New release s390-tools-2.13.0

Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

AUTHORS.md

@@ -47,6 +47,7 @@ List of all individuals having contributed content to s390-tools
 - Jan Glauber
 - Jan Hoeppner
 - Jan Willeke
+- Jason J. Herne
 - Javier Martinez Canillas
 - Jean-Baptiste Joret
 - Jens Remus
@@ -58,6 +59,7 @@ List of all individuals having contributed content to s390-tools
 - Lakhvich Dmitriy
 - Marc Hartmayer
 - Mark Dettinger
+- Mark Post
 - Martin Kammerer
 - Martin Peschke
 - Martin Petermann
@@ -69,6 +71,7 @@ List of all individuals having contributed content to s390-tools
 - Michael Mueller
 - Mijo Safradin
 - Mikhail Zaslonko
+- Niklas Schnelle
 - Peter Oberparleiter
 - Peter Tiedemann
 - Philipp Kern
@@ -98,6 +101,7 @@ List of all individuals having contributed content to s390-tools
 - Thomas Richter
 - Thomas Spatzier
 - Thomas Weber
+- Tuan Hoang
 - Ursula Braun
 - Utz Bacher
 - Vasily Gorbik

CHANGELOG.md

@@ -1,6 +1,63 @@
 Release history for s390-tools (MIT version)
 --------------------------------------------
- * __v2.11.0 (2019-09-06)__
+* __v2.13.0 (2020-05-06)__
+
+  For Linux kernel version: 5.5 / 5.6
+
+  Add new tool:
+  - genprotimg: Add genprotimg to create protected virtualization images
+  - genprotimg: Add sample script to verify host keys
+
+  Changes of existing tools:
+  - dbginfo: Gather bridge related data (using 'bridge')
+  - dbginfo: Removed collection of /var/log/opencryptoki/
+  - dbginfo: collect softnet_stat
+  - dbginfo: gather ethtool output for per-queue coalescing
+  - ipl_tools: Support clear attribute for FCP and CCW re-IPL
+  - zdev: Report FC Endpoint Security of zfcp devices
+  - zdev/dracut/95zdev/module-setup.sh: Add ctcm kernel module
+  - cpumf/data: Add new deflate counters for IBM z15
+  - zkey: Add support for EP11 secure keys
+  - zpcictl: Initiate recover after reset
+  - zipl: Add support for NVMe devices
+  - zipl: A multitude of code and stability improvements
+
+  Bug Fixes:
+  - zipl: Prevent endless loop during IPL
+  - zipl/libc: Fix potential buffer overflow in printf
+  - zkey: Fix listing of keys on file systems reporting DT_UNKNOWN
+  - zkey: Fix display of clear key size for XTS, CCA-AESCIPHER, and EP11-AES XTS keys
+
+
+* __v2.12.0 (2019-12-17)__
+
+  For Linux kernel version: 5.4
+
+  Changes of existing tools:
+  - dbginfo: Gather qdisc related data (using 'tc')
+  - dbginfo: Gather extended network statistics (using 'ip link')
+  - dbginfo: Collect all files under /usr/lib/systemd/system/
+  - cpumf/cpumf_helper: Add IBM z15 machine name
+  - zkey: Display MKVP when validating a secure key
+  - zkey: Cross check APQNs when generating, validating, or importing secure keys,
+      and when changing APQN associations
+  - zkey: Check crypto card level during APQN cross checking
+  - zkey: Add support for generating, validating, and re-enciphering AES CIPHER keys
+  - zkey-cryptsetup: Add --to-new and --from-old options
+  - zkey-cryptsetup: Allow setkey to set different key types
+  - lszcrypt/chzcrypt: CEX7S exploitation support
+  - zcryptstats: Add support for CEX7 crypto card
+  - zipl: Ship a minimal zipl.conf
+  - zipl: Add value of target= as search path for BLS case
+
+  Bug Fixes:
+  - dasdview: Fix exit status in error cases
+  - zipl: Fix various compile warnings
+  - zipl: Fix dependency generation in zipl/boot
+  - zipl: Fix entry point for stand-alone kdump
+  - zipl: Add missing options to help output
+
+* __v2.11.0 (2019-09-06)__
 
   For Linux kernel version: 5.3
 
@@ -16,7 +73,7 @@ Release history for s390-tools (MIT version)
   - zipl: Fix freeing of uninitialized pointer
   - zipl: Set correct secure IPL default value
 
- * __v2.10.0 (2019-07-31)__
+* __v2.10.0 (2019-07-31)__
 
   For Linux kernel version: 5.2
 
@@ -34,7 +91,7 @@ Release history for s390-tools (MIT version)
   - zipl: Do not overwrite BOOT_IMAGE entry
   - zkey: Fix auto-detection of clear key bitsize for XTS keys
 
- * __v2.9.0 (2019-05-21)__
+* __v2.9.0 (2019-05-21)__
 
   For Linux kernel version: 5.0 / 5.1
 
@@ -67,7 +124,7 @@ Release history for s390-tools (MIT version)
   - zfcpdbf: Warn about ambiguous payload records with dup reqid & payarea
   - zpcictl: Check for regular directory to prevent possible buffer overflow
 
- * __v2.8.0 (2019-02-15)__
+* __v2.8.0 (2019-02-15)__
 
   For Linux kernel version: 4.20
 
@@ -81,7 +138,7 @@ Release history for s390-tools (MIT version)
   - zkey: Avoid EPERM on key change if user is not owner of key file
   - cpumf/cpumf_helper: Always return list reference for --sfb-size
 
- * __v2.7.1 (2018-12-13)__
+* __v2.7.1 (2018-12-13)__
 
   For Linux kernel version: 4.19
 
@@ -105,7 +162,7 @@ Release history for s390-tools (MIT version)
       ip_watcher, libvmdump, libvtoc, lsqeth, lszcrypt, qethqoat, zdev, zdsfs,
       zgetdump, zipl, zpcictl
 
- * __v2.7.0 (2018-10-31)__
+* __v2.7.0 (2018-10-31)__
 
   For Linux kernel version: 4.19
 
@@ -130,7 +187,7 @@ Release history for s390-tools (MIT version)
   - Direct --help and --version output to stdout for several tools
   - osasnmpd: Start without real OSA devices
 
- * __v2.6.0 (2018-08-10)__
+* __v2.6.0 (2018-08-10)__
 
   For Linux kernel version: 4.18
 
@@ -144,7 +201,7 @@ Release history for s390-tools (MIT version)
   - netboot: Include compressed kernel modules in initramfs
   - netboot: Send client architecture and handle path prefix
 
- * __v2.5.0 (2018-06-08)__
+* __v2.5.0 (2018-06-08)__
 
   For Linux kernel version: 4.17
 
@@ -156,7 +213,7 @@ Release history for s390-tools (MIT version)
   Bug Fixes:
   - lsluns: Print a message if no adapter or port exists
 
- * __v2.4.0 (2018-05-07)__
+* __v2.4.0 (2018-05-07)__
 
   For Linux kernel version: 4.16
 

Makefile

@@ -8,7 +8,9 @@ TOOL_DIRS = zipl zdump fdasd dasdfmt dasdview tunedasd \
 	   tape390 osasnmpd qetharp ip_watcher qethconf scripts zconf \
 	   vmconvert vmcp man mon_tools dasdinfo vmur cpuplugd ipl_tools \
 	   ziomon iucvterm hyptop cmsfs-fuse qethqoat zfcpdump zdsfs cpumf \
-	   systemd hmcdrvfs cpacfstats zdev dump2tar zkey netboot etc zpcictl
+	   systemd hmcdrvfs cpacfstats zdev dump2tar zkey netboot etc zpcictl \
+	   genprotimg
+
 SUB_DIRS = $(LIB_DIRS) $(TOOL_DIRS)
 
 all: $(TOOL_DIRS)

README.md

@@ -1,4 +1,3 @@
-
 s390-tools
 ==========
 
@@ -31,6 +30,9 @@ Package contents
  * dasdinfo:
    Display unique DASD ID, either UID or volser.
 
+ * genprotimg:
+   Create a protected virtualization image.
+
  * udev rules:
    - 59-dasd.rules: rules for unique DASD device nodes created in /dev/disk/.
    - 57-osasnmpd.rules: udev rules for osasnmpd.
@@ -265,9 +267,10 @@ build options:
 | pfm            | `HAVE_PFM`         | cpacfstats                            |
 | net-snmp       | `HAVE_SNMP`        | osasnmpd                              |
 | glibc-static   | `HAVE_LIBC_STATIC` | zfcpdump                              |
-| openssl        | `HAVE_OPENSSL`     | zkey                                  |
+| openssl        | `HAVE_OPENSSL`     | genprotimg,zkey                       |
 | cryptsetup     | `HAVE_CRYPTSETUP2` | zkey-cryptsetup                       |
 | json-c         | `HAVE_JSONC`       | zkey-cryptsetup                       |
+| glib2          | `HAVE_GLIB2`       | genprotimg                            |
 
 This table lists additional build or install options:
 
@@ -288,6 +291,14 @@ the different tools are provided:
 * dbginfo.sh:
   The tar package is required to archive collected data.
 
+* genprotimg:
+  For building genprotimg you need OpenSSL version 1.1.0 or newer
+  installed (openssl-devel.rpm). Also required is glib2
+  (glib2-devel.rpm). Tip: you may skip the genprotimg build by adding
+  `HAVE_OPENSSL=0` or `HAVE_GLIB2=0`.
+
+  The runtime requirements are: openssl-libs (>= 1.1.0) and glib2.
+
 * osasnmpd:
   You need at least the NET-SNMP 5.1.x package (net-snmp-devel.rpm)
   installed, before building the osasnmpd subagent.

cmsfs-fuse/dasd.c

@@ -19,6 +19,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include "lib/zt_common.h"
 #include "cmsfs-fuse.h"
 #include "edf.h"
 #include "helper.h"

cmsfs-fuse/helper.h

@@ -49,6 +49,4 @@ extern FILE *logfile;
 		fprintf(stderr, COMP "Warning, " __VA_ARGS__);		\
 	} while (0)
 
-#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
-
 #endif

common.mak

@@ -5,7 +5,7 @@ COMMON_INCLUDED = true
 # The variable "DISTRELEASE" should be overwritten in rpm spec files with:
 # "make DISTRELEASE=%{release}" and "make install DISTRELEASE=%{release}"
 VERSION            = 2
-RELEASE            = 11
+RELEASE            = 13
 PATCHLEVEL         = 0
 DISTRELEASE        = build-$(shell date +%Y%m%d)
 S390_TOOLS_RELEASE = $(VERSION).$(RELEASE).$(PATCHLEVEL)-$(DISTRELEASE)

cpumf/Makefile

@@ -9,7 +9,8 @@ DATA_FILES = cpum-cf-hw-counter.map \
 	     cpum-cf-csvn-12345.ctr cpum-cf-csvn-6.ctr \
              cpum-cf-extended-z10.ctr cpum-cf-extended-z196.ctr \
 	     cpum-cf-extended-zEC12.ctr cpum-sf-modes.ctr \
-	     cpum-cf-extended-z13.ctr cpum-cf-extended-z14.ctr
+	     cpum-cf-extended-z13.ctr cpum-cf-extended-z14.ctr \
+	     cpum-cf-extended-z15.ctr
 LIB_FILES = bin/cpumf_helper
 USRBIN_SCRIPTS = bin/lscpumf
 USRSBIN_SCRIPTS = bin/chcpumf

cpumf/bin/cpumf_helper.in

@@ -12,8 +12,6 @@ use warnings;
 use Carp qw/croak/;
 use Data::Dumper;
 use Getopt::Long qw/:config no_ignore_case/;
-use Pod::Usage;
-
 
 # Global constants
 my $SERVICE_LEVELS = '/proc/service_levels';
@@ -213,6 +211,7 @@ my $system_z_hwtype_map = {
 	2965		=> 'IBM z13s',
 	3906		=> 'IBM z14',
 	3907		=> 'IBM z14 ZR1',
+	8561		=> 'IBM z15',
 };
 
 sub get_hardware_type()
@@ -351,6 +350,62 @@ sub cpumf_hardware_counter_map()
 	return $map;
 }
 
+my $cpumf_helper_str = <<'END_MESSAGE';
+
+cpumf_helper - Helper module for managing CPU-Measurement Facilities (CPU-MF)
+
+Options:
+-i, --info:
+	Displays detailed information about installed and available
+	CPU-measurement facilities and the related Linux support.
+
+-c, --counter authorization_value
+	Displays counter information for the current System z hardware.
+	The authorization value provides information about the authorized
+	counter sets. The value must be specified in decimal format.
+
+	To display all supported counters, specify C<65535> (FFFF hex).
+
+	To display supported counters for a particular System z hardware,
+	use the --ctr-def option and specify the System z hardware type.
+
+--hardware-type
+	Displays the System z hardware type.
+
+--ctr-def ctr-definition
+	Displays detailed information about the specified counter definition.
+	Valid counter definitions start with C<cfvn-> or <csvn-> followed by
+	the counter first/second version number of the CPU-Measurement Counter
+	Facility.  To display counter information of model-specific counter
+	sets, specify the System z hardware type for I<ctr-definition>.
+
+--ctr-set-names
+	Displays the mapping of counter set IDs to counter set names.
+	The counter set IDs are numbers that are used in counter definitions.
+
+--ctr-set-ids
+	Displays the counter set IDs.  The counter set IDs are numbers that
+	match the authorization bits (see QUERY COUNTER INFORMATION).
+	The output format is a list. To get the ID for a particular counter
+	set, use an index number as follows:
+
+	0: Basic Counter Set
+	1: Problem-State Counter Set
+	2: Crypto-Activity Counter Set
+	3: Extended Counter Set
+	4: MT-diagnostic Counter Set
+	5: Coprocessor Group Counter Set
+
+--ctr-sf
+	Displays the counter definitions for the sampling facility support.
+	These counter definitions are specific to Linux perf infrastructure.
+
+--sfb-size
+	Displays the size of the sampling facility buffer (SFB). The minimum
+	and maximum numbers are measured in units of sample-data-blocks. A
+	sample-data-block uses about 4 kilobytes.
+
+END_MESSAGE
 
 sub cpumf_helper_main()
 {
@@ -368,8 +423,8 @@ sub cpumf_helper_main()
 		"ctr-set-ids"	=> \$conf->{opt_ctrset_ids},
 		"sfb-size"	=> \$conf->{opt_sfb_size},
 		"ctr-sf"	=> \$conf->{opt_sf_ctr},
-	) or pod2usage(-message =>"One or more options are not valid",
-		       -exitval => 1);
+	) or die("One or more options are not valid\n" . $cpumf_helper_str);
+
 
 	# Setting up Data::Dumper to create parseable Perl output
 	local $Data::Dumper::Purity = 1;
@@ -421,8 +476,7 @@ sub cpumf_helper_main()
 		$result = cpumf_counter_set_ids();
 
 	} else {
-		pod2usage(-message => "No option specified",
-			  -exitval => 1);
+		die("No option specified\n" . $cpumf_helper_str);
 	}
 
 	# Display result
@@ -433,93 +487,3 @@ sub cpumf_helper_main()
 &cpumf_helper_main();
 __DATA__
 __END__
-=head1 NAME
-
-B<cpumf_helper> - Helper module for managing CPU-Measurement Facilities (CPU-MF)
-
-=head1 SYNOPSIS
-
-=head1 DESCRIPTION
-
-The B<cpumf_helper> program is not intended for ordinary use.
-
-=head1 OPTIONS
-
-=over 8
-
-=item B<-i>, B<--info>
-
-Displays detailed information about installed and available CPU-measurement
-facilities and the related Linux support.
-
-=item B<-c>, B<--counter> I<authorization_value>
-
-Displays counter information for the current System z hardware.  The
-authorization value provides information about the authorized counter sets.  The
-value must be specified in decimal format.
-
-To display all supported counters, specify C<65535> (FFFF hex).
-
-To display supported counters for a particular System z hardware, use the
-B<--ctr-def> option and specify the System z hardware type.
-
-=item B<--hardware-type>
-
-Displays the System z hardware type.
-
-=item B<--ctr-def> I<ctr-definition>
-
-Displays detailed information about the specified counter definition.
-Valid counter definitions start with C<cfvn-> or <csvn-> followed by
-the counter first/second version number of the CPU-Measurement Counter
-Facility.  To display counter information of model-specific counter
-sets, specify the System z hardware type for I<ctr-definition>.
-
-=item B<--ctr-set-names>
-
-Displays the mapping of counter set IDs to counter set names.  The counter set
-IDs are numbers that are used in counter definitions.
-
-=item B<--ctr-set-ids>
-
-Displays the counter set IDs.  The counter set IDs are numbers that match the
-authorization bits (see QUERY COUNTER INFORMATION).  The output format is a
-list.  To get the ID for a particular counter set, use an index number as
-follows:
-
-=over 16
-
-=item 0: Basic Counter Set
-
-=item 1: Problem-State Counter Set
-
-=item 2: Crypto-Activity Counter Set
-
-=item 3: Extended Counter Set
-
-=item 4: MT-diagnostic Counter Set
-
-=item 5: Coprocessor Group Counter Set
-
-=back
-
-=item B<--ctr-sf>
-
-Displays the counter definitions for the sampling facility support.  These
-counter definitions are specific to Linux perf infrastructure.
-
-=item B<--sfb-size>
-
-Displays the size of the sampling facility buffer (SFB).  The minimum and
-maximum numbers are measured in units of sample-data-blocks.  A
-sample-data-block uses about 4 kilobytes.
-
-=back
-
-=head1 FILES
-
-=head1 SEE ALSO
-
-L<lscpumf(1)>, L<chcpumf(1)>
-
-=cut

cpumf/data/cpum-cf-extended-z15.ctr

@@ -0,0 +1,376 @@
+# Counter decriptions for the
+#	IBM z14 extended counter and MT-diagnostic counter set
+#
+# Notes for transactional-execution mode symbolic names:
+#	TX .. transactional-execution mode
+#	NC .. nonconstrained
+#	 C .. constrained
+#
+# Undefined counters in the extended counter set:
+#	142
+#	158-161
+#	176-223
+#	227-231
+#	233-242
+#	246-255
+# Undefined counters in the MT-diagnostic counter set:
+#	450-495
+#
+#
+# Extended Counter Set
+# ---------------------------------------------------------------------
+Counter:128	Name:L1D_RO_EXCL_WRITES
+Short-Description:L1D Read-only Exclusive Writes
+Description:
+A directory write to the Level-1 Data cache where the line was
+originally in a Read-Only state in the cache but has been updated
+to be in the Exclusive state that allows stores to the cache line
+.
+Counter:129	Name:DTLB2_WRITES
+Short-Description:DTLB2 Writes
+Description:
+A translation has been written into The Translation Lookaside
+Buffer 2 (TLB2) and the request was made by the data cache
+.
+Counter:130	Name:DTLB2_MISSES
+Short-Description:DTLB2 Misses
+Description:
+A TLB2 miss is in progress for a request made by the data cache.
+Incremented by one for every TLB2 miss in progress for the Level-1
+Data cache on this cycle
+.
+Counter:131	Name:DTLB2_HPAGE_WRITES
+Short-Description:DTLB2 One-Megabyte Page Writes
+Description:
+A translation entry was written into the Combined Region and Segment
+Table Entry array in the Level-2 TLB for a one-megabyte page
+.
+Counter:132	Name:DTLB2_GPAGE_WRITES
+Short-Description:DTLB2 Two-Gigabyte Page Writes
+Description:
+A translation entry for a two-gigabyte page was written into the
+Level-2 TLB
+.
+Counter:133	Name:L1D_L2D_SOURCED_WRITES
+Short-Description:L1D L2D Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the
+returned cache line was sourced from the Level-2 Data cache
+.
+Counter:134	Name:ITLB2_WRITES
+Short-Description:ITLB2 Writes
+Description:
+A translation entry has been written into the Translation Lookaside
+Buffer 2 (TLB2) and the request was made by the instruction cache
+.
+Counter:135	Name:ITLB2_MISSES
+Short-Description:ITLB2 Misses
+Description:
+A TLB2 miss is in progress for a request made by the instruction cache.
+Incremented by one for every TLB2 miss in progress for the Level-1
+Instruction cache in a cycle
+.
+Counter:136	Name:L1I_L2I_SOURCED_WRITES
+Short-Description:L1I L2I Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from the Level-2 Instruction cache
+.
+Counter:137	Name:TLB2_PTE_WRITES
+Short-Description:TLB2 PTE Writes
+Description:
+A translation entry was written into the Page Table Entry array in the
+Level-2 TLB
+.
+Counter:138	Name:TLB2_CRSTE_WRITES
+Short-Description:TLB2 CRSTE Writes
+Description:
+Translation entries were written into the Combined Region and Segment
+Table Entry array and the Page Table Entry array in the Level-2 TLB
+.
+Counter:139	Name:TLB2_ENGINES_BUSY
+Short-Description:TLB2 Engines Busy
+Description:
+The number of Level-2 TLB translation engines busy in a cycle
+.
+Counter:140	Name:TX_C_TEND
+Short-Description:Completed TEND instructions in constrained TX mode
+Description:
+A TEND instruction has completed in a constrained transactional-execution
+mode
+.
+Counter:141	Name:TX_NC_TEND
+Short-Description:Completed TEND instructions in non-constrained TX mode
+Description:
+A TEND instruction has completed in a non-constrained
+transactional-execution mode
+.
+Counter:143	Name:L1C_TLB2_MISSES
+Short-Description:L1C TLB2 Misses
+Description:
+Increments by one for any cycle where a level-1 cache or level-2 TLB miss
+is in progress
+.
+Counter:144	Name:L1D_ONCHIP_L3_SOURCED_WRITES
+Short-Description:L1D On-Chip L3 Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an On-Chip Level-3 cache without intervention
+.
+Counter:145	Name:L1D_ONCHIP_MEMORY_SOURCED_WRITES
+Short-Description:L1D On-Chip Memory Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from On-Chip memory
+.
+Counter:146	Name:L1D_ONCHIP_L3_SOURCED_WRITES_IV
+Short-Description:L1D On-Chip L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an On-Chip Level-3 cache with intervention
+.
+Counter:147	Name:L1D_ONCLUSTER_L3_SOURCED_WRITES
+Short-Description:L1D On-Cluster L3 Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from On-Cluster Level-3 cache withountervention
+.
+Counter:148	Name:L1D_ONCLUSTER_MEMORY_SOURCED_WRITES
+Short-Description:L1D On-Cluster Memory Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an On-Cluster memory
+.
+Counter:149	Name:L1D_ONCLUSTER_L3_SOURCED_WRITES_IV
+Short-Description:L1D On-Cluster L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an On-Cluster Level-3 cache with intervention
+.
+Counter:150	Name:L1D_OFFCLUSTER_L3_SOURCED_WRITES
+Short-Description:L1D Off-Cluster L3 Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an Off-Cluster Level-3 cache without
+intervention
+.
+Counter:151	Name:L1D_OFFCLUSTER_MEMORY_SOURCED_WRITES
+Short-Description:L1D Off-Cluster Memory Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from Off-Cluster memory
+.
+Counter:152	Name:L1D_OFFCLUSTER_L3_SOURCED_WRITES_IV
+Short-Description:L1D Off-Cluster L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an Off-Cluster Level-3 cache with intervention
+.
+Counter:153	Name:L1D_OFFDRAWER_L3_SOURCED_WRITES
+Short-Description:L1D Off-Drawer L3 Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an Off-Drawer Level-3 cache without
+intervention
+.
+Counter:154	Name:L1D_OFFDRAWER_MEMORY_SOURCED_WRITES
+Short-Description:L1D Off-Drawer Memory Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from Off-Drawer memory
+.
+Counter:155	Name:L1D_OFFDRAWER_L3_SOURCED_WRITES_IV
+Short-Description:L1D Off-Drawer L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from an Off-Drawer Level-3 cache with intervention
+.
+Counter:156	Name:L1D_ONDRAWER_L4_SOURCED_WRITES
+Short-Description:L1D On-Drawer L4 Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from On-Drawer Level-4 cache
+.
+Counter:157	Name:L1D_OFFDRAWER_L4_SOURCED_WRITES
+Short-Description:L1D Off-Drawer L4 Sourced Writes
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from Off-Drawer Level-4 cache
+.
+Counter:158	Name:L1D_ONCHIP_L3_SOURCED_WRITES_RO
+Short-Description:L1D On-Chip L3 Sourced Writes read-only
+Description:
+A directory write to the Level-1 Data cache directory where the returned
+cache line was sourced from On-Chip L3 but a read-only invalidate was
+done to remove other copies of the cache line
+.
+Counter:162	Name:L1I_ONCHIP_L3_SOURCED_WRITES
+Short-Description:L1I On-Chip L3 Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache ine was sourced from an On-Chip Level-3 cache without
+intervention
+.
+Counter:163	Name:L1I_ONCHIP_MEMORY_SOURCED_WRITES
+Short-Description:L1I On-Chip Memory Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache ine was sourced from On-Chip memory
+.
+Counter:164	Name:L1I_ONCHIP_L3_SOURCED_WRITES_IV
+Short-Description:L1I On-Chip L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache ine was sourced from an On-Chip Level-3 cache with
+intervention
+.
+Counter:165	Name:L1I_ONCLUSTER_L3_SOURCED_WRITES
+Short-Description:L1I On-Cluster L3 Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from an On-Cluster Level-3 cache without
+intervention
+.
+Counter:166	Name:L1I_ONCLUSTER_MEMORY_SOURCED_WRITES
+Short-Description:L1I On-Cluster Memory Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from an On-Cluster memory
+.
+Counter:167	Name:L1I_ONCLUSTER_L3_SOURCED_WRITES_IV
+Short-Description:L1I On-Cluster L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from On-Cluster Level-3 cache with
+intervention
+.
+Counter:168	Name:L1I_OFFCLUSTER_L3_SOURCED_WRITES
+Short-Description:L1I Off-Cluster L3 Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from an Off-Cluster Level-3 cache without
+intervention
+.
+Counter:169	Name:L1I_OFFCLUSTER_MEMORY_SOURCED_WRITES
+Short-Description:L1I Off-Cluster Memory Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from Off-Cluster memory
+.
+Counter:170	Name:L1I_OFFCLUSTER_L3_SOURCED_WRITES_IV
+Short-Description:L1I Off-Cluster L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from an Off-Cluster Level-3 cache with
+intervention
+.
+Counter:171	Name:L1I_OFFDRAWER_L3_SOURCED_WRITES
+Short-Description:L1I Off-Drawer L3 Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from an Off-Drawer Level-3 cache without
+intervention
+.
+Counter:172	Name:L1I_OFFDRAWER_MEMORY_SOURCED_WRITES
+Short-Description:L1I Off-Drawer Memory Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from Off-Drawer memory
+.
+Counter:173	Name:L1I_OFFDRAWER_L3_SOURCED_WRITES_IV
+Short-Description:L1I Off-Drawer L3 Sourced Writes with Intervention
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from an Off-Drawer Level-3 cache with
+intervention
+.
+Counter:174	Name:L1I_ONDRAWER_L4_SOURCED_WRITES
+Short-Description:L1I On-Drawer L4 Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from On-Drawer Level-4 cache
+.
+Counter:175	Name:L1I_OFFDRAWER_L4_SOURCED_WRITES
+Short-Description:L1I Off-Drawer L4 Sourced Writes
+Description:
+A directory write to the Level-1 Instruction cache directory where the
+returned cache line was sourced from Off-Drawer Level-4 cache
+.
+Counter:224	Name:BCD_DFP_EXECUTION_SLOTS
+Short-Description:BCD DFP Execution Slots
+Description:
+Count of floating point execution slots used for finished Binary Coded
+Decimal to Decimal Floating Point conversions. Instructions: CDZT,
+CXZT, CZDT, CZXT
+.
+Counter:225	Name:VX_BCD_EXECUTION_SLOTS
+Short-Description:VX BCD Execution Slots
+Description:
+Count of floating point execution slots used for finished vector arithmetic
+Binary Coded Decimal instructions. Instructions: VAP, VSP, VMPVMSP, VDP,
+VSDP, VRP, VLIP, VSRP, VPSOPVCP, VTP, VPKZ, VUPKZ, VCVB, VCVBG, VCVDVCVDG
+.
+Counter:226	Name:DECIMAL_INSTRUCTIONS
+Short-Description:Decimal Instructions
+Description:
+Decimal instructions dispatched. Instructions: CVB, CVD, AP, CP, DP, ED,
+EDMK, MP, SRP, SP, ZAP
+.
+Counter:232	Name:LAST_HOST_TRANSLATIONS
+Short-Description:Last host translation done
+Description:
+Last Host Translation done
+.
+Counter:243	Name:TX_NC_TABORT
+Short-Description:Aborted transactions in non-constrained TX mode
+Description:
+A transaction abort has occurred in a non-constrained
+transactional-execution mode
+.
+Counter:244	Name:TX_C_TABORT_NO_SPECIAL
+Short-Description:Aborted transactions in constrained TX mode not using special completion logic
+Description:
+A transaction abort has occurred in a constrained transactional-execution
+mode and the CPU is not using any special logic to allow the transaction
+to complete
+.
+Counter:245	Name:TX_C_TABORT_SPECIAL
+Short-Description:Aborted transactions in constrained TX mode using special completion logic
+Description:
+A transaction abort has occurred in a constrained transactional-execution
+mode and the CPU is using special logic to allow the transaction to
+complete
+.
+Counter:247     Name:DFLT_ACCESS
+Short-Description:Cycles CPU spent obtaining access to Deflate unit
+Description:
+Cycles CPU spent obtaining access to Deflate unit
+.
+Counter:252     Name:DFLT_CYCLES
+Short-Description:Cycles CPU is using Deflate unit
+Description:
+Cycles CPU is using Deflate unit
+.
+Counter:264     Name:DFLT_CC
+Short-Description:Increments by one for every DEFLATE CONVERSION CALL instruction executed
+Description:
+Increments by one for every DEFLATE CONVERSION CALL instruction executed
+.
+Counter:265     Name:DFLT_CCERROR
+Short-Description:Increments by one for every DEFLATE CONVERSION CALL instruction executed that ended in Condition Codes 0, 1 or 2
+Description:
+Increments by one for every DEFLATE CONVERSION CALL instruction executed that ended in Condition Codes 0, 1 or 2
+.
+#
+# MT-diagnostic counter set
+# ---------------------------------------------------------------------
+Counter:448	Name:MT_DIAG_CYCLES_ONE_THR_ACTIVE
+Short-Description:Cycle count with one thread active
+Description:
+Cycle count with one thread active
+.
+Counter:449	Name:MT_DIAG_CYCLES_TWO_THR_ACTIVE
+Short-Description:Cycle count with two threads active
+Description:
+Cycle count with two threads active
+.

cpumf/data/cpum-cf-hw-counter.map

@@ -28,7 +28,6 @@
 	2965		=> 'cpum-cf-extended-z13.ctr',
 	3906		=> 'cpum-cf-extended-z14.ctr',
 	3907		=> 'cpum-cf-extended-z14.ctr',
-	# Identical with z14
-	8561		=> 'cpum-cf-extended-z14.ctr',
-	8562		=> 'cpum-cf-extended-z14.ctr',
+	8561		=> 'cpum-cf-extended-z15.ctr',
+	8562		=> 'cpum-cf-extended-z15.ctr',
 };

cpuplugd/cpuplugd.h

@@ -152,7 +152,6 @@ struct symbol_names {
 };
 
 extern int foreground;
-extern int debug;
 extern char *configfile;
 extern int debug;        /* is verbose specified? */
 extern int memory;

dasdinfo/dasdinfo.c

@@ -290,7 +290,7 @@ static int dinfo_create_devnode(dev_t dev, char **devno)
 	mode = S_IFBLK | S_IRWXU;
 
 	/* Try several locations for the temporary device node. */
-	for (path = 0; path < UTIL_ARRAY_SIZE(pathname); path++) {
+	for (path = 0; path < ARRAY_SIZE(pathname); path++) {
 		if (pathname[path] == NULL)
 			continue;
 		for (retry = 0; retry < TEMP_DEV_MAX_RETRIES; retry++) {

dasdview/dasdview.c

@@ -160,19 +160,19 @@ dasdview_get_info(dasdview_info_t *info)
 		if (err != EBADF)
 			zt_error_print("dasdview: "
 				       "Could not retrieve geo information!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if (dasd_get_blocksize(info->device, &info->blksize) != 0) {
 		zt_error_print("dasdview: "
 			       "Could not retrieve blocksize information!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if (dasd_get_info(info->device, &info->dasd_info) != 0) {
 		zt_error_print("dasdview: "
 			       "Could not retrieve disk information!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	characteristics = (struct dasd_eckd_characteristics *)
@@ -261,7 +261,7 @@ dasdview_parse_input(unsigned long long *p, dasdview_info_t *info, char *s)
 error:
 	zt_error_print("dasdview: usage error\n"
 		       "%s is not a valid begin/size value!", s);
-	exit(-1);
+	exit(EXIT_FAILURE);
 }
 
 /*
@@ -404,7 +404,7 @@ dasdview_print_extended_info(dasdview_info_t *info)
 	if (dasd_info->features == DASD_FEATURE_DEFAULT) {
 		printf("default\n");
 	} else {
-		for (i = 0; i < UTIL_ARRAY_SIZE(flist); i++)
+		for (i = 0; i < ARRAY_SIZE(flist); i++)
 			if (dasd_info->features & flist[i].mask)
 				printf("%s ", flist[i].name);
 		printf("\n");
@@ -454,7 +454,7 @@ dasdview_print_vlabel(dasdview_info_t *info)
 		if (rc) {
 			zt_error_print("error when reading label from device:"
 				       " rc=%d\n", rc);
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 		lzds_dasd_get_vlabel(info->dasd, &tmpvlabel);
 		memcpy(&vlabel, tmpvlabel, sizeof(vlabel));
@@ -600,7 +600,7 @@ dasdview_print_volser(dasdview_info_t *info)
 		if (rc) {
 			zt_error_print("error when reading label from device:"
 				       " rc=%d\n", rc);
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 		lzds_dasd_get_vlabel(info->dasd, &tmpvlabel);
 		memcpy(&vlabel, tmpvlabel, sizeof(vlabel));
@@ -644,7 +644,7 @@ dasdview_read_vtoc(dasdview_info_t *info)
 		zt_error_print("dasdview: disk layout error\n"
 			       "%s is not formatted with the z/OS "
 			       "compatible disk layout!\n", info->device);
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	vtocblk = (u_int64_t)vtoc_get_cyl_from_cchhb(&vlabel.vtoc) *
@@ -664,7 +664,7 @@ dasdview_read_vtoc(dasdview_info_t *info)
 	if ((vtocblk <= 0) || (vtocblk > maxblk)) {
 		zt_error_print("dasdview: VTOC error\n"
 			       "Volume label VTOC pointer is not valid!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	vtoc_read_label(info->device, (vtocblk - 1) * info->blksize,
@@ -676,7 +676,7 @@ dasdview_read_vtoc(dasdview_info_t *info)
 		/* format4 DSCB is invalid */
 		zt_error_print("dasdview: VTOC error\n"
 			       "Format 4 DSCB is invalid!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	info->f4c++;
@@ -724,19 +724,19 @@ dasdview_read_vtoc(dasdview_info_t *info)
 	if (info->f4c > 1) {
 		zt_error_print("dasdview: VTOC error\n"
 			       "More than one FMT4 DSCB!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if (info->f5c > 1) {
 		zt_error_print("dasdview: VTOC error\n"
 			       "More than one FMT5 DSCB!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if (info->f7c > 1) {
 		zt_error_print("dasdview: VTOC error\n"
 			       "More than one FMT7 DSCB!\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 }
 
@@ -975,7 +975,7 @@ static void dasdview_print_format1_8_short_info_raw(format1_label_t *f1,
 	}
 	if (rc) {
 		zt_error_print("dasdview: Broken format 3 DSCB chain \n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	f3 = (dscb && dscb->fmtid == 0xf3) ? (format3_label_t *)dscb : NULL;
 
@@ -990,7 +990,7 @@ static void dasdview_print_format1_8_short_info_raw(format1_label_t *f1,
 		if (f3->DS3FMTID != 0xf3) {
 			zt_error_print("dasdview: Broken format 3 DSCB"
 				       " chain \n");
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 		for (j = 0; j < 4; ++j)
 			dasdview_print_short_info_extent_raw(&f3->DS3EXTNT[j]);
@@ -1002,7 +1002,7 @@ static void dasdview_print_format1_8_short_info_raw(format1_label_t *f1,
 		if (rc) {
 			zt_error_print("dasdview: Broken format 3 DSCB"
 				       " chain \n");
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 	}
 	printf("\n");
@@ -1025,7 +1025,7 @@ static void dasdview_print_vtoc_info_raw(dasdview_info_t *info)
 	rc = lzds_raw_vtoc_alloc_dscbiterator(info->rawvtoc, &it);
 	if (rc) {
 		zt_error_print("dasdview: could not allocate DSCB iterator \n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	while (!lzds_dscbiterator_get_next_dscb(it, &dscb)) {
 		if (dscb->fmtid == 0xf1)
@@ -1058,7 +1058,7 @@ static void dasdview_print_vtoc_info_raw(dasdview_info_t *info)
 	rc = lzds_raw_vtoc_alloc_dscbiterator(info->rawvtoc, &it);
 	if (rc) {
 		zt_error_print("dasdview: could not allocate DSCB iterator \n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	while (!lzds_dscbiterator_get_next_dscb(it, &dscb)) {
 		if (dscb->fmtid == 0xf1 || dscb->fmtid == 0xf8)
@@ -1739,23 +1739,23 @@ static void dasdview_print_vtoc_raw(dasdview_info_t *info)
 	if (rc) {
 		zt_error_print("error when reading label from device:"
 			       " rc=%d\n", rc);
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	rc = lzds_dasd_alloc_rawvtoc(info->dasd);
 	if (rc == EINVAL) {
 		zt_error_print("dasdview: Cannot read VTOC because disk does"
 			       " not contain valid VOL1 label.\n",
 			       info->device);
-		exit(-1);
+		exit(EXIT_FAILURE);
 	} else if (rc) {
 		zt_error_print("error when reading vtoc from device:"
 			       " rc=%d\n", rc);
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	rc = lzds_dasd_get_rawvtoc(info->dasd, &info->rawvtoc);
 	if (rc || !info->rawvtoc) {
 		zt_error_print("dasdview: libvtoc could not read vtoc\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if (info->vtoc_info || info->vtoc_all)
@@ -1764,7 +1764,7 @@ static void dasdview_print_vtoc_raw(dasdview_info_t *info)
 	rc = lzds_raw_vtoc_alloc_dscbiterator(info->rawvtoc, &it);
 	if (rc) {
 		zt_error_print("dasdview: could not allocate DSCB iterator\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	while (!lzds_dscbiterator_get_next_dscb(it, &record))
 		dasdview_print_vtoc_dscb(info, record);
@@ -1858,7 +1858,7 @@ static void dasdview_view_standard(dasdview_info_t *info)
 		zt_error_print("dasdview: open error\n"
 			       "Unable to open device %s in read-only mode!\n",
 			       info->device);
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	j = (info->begin / SEEK_STEP);
@@ -1877,7 +1877,7 @@ static void dasdview_view_standard(dasdview_info_t *info)
 			zt_error_print("dasdview: seek error\n"
 				       "Unable to seek in device %s!\n",
 				       info->device);
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 		b++;
 		a += SEEK_STEP;
@@ -1890,7 +1890,7 @@ static void dasdview_view_standard(dasdview_info_t *info)
 			zt_error_print("dasdview: seek error\n"
 				       "Unable to seek in device %s!\n",
 				       info->device);
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 	}
 
@@ -1926,7 +1926,7 @@ static void dasdview_view_standard(dasdview_info_t *info)
 			zt_error_print("dasdview: read error\n"
 				       "Unable to read from device %s!\n",
 				       info->device);
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 
 		if (info->format1)
@@ -1945,7 +1945,7 @@ static void dasdview_view_standard(dasdview_info_t *info)
 			zt_error_print("dasdview: read error\n"
 				       "Unable to read from device %s!\n",
 				       info->device);
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 
 		if (info->format1)
@@ -2112,18 +2112,18 @@ static void dasdview_view_raw(dasdview_info_t *info)
 	trackdata = memalign(4096, trckbuffsize * RAWTRACKSIZE);
 	if (!trackdata) {
 		zt_error_print("failed to allocate memory\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	rc = lzds_dasd_alloc_dasdhandle(info->dasd, &dasdh);
 	if (rc) {
 		zt_error_print("failed to allocate memory\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	rc = lzds_dasdhandle_open(dasdh);
 	if (rc) {
 		lzds_dasdhandle_free(dasdh);
 		zt_error_print("failed to open device\n");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 	/* residual is the number of tracks we still have to read */
 	residual = tracks_to_read;
@@ -2135,7 +2135,7 @@ static void dasdview_view_raw(dasdview_info_t *info)
 							   trckend, trackdata);
 		if (rc) {
 			perror("Error on read");
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 		data = trackdata;
 		for (i = 0; i < trckcount; ++i) {
@@ -2153,7 +2153,7 @@ static void dasdview_view_raw(dasdview_info_t *info)
 	lzds_dasdhandle_free(dasdh);
 	if (rc < 0) {
 		perror("Error on closing file");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 }
 
@@ -2253,7 +2253,7 @@ int main(int argc, char *argv[])
 				zt_error_print("dasdview: usage error\n"
 					       "%s is no valid argument for"
 					       " option -t/--vtoc\n", optarg);
-				exit(-1);
+				exit(EXIT_FAILURE);
 			}
 			info.vtoc = 1;
 			info.action_specified = 1;
@@ -2301,13 +2301,13 @@ int main(int argc, char *argv[])
 		rc = lzds_zdsroot_alloc(&info.zdsroot);
 		if (rc) {
 			zt_error_print("Could not allocate index\n");
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 		rc = lzds_zdsroot_add_device(info.zdsroot, info.device,
 					     &info.dasd);
 		if (rc) {
 			zt_error_print("Could not add device to index\n");
-			exit(-1);
+			exit(EXIT_FAILURE);
 		}
 	}
 
@@ -2328,7 +2328,7 @@ int main(int argc, char *argv[])
 	if (info.begin > max) {
 		zt_error_print("dasdview: usage error\n"
 			"'begin' value is not within disk range!");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if (info.size_specified)
@@ -2343,7 +2343,7 @@ int main(int argc, char *argv[])
 		zt_error_print("dasdview: usage error\n"
 			"'begin' + 'size' is not within "
 			"disk range!");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	if ((info.begin_specified || info.size_specified) &&
@@ -2355,7 +2355,7 @@ int main(int argc, char *argv[])
 		zt_error_print("dasdview: usage error\n"
 			"Options -1 or -2 make only sense with "
 			"options -b or -s!");
-		exit(-1);
+		exit(EXIT_FAILURE);
 	}
 
 	/* do the output */

fdasd/fdasd.c

@@ -75,7 +75,7 @@ static int get_part_name_by_dsname(char *dsname, char **name)
 		return 0;
 	}
 
-	for (i = 0; i < UTIL_ARRAY_SIZE(partition_types); i++) {
+	for (i = 0; i < ARRAY_SIZE(partition_types); i++) {
 		if (strstr(dsname, partition_types[i].dsname) != NULL) {
 			*name = partition_types[i].name;
 			return 0;
@@ -97,7 +97,7 @@ static int get_part_type_by_dsname(char *dsname, int *type)
 		return 0;
 	}
 
-	for (i = 0; i < UTIL_ARRAY_SIZE(partition_types); i++) {
+	for (i = 0; i < ARRAY_SIZE(partition_types); i++) {
 		if (strstr(dsname, partition_types[i].dsname) != NULL) {
 			*type = partition_types[i].type;
 			return 0;
@@ -112,7 +112,7 @@ static int get_part_type_by_dsname(char *dsname, int *type)
  */
 static int get_part_dsname_by_type(unsigned int type, char **dsname)
 {
-	if (type > UTIL_ARRAY_SIZE(partition_types))
+	if (type > ARRAY_SIZE(partition_types))
 		return 1;
 
 	if (type == 0)
@@ -1205,7 +1205,7 @@ static void fdasd_list_known_partitions(void)
 	unsigned int i;
 
 	for (i = VALID_PARTITION_OFFSET;
-	     i < UTIL_ARRAY_SIZE(partition_types); i++) {
+	     i < ARRAY_SIZE(partition_types); i++) {
 		printf("%3d %s\n",
 		       partition_types[i].type, partition_types[i].name);
 	}
@@ -1622,7 +1622,7 @@ static void fdasd_change_part_type(fdasd_anchor_t *anc)
 
 	part_type = 0;
 	while (part_type < 1 ||
-	       part_type > UTIL_ARRAY_SIZE(partition_types) - 1) {
+	       part_type > ARRAY_SIZE(partition_types) - 1) {
 		do {
 			part_type = read_char("new partition type: ");
 		} while (!isdigit(part_type));

genprotimg/.gitignore

@@ -0,0 +1,5 @@
+tags
+compile_commands.json
+src/.check-dep-genprotimg
+src/.detect-openssl.dep.c
+src/genprotimg

genprotimg/Makefile

@@ -0,0 +1,27 @@
+# Common definitions
+include ../common.mak
+
+.DEFAULT_GOAL := all
+
+PKGDATADIR := "$(DESTDIR)$(TOOLS_DATADIR)/genprotimg"
+TESTS :=
+SUBDIRS := boot src man
+RECURSIVE_TARGETS := all-recursive install-recursive clean-recursive
+
+all: all-recursive
+
+install: all install-recursive
+	$(INSTALL) -d -m 755 "$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 boot/stage3a.bin "$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 boot/stage3b_reloc.bin "$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 samples/check_hostkeydoc "$(PKGDATADIR)"
+
+clean: clean-recursive
+
+$(RECURSIVE_TARGETS):
+	@target=`echo $@ |sed s/-recursive//`; \
+		for d in $(SUBDIRS); do \
+			$(MAKE) -C $$d $$target; \
+		done
+
+.PHONY: all install clean $(RECURSIVE_TARGETS)

genprotimg/README.md

@@ -0,0 +1,85 @@
+# genprotimg
+
+`genprotimg` takes a kernel, key files, optionally an initrd image,
+optionally a file containing the kernel command line parameters, and
+generates a single, bootable image file. The generated image file
+consists of a concatenation of a plain text boot loader, the encrypted
+components for kernel, initrd, kernel command line, and the
+integrity-protected PV header, containing the metadata necessary for
+running the guest in protected mode. See [Memory Layout](#memory-layout)
+for details about the internal structure of the created image.
+
+It is possible to use the generated image as a kernel for zipl or for
+a direct kernel boot using QEMU.
+
+## Getting started
+
+If all dependencies are met a simple `make` call in the source tree
+should be enough for building `genprotimg`.
+
+## Details
+
+The main idea of `genprotimg` is:
+
+1. read in all keys, IVs, and other information needed for the
+   encryption of the components and the generation of the PV header
+2. add stub stage3a (so we can calculate the memory addresses)
+3. add components: prepare the components (alignment and encryption)
+   and add them to the memory layout
+4. build and add stage3b: generate the stage3b and add it to the memory layout
+5. generate the PV header: generate the hashes (pld, ald, and tld) of
+   the components and create the PV header and IPIB
+6. parameterize the stub stage3a: uses the IPIB and PV header
+7. write the final image to the specified output path
+
+### Boot Loader
+
+The boot loader consists of two parts:
+
+1. stage3a boot loader (cleartext), this loader is responsible for the
+   transition into the protected mode by doing diag308 subcode 8 and
+   10 calls.
+2. stage3b boot loader (encrypted), this loader is very similar to the
+   normal zipl stage3 boot loader. It will be loaded by the Ultravisor
+   after the successful transition into protected mode. Like the zipl
+   stage3 boot loader it moves the kernel and patches in the values
+   for initrd and parmline.
+
+The loaders have the following constraints:
+
+1. It must be possible to place stage3a and stage3b at a location
+   greater than 0x10000 because the zipl stage3 loader zeroes out
+   everything at addresses lower than 0x10000 of the image.
+2. As the stage3 loader of zipl assumes that the passed kernel image
+   looks like a normal kernel image, the zipl stage3 loader modifies the
+   content at the memory area 0x10400 - 0x10800, therefore we leave this
+   area unused in our stage3a loader.
+3. The default entry address used by the zipl stage3 loader is 0x10000
+   so we add a simple branch to 0x11000 at 0x10000 so the zipl stage3
+   loader can modify the area 0x10400 - 0x10800 without affecting the
+   stage3a loader.
+
+#### Detail about stage3b
+
+The stage3b.bin is linked at address 0x9000, therefore it will not
+work at another address. The relocation support for the stage3b
+loader, so that it can be placed at addresses != 0x9000, is added in
+the loader with the name stage3b_reloc.bin. By default, if we're
+talking about stage3b we refer to stage3b_reloc.bin.
+
+### Memory Layout
+
+The memory layout of the bootable file looks like:
+
+| Start                  | End        | Use                                                                   |
+|------------------------|------------|-----------------------------------------------------------------------|
+| 0                      | 0x7        | Short PSW, starting instruction at 0x11000                            |
+| 0x10000                | 0x10012    | Branch to 0x11000                                                     |
+| 0x10013                | 0x10fff    | Left intentionally unused                                             |
+| 0x11000                | 0x12fff    | Stage3a                                                               |
+| 0x13000                | 0x13fff    | IPIB used as argument for the diag308 call                            |
+| 0x14000                | 0x1[45]fff | UV header used for the diag308 call (size can be either 1 or 2 pages) |
+| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted kernel                                                      |
+| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted kernel parameters                                           |
+| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted initrd                                                      |
+| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted stage3b_reloc                                               |

genprotimg/boot/.gitignore

@@ -0,0 +1,4 @@
+*.elf
+*.lds
+*.bin
+*.d

genprotimg/boot/Makefile

@@ -0,0 +1,97 @@
+# Common definitions
+include ../../common.mak
+
+ZIPL_DIR := $(rootdir)/zipl
+ZIPL_BOOT_DIR := $(ZIPL_DIR)/boot
+
+INCLUDE_PATHS := $(ZIPL_BOOT_DIR) $(ZIPL_DIR)/include $(rootdir)/include
+INCLUDE_PARMS := $(addprefix -I,$(INCLUDE_PATHS))
+
+ALL_CFLAGS := $(NO_PIE_CFLAGS) -Os -g \
+	$(INCLUDE_PARMS) \
+	-DENABLE_SCLP_ASCII=1 \
+	-DS390_TOOLS_RELEASE=$(S390_TOOLS_RELEASE) \
+	-fno-builtin -ffreestanding -fno-asynchronous-unwind-tables \
+	-fno-delete-null-pointer-checks \
+	-fexec-charset=IBM1047 -m64 -mpacked-stack \
+	-mstack-size=4096 -mstack-guard=128 -msoft-float \
+	-Wall -Wformat-security -Wextra -Werror
+
+FILES := stage3a.bin stage3b.bin stage3b_reloc.bin
+
+ZIPL_SRCS_C := libc.c ebcdic.c ebcdic_conv.c sclp.c
+ZIPL_SRCS_ASM := entry.S
+
+ZIPL_OBJS_C := $(ZIPL_SRCS_C:%.c=%.o)
+ZIPL_OBJS_ASM := $(ZIPL_SRCS_ASM:%.S=%.o)
+ZIPL_OBJS := $(ZIPL_OBJS_C) $(ZIPL_OBJS_ASM)
+
+
+all: $(FILES)
+
+# Prevent make from using some default rules...
+%:	%.S
+
+%.o:	%.S Makefile
+	$(CC) $(ALL_CFLAGS) -c -o $@ $<
+
+%.o:	%.c Makefile
+	$(CC) $(ALL_CFLAGS) -c -o $@ $<
+
+
+# Dependencies for the .lds generation
+sources_lds_S = $(wildcard *.lds.S)
+dependencies_lds_S = $(sources_lds_S:%.lds.S=.%.lds.d)
+# Include all ".lds.d" dependency files for all make targets except for "clean"
+ifneq ($(MAKECMDGOALS),clean)
+-include $(dependencies_lds_S)
+endif
+
+%.lds:	%.lds.S Makefile
+	$(CPP) -Wp,-MD,.$@.d,-MT,$@ $(INCLUDE_PARMS) -P -C -o $@ $<
+
+# Special rules for zipl object files
+$(ZIPL_OBJS_C): %.o : $(ZIPL_BOOT_DIR)/%.c
+	$(CC) $(ALL_CFLAGS) -c -o $@ $<
+
+$(ZIPL_OBJS_ASM): %.o : $(ZIPL_BOOT_DIR)/%.S
+	$(CC) $(ALL_CFLAGS) -c -o $@ $<
+
+dependencies_zipl_c := $(ZIPL_SRCS_C:%.c=.%.o.d)
+
+$(dependencies_zipl_c): .%.o.d : $(ZIPL_BOOT_DIR)/%.c
+	$(CC_SILENT) -MM $(ALL_CPPFLAGS) $(ALL_CFLAGS) $< > $@
+
+ifneq ($(MAKECMDGOALS),clean)
+-include $(dependencies_zipl_c)
+endif
+
+stage3b_reloc.o: stage3b.bin
+
+stage3a.elf: head.o stage3a_init.o stage3a.o stage3a.lds $(ZIPL_OBJS)
+stage3b.elf: head.o stage3b.o stage3b.lds $(ZIPL_OBJS)
+stage3b_reloc.elf:
+
+%.elf:	%.o
+	case $* in \
+		stage3a) SFLAGS="$(NO_PIE_LINKFLAGS) -nostdlib -Wl,-T,stage3a.lds";; \
+		stage3b) SFLAGS="$(NO_PIE_LINKFLAGS) -nostdlib -Wl,-T,stage3b.lds";; \
+		stage3b_reloc) SFLAGS="$(NO_PIE_LINKFLAGS) -nostdlib -Wl,-estage3b_reloc_start,-Ttext,0";; \
+	esac; \
+	$(LINK) $$SFLAGS -m64 $(filter %.o, $^) -o $@
+	@chmod a-x $@
+
+%.bin:	%.elf
+	$(OBJCOPY) -O binary \
+		--only-section=.text* \
+		--only-section=.ex_table* \
+		--only-section=.fixup* \
+		--only-section=.data*  \
+		--only-section=.rodata* \
+		$< $@
+	@chmod a-x $@
+
+clean:
+	rm -f *.o *.elf *.bin *.map .*.d *.lds
+
+.PHONY: all clean

genprotimg/boot/common_memory_layout.h

@@ -0,0 +1,25 @@
+/*
+ * Common memory layout for stage3a and stage3b bootloader.
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef COMMON_MEMORY_LAYOUT_H
+#define COMMON_MEMORY_LAYOUT_H
+
+#include "boot/loaders_layout.h"
+
+#define STACK_ADDRESS		STAGE3_STACK_ADDRESS
+#define STACK_SIZE		STAGE3_STACK_SIZE
+
+#define HEAP_ADDRESS		STAGE3_HEAP_ADDRESS
+#define HEAP_SIZE		STAGE3_HEAP_SIZE
+
+
+#ifndef __ASSEMBLER__
+
+#endif /* __ASSEMBLER__ */
+#endif /* COMMON_MEMORY_LAYOUT_H */

genprotimg/boot/head.S

@@ -0,0 +1,29 @@
+/*
+ * Entry code for stage 3a boot loader
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+
+#include "common_memory_layout.h"
+
+#include "boot/s390.h"
+#include "boot/sigp.h"
+
+.section .text.start
+.globl _start
+_start:
+	/* Might be called after a diag308 so better set
+	 * architecture and addressing mode
+	 */
+	lhi	%r1, 1
+	sigp	%r1, %r0, SIGP_SET_ARCHITECTURE
+	sam64
+
+	/* Initialize stack */
+	lgfi	%r15, STACK_ADDRESS + STACK_SIZE - STACK_FRAME_OVERHEAD
+	brasl	%r14, initialize
+.previous

genprotimg/boot/stage3a.c

@@ -0,0 +1,62 @@
+/*
+ * Main program for stage3a bootloader
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include "libc.h"
+#include "stage3a.h"
+
+#include "lib/zt_common.h"
+#include "boot/s390.h"
+#include "boot/ipl.h"
+#include "sclp.h"
+#include "error.h"
+
+
+static volatile struct stage3a_args __section(".loader_parms") loader_parms;
+
+void __noreturn start(void)
+{
+	int rc;
+	volatile struct stage3a_args *args = &loader_parms;
+	/* calculate the IPIB memory address */
+	struct ipl_parameter_block *ipib = (void *)((uint64_t)args + args->ipib_offs);
+
+	/* Calculate the PV header memory address and set it and its
+	 * size in the IPIB. This allows the PV header to be position
+	 * independent.
+	 */
+	ipib->pv.pv_hdr_addr = (uint64_t)args + args->hdr_offs;
+	ipib->pv.pv_hdr_size = args->hdr_size;
+
+	/* set up ASCII and line-mode */
+	sclp_setup(SCLP_LINE_ASCII_INIT);
+
+	/* test if Secure Execution Unpack facility is available */
+	stfle(S390_lowcore.stfle_fac_list,
+	      ARRAY_SIZE(S390_lowcore.stfle_fac_list));
+	rc = test_facility(UNPACK_FACILITY);
+	if (rc == 0)
+		panic(ENOPV, "Secure unpack facility is not available\n");
+
+	rc = diag308(DIAG308_SET_PV, ipib);
+	if (rc != DIAG308_RC_OK)
+		panic(EPV, "Protected boot setup has failed: 0x%x\n", rc);
+
+	rc = diag308(DIAG308_UNPACK_PV, 0x0);
+	if (rc != DIAG308_RC_OK) {
+		sclp_setup(SCLP_LINE_ASCII_INIT);
+		panic(EPV, "Protected boot has failed: 0x%x\n", rc);
+	}
+
+	while (1)
+		;
+}
+
+void panic_notify(unsigned long UNUSED(rc))
+{
+}

genprotimg/boot/stage3a.h

@@ -0,0 +1,34 @@
+/*
+ * Main program for stage3a bootloader.
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef STAGE3A_H
+#define STAGE3A_H
+
+#include "lib/zt_common.h"
+#include "boot/loaders_layout.h"
+
+#define STAGE3A_INIT_ENTRY		IMAGE_ENTRY
+#define STAGE3A_ENTRY			(STAGE3A_INIT_ENTRY + _AC(0x1000, UL))
+#define STAGE3A_LOAD_ADDRESS		IMAGE_LOAD_ADDRESS
+
+
+#ifndef __ASSEMBLER__
+
+#include <stdint.h>
+
+/* Must not have any padding */
+struct stage3a_args {
+	uint64_t hdr_offs;
+	uint64_t hdr_size;
+	uint64_t ipib_offs;
+};
+STATIC_ASSERT(sizeof(struct stage3a_args) == 3 * 8)
+
+#endif /* __ASSEMBLER__ */
+#endif /* STAGE3A_H */

genprotimg/boot/stage3a.lds.S

@@ -0,0 +1,103 @@
+/*
+ * Memory layout for stage 3a
+ * ==========================
+ *
+ * General memory layout
+ * ---------------------
+ *
+ * 0x00000 - 0x01fff	Lowcore
+ * 0x02000 - 0x05fff	Memory allocation (heap)
+ * 0x0f000 - 0x0ffff	Stack
+ * 0x10000 - 0x10012	Jump to the "actual" stage3a code
+ * 0x11000 - 0x12fff	Stage3a code + arguments (offsets and lengths to the
+ * 			actual data: IPIB and UV header)
+ */
+
+#include "stage3a.h"
+#include "common_memory_layout.h"
+
+OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
+OUTPUT_ARCH(s390:64-bit)
+
+ENTRY(_init)
+
+SECTIONS
+{
+	. = 0x0;
+
+	. = HEAP_ADDRESS;
+	__heap_start = .;
+	.heap : {
+		. = . + HEAP_SIZE;
+		ASSERT(__heap_stop - __heap_start == HEAP_SIZE,
+		       "Heap section doesn't conform to the described memory layout");
+	}
+	__heap_stop = .;
+
+	. = STACK_ADDRESS;
+	__stack_start = .;
+	.stack : {
+		. = . + STACK_SIZE;
+		ASSERT(__stack_end - __stack_start == STACK_SIZE,
+		       "Stack section doesn't conform to the described memory layout");
+	}
+	__stack_end = .;
+
+	. = STAGE3A_INIT_ENTRY;
+	__text_init_start = .;
+	.text : {
+		stage3a_init.o(.text.init)
+		__text_init_stop = ABSOLUTE(.);
+		/* Text size of text_init must be smaller than 'PARMAREA - IMAGE_ENTRY',
+		 * otherwise the text data could be overwritten by the original zipl stage3
+		 * boot loader */
+		ASSERT(__text_init_stop - __text_init_start < PARMAREA - IMAGE_ENTRY,
+		       "Text size must be smaller than 'PARMAREA - IMAGE_ENTRY'");
+		. = 0x1000;
+		ASSERT(ABSOLUTE(.) == STAGE3A_ENTRY,
+		       "Text section doesn't conform to the described memory layout");
+		head.o(.text.start)
+		*(.text)
+	}
+
+	.ex_table ALIGN(16) : {
+		__ex_table_start = .;
+		*(.ex_table)
+		__ex_table_stop = .;
+	}
+
+	.bss ALIGN(16) : {
+		__bss_start = .;
+		*(.bss)
+		__bss_stop = .;
+	}
+
+	.rodata ALIGN(16) : {
+		*(.rodata)
+		*(.rodata.*)
+	}
+
+	.data ALIGN(16) : {
+		*(.data)
+		. = ALIGN(16);
+		/* The IPIB offset and the UV header offset and size will be
+		 * saved in 'loader_parms' */
+		__loader_parms_start = .;
+		KEEP(*(.loader_parms));
+		__loader_parms_stop = .;
+		ASSERT(__loader_parms_stop - __loader_parms_start == 3 * 8,
+		       "Data size must be equal to 'sizeof(struct stage3a_args)'");
+		ASSERT(ABSOLUTE(.) < 0x13000, "Data section doesn't conform to the described memory layout");
+	}
+
+	/* List this explicitly as otherwise .note.gnu.build-id will be
+	 * put at 0x0 */
+	.notes : {
+		*(.note.*)
+	}
+
+	/* Sections to be discarded */
+	/DISCARD/ : {
+		*(.eh_frame)
+	}
+}

genprotimg/boot/stage3a_init.S

@@ -0,0 +1,26 @@
+/*
+ * Entry code for stage 3a boot loader
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include "stage3a.h"
+#include "boot/sigp.h"
+
+.section .text.init
+.globl _init
+_init:
+	/* set architecture and switch to 64bit  */
+	lhi	%r1, 1
+	sigp	%r1, %r0, SIGP_SET_ARCHITECTURE
+	sam64
+	/* The original stage3 boot loader will try to store the
+	 * kernel command line and the address and size of the
+	 * ramdisk. Simply ignore this by starting at 0x11000.
+	 */
+	lgfi	%r1, STAGE3A_ENTRY
+	br	%r1
+.previous

genprotimg/boot/stage3b.c

@@ -0,0 +1,77 @@
+/*
+ * Main program for stage3b bootloader
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include "libc.h"
+#include "stage3b.h"
+
+#include "lib/zt_common.h"
+#include "boot/s390.h"
+#include "boot/linux_layout.h"
+#include "boot/loaders_layout.h"
+#include "sclp.h"
+#include "error.h"
+
+
+static volatile struct stage3b_args __section(".loader_parms") loader_parms;
+
+static inline void __noreturn load_psw(struct psw_t psw)
+{
+	asm volatile("lpswe %0" : : "Q"(psw) : "cc");
+
+	while (1)
+		;
+}
+
+void __noreturn start(void)
+{
+	volatile struct stage3b_args *args = &loader_parms;
+	volatile struct memblob *kernel = &args->kernel;
+	volatile struct memblob *cmdline = &args->cmdline;
+	volatile struct memblob *initrd = &args->initrd;
+	volatile struct psw_t psw = args->psw;
+
+	/* set up ASCII and line-mode */
+	sclp_setup(SCLP_LINE_ASCII_INIT);
+
+	if (kernel->size < IMAGE_LOAD_ADDRESS)
+		panic(EINTERNAL, "Invalid kernel\n");
+
+	if (cmdline->size > COMMAND_LINE_SIZE)
+		panic(EINTERNAL, "Command line is too large\n");
+
+	/* move the kernel and cut the kernel header */
+	memmove((void *)IMAGE_LOAD_ADDRESS,
+		(void *)(kernel->src + IMAGE_LOAD_ADDRESS),
+		kernel->size - IMAGE_LOAD_ADDRESS);
+
+	/* move the kernel cmdline */
+	memmove((void *)COMMAND_LINE,
+		(void *)cmdline->src,
+		cmdline->size);
+	/* the initrd does not need to be moved */
+
+	if (initrd->size != 0) {
+		/* copy initrd start address and size into new kernel space */
+		*(unsigned long long *)INITRD_START = initrd->src;
+		*(unsigned long long *)INITRD_SIZE = initrd->size;
+	}
+
+	/* disable ASCII and line-mode */
+	sclp_setup(SCLP_DISABLE);
+
+	/* use lpswe instead of diag308 as a I/O subsystem reset is not
+	 * needed as this was already done by the diag308 subcode 10 call
+	 * in stage3a
+	 */
+	load_psw(psw);
+}
+
+void panic_notify(unsigned long UNUSED(rc))
+{
+}

genprotimg/boot/stage3b.h

@@ -0,0 +1,42 @@
+/*
+ * Main program for stage3b bootloader
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef STAGE3B_H
+#define STAGE3B_H
+
+#include "lib/zt_common.h"
+#include "boot/loaders_layout.h"
+
+#define STAGE3B_ENTRY			STAGE3_ENTRY
+#define STAGE3B_LOAD_ADDRESS		STAGE3B_ENTRY
+
+
+#ifndef __ASSEMBLER__
+
+#include <stdint.h>
+
+#include "boot/s390.h"
+
+/* Must not have any padding included */
+struct memblob {
+	uint64_t src;
+	uint64_t size;
+};
+STATIC_ASSERT(sizeof(struct memblob) == 2 * 8)
+
+/* Must not have any padding included */
+struct stage3b_args {
+	struct memblob kernel;
+	struct memblob cmdline;
+	struct memblob initrd;
+	struct psw_t psw;
+};
+STATIC_ASSERT(sizeof(struct stage3b_args) == 3 * sizeof(struct memblob) + 16)
+#endif /* __ASSEMBLER__ */
+#endif /* STAGE3B_H */

genprotimg/boot/stage3b.lds.S

@@ -0,0 +1,87 @@
+/*
+ * Memory layout for stage 3b
+ * ==========================
+ *
+ * General memory layout
+ * ---------------------
+ *
+ * 0x00000 - 0x01fff	Lowcore
+ * 0x02000 - 0x05fff	Memory allocation (heap)
+ * 0x0a000 - 0x0efff	Stage3b code
+ * 0x0f000 - 0x0ffff	Stack
+ */
+
+#include "stage3b.h"
+#include "common_memory_layout.h"
+
+OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
+OUTPUT_ARCH(s390:64-bit)
+
+ENTRY(_start)
+
+SECTIONS
+{
+	. = 0x0;
+
+	. = HEAP_ADDRESS;
+	__heap_start = .;
+	.heap : {
+		. = . + HEAP_SIZE;
+		ASSERT(__heap_stop - __heap_start == HEAP_SIZE,
+		       "Heap section doesn't conform to the described memory layout");
+	}
+	__heap_stop = .;
+
+	. = STAGE3B_ENTRY;
+	.text : {
+		head.o(.text.start)
+		*(.text)
+	}
+
+	.ex_table ALIGN(16) : {
+		__ex_table_start = .;
+		*(.ex_table)
+		__ex_table_stop = .;
+	}
+
+	.bss ALIGN(16) : {
+		__bss_start = .;
+		*(.bss)
+		__bss_stop = .;
+	}
+
+	.rodata ALIGN(16) : {
+		*(.rodata)
+		*(.rodata.*)
+	}
+
+	.data ALIGN(16) : {
+		*(.data)
+		. = ALIGN(16);
+		__loader_parms_start = .;
+		KEEP(*(.loader_parms));
+		__loader_parms_end = .;
+		ASSERT(__loader_parms_end - __loader_parms_start == 3 * 16 + 16,
+		       "Data size must be equal to 'sizeof(struct stage3b_args)'");
+	}
+
+	. = STACK_ADDRESS;
+	__stack_start = .;
+	.stack : {
+		. = . + STACK_SIZE;
+		ASSERT(__stack_end - __stack_start == STACK_SIZE,
+		       "Stack section doesn't conform to the described memory layout");
+	}
+	__stack_end = .;
+
+	/* List this explicitly as otherwise .note.gnu.build-id will be
+	 * put at 0x0 */
+	.notes : {
+		*(.note.*)
+	}
+
+	/* Sections to be discarded */
+	/DISCARD/ : {
+		*(.eh_frame)
+	}
+}

genprotimg/boot/stage3b_reloc.S

@@ -0,0 +1,53 @@
+/*
+ * Relocator code for stage 3b boot loader
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include "stage3b.h"
+#include "boot/sigp.h"
+
+.macro MEMCPY dst,src,len
+	lgr	%r0, \dst
+	lgr	%r1, \len
+	lgr	%r2, \src
+	lgr	%r3, \len
+
+20:	mvcle	%r0, %r2, 0
+	jo	20b
+.endm
+
+.org 0x0
+.section .text.start
+.globl stage3b_reloc_start
+stage3b_reloc_start:
+	/* Might be called after a diag308 so better set
+	 * architecture and addressing mode
+	 */
+	lhi	%r1, 1
+	sigp	%r1, %r0, SIGP_SET_ARCHITECTURE
+	sam64
+
+.copy_stage3b:
+	/* Location of stage3b in memory */
+	larl	%r8, stage3b_start
+
+	/* Destination for stage3b */
+	lgfi	%r9, STAGE3B_LOAD_ADDRESS
+
+	/* Size of stage3b */
+	lghi	%r11, stage3b_end - stage3b_start
+
+	/* Copy the stage3b loader to address STAGE3B_LOAD_ADDRESS */
+	MEMCPY	%r9, %r8, %r11
+
+	/* Branch to STAGE3B_ENTRY */
+	lgfi	%r9, STAGE3B_ENTRY
+	br	%r9
+stage3b_start:
+	.incbin	"stage3b.bin"
+stage3b_end:
+.previous

genprotimg/man/Makefile

@@ -0,0 +1,12 @@
+# Common definitions
+include ../../common.mak
+
+all:
+
+install:
+	$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man8
+	$(INSTALL) -m 644 -c genprotimg.8 $(DESTDIR)$(MANDIR)/man8
+
+clean:
+
+.PHONY: all install clean

genprotimg/man/genprotimg.8

@@ -0,0 +1,97 @@
+.\" Copyright 2020 IBM Corp.
+.\" s390-tools is free software; you can redistribute it and/or modify
+.\" it under the terms of the MIT license. See LICENSE for details.
+.\"
+.TH GENPROTIMG 8 "March 2020" "s390-tools"
+.SH NAME
+genprotimg \- Create a protected virtualization image
+
+.SH SYNOPSIS
+.SY
+.B genprotimg
+\fB\-k\fR \fIHOST_KEY_DOCUMENT\fR...
+\fB\-i\fR \fIVMLINUZ\fR
+[\fB\-r\fR \fIRAMDISK\fR]
+[\fB\-p\fR \fIPARMFILE\fR]
+\fB\-o\fR \fIOUTFILE\fR
+[\fIOPTION\fR]...
+.YS
+
+.SH DESCRIPTION
+.PP
+Use \fBgenprotimg\fR to generate a single bootable image file with
+encrypted and integrity-protected parts. The command requires a kernel
+image, a host-key document, and an output file name. Optionally,
+specify an initial RAM filesystem, and a file containing the kernel
+parameters. Should special circumstances require it, you can
+optionally specify your own keys for the encryption by using the
+experimental options. In the resulting image file, a plain text boot
+loader, the encrypted components for kernel, initial RAM disk, kernel
+parameters, and the encrypted and integrity-protected header are
+concatenated. The header contains metadata necessary for running the
+guest in protected mode.
+.PP
+Use this image file as a kernel image for zipl or for a direct kernel
+boot using QEMU.
+
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Prints usage information, then exits.
+.TP
+\fB\-\-help-experimental\fR
+Prints experimental usage information, then exits.
+.TP
+\fB\-\-help-all\fR
+Prints all usage information, then exits.
+.TP
+\fB\-V\fR, \fB\-\-verbose\fR
+Provides more detailed output.
+.TP
+\fB\-k\fR, \fB\-\-host-key-document\fR=\fI\,HOST_KEY_DOCUMENT\/\fR
+Specifies a host-key document. At least one is required. Specify this
+option multiple times to enable the image to run on more than one
+host.
+.TP
+\fB\-o\fR, \fB\-\-output\fR=\fI\,OUTPUT_FILE\/\fR
+Specifies the output file. Required.
+.TP
+\fB\-i\fR, \fB\-\-image\fR=\fI\,VMLINUZ\/\fR
+Specifies the Linux kernel image file. Required.
+.TP
+\fB\-r\fR, \fB\-\-ramdisk\fR=\fI\,RAMDISK\/\fR
+Specifies the RAM disk image. Optional.
+.TP
+\fB\-p\fR, \fB\-\-parmfile\fR=\fI\,PARMFILE\/\fR
+Specifies the kernel command line stored in \fI\,PARMFILE\/\fR. Optional.
+.TP
+\fB\-\-no-verify\fR
+Do not require the host-key documents to be valid. For testing
+purposes, do not use for a production image. Optional.
+.TP
+\fB\-v\fR, \fB\-\-version\fR
+Prints version information, then exits.
+
+.SH EXAMPLE
+.PP
+Generate a protected virtualization image in
+\fI\,/boot/vmlinuz.pv\/\fR, using the kernel file \fI\,vmlinuz\/\fR,
+the initrd in \fI\,initramfs\/\fR, the kernel parameters contained in
+\fI\,parmfile\/\fR, and the host-key document in \fI\,host_key.crt\/\fR:
+.PP
+.Vb 1
+.EX
+\&        genprotimg \-i \fI\,vmlinuz\/\fR \-r \fI\,initramfs\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-o \fI\,/boot/vmlinuz.pv\/\fR
+.EE
+.Ve
+.PP
+
+.SH NOTES
+.IP "1." 4
+An ELF file cannot be used as a Linux kernel image.
+.IP "2." 4
+Remember to re-run \fBzipl\fR after updating a protected
+virtualization image.
+
+.SH SEE ALSO
+\&\fBzipl\fR\|(5), \fBqemu\fR\|(1)

genprotimg/samples/check_hostkeydoc

@@ -0,0 +1,276 @@
+#!/bin/sh
+#
+# check_hostkeydoc - Verify an IBM Secure Execution host key document
+#
+# Sample script to verify that a host key document is genuine by
+# verifying the issuer, the validity date and the signature.
+# Optionally verify the full trust chain using a CA certficate.
+#
+# Revocation list checking not yet implemented.
+#
+# Sample invocation:
+#
+# ./check_hostkeydoc HKD1234.crt signing-key.crt
+#
+# Copyright IBM Corp. 2020
+#
+# s390-tools is free software; you can redistribute it and/or modify
+# it under the terms of the MIT license. See LICENSE for details.
+
+
+# Allocate temporary files
+ISSUER_PUBKEY_FILE=$(mktemp)
+SIGNATURE_FILE=$(mktemp)
+BODY_FILE=$(mktemp)
+ISSUER_DN_FILE=$(mktemp)
+SUBJECT_DN_FILE=$(mktemp)
+DEF_ISSUER_DN_FILE=$(mktemp)
+CRL_SERIAL_FILE=$(mktemp)
+
+# Cleanup on exit
+cleanup()
+{
+    rm -f $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE \
+        $ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_DN_FILE \
+        $CRL_SERIAL_FILE
+}
+trap cleanup EXIT
+
+# Enhanced error checking for bash
+if echo $SHELL | grep /bin/bash > /dev/null
+then
+    set -o pipefail
+    set -o nounset
+fi
+set -e
+
+# Usage
+usage()
+{
+cat <<-EOF
+Usage: `basename $1` host-key-doc signing-key-cert [-c CA-cert] [-r CRL]
+
+Verify an IBM Secure Execution host key document against
+a signing key.
+
+Note that in order to have the full trust chain verified
+it is necessary to provide the issueing CA's certificate.
+
+EOF
+}
+
+check_verify_chain()
+{
+    # Verify certificate chain in case a CA certificate file/bundle
+    # was specified on the command line.
+    if [ $# = 1 ]
+    then
+        cat >&2 <<-EOF
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+No CA certificate specified! Skipping trust chain verification.
+Make sure that '$1' is a valid certificate.
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+EOF
+    else
+        openssl verify -crl_download -crl_check $2 &&
+        openssl verify -crl_download -crl_check -untrusted $2 $1 ||
+        exit 1
+    fi
+}
+
+extract_pubkey()
+{
+    openssl x509 -in $1 -pubkey -noout > $2
+}
+
+extract_signature()
+{
+    # Assuming that the last field is the signature
+    SIGOFFSET=$(openssl asn1parse -in $1 | tail -1 | cut -d : -f 1)
+
+    openssl asn1parse -in $1 -out $2 -strparse $SIGOFFSET -noout
+}
+
+extract_body()
+{
+    # Assuming that the first field is the full cert body
+    SIGOFFSET=$(openssl asn1parse -in $1 | head -2 | tail -1 | cut -d : -f 1)
+
+    openssl asn1parse -in $1 -out $2 -strparse $SIGOFFSET -noout
+}
+
+verify_signature()
+{
+    # Assuming that the signature algorith is SHA512 with RSA
+    openssl sha512 -verify $1 -signature $2 $3
+}
+
+canonical_dn()
+{
+    OBJTYPE=$1
+    OBJ=$2
+    DNTYPE=$3
+    OUTPUT=$4
+
+    openssl $OBJTYPE -in $OBJ -$DNTYPE -noout -nameopt multiline \
+        | sort | grep -v $DNTYPE= > $OUTPUT
+}
+
+default_issuer()
+{
+    cat <<-EOF
+    commonName                = International Business Machines Corporation
+    countryName               = US
+    localityName              = Poughkeepsie
+    organizationalUnitName    = IBM Z Host Key Signing Service
+    organizationName          = International Business Machines Corporation
+    stateOrProvinceName       = New York
+EOF
+}
+
+verify_issuer_files()
+{
+    default_issuer > $DEF_ISSUER_DN_FILE
+
+    if ! diff $ISSUER_DN_FILE $DEF_ISSUER_DN_FILE
+    then
+        echo Incorrect default issuer >&2 && exit 1
+    fi
+
+    if diff $ISSUER_DN_FILE $SUBJECT_DN_FILE
+    then
+        echo Issuer verification OK
+    else
+        echo Issuer verification failed >&2 && exit 1
+    fi
+}
+
+cert_time()
+{
+    DATE=$(openssl x509 -in $1 -$2 -noout | sed "s/^.*=//")
+
+    date -d "$DATE" +%s
+}
+
+crl_time()
+{
+    DATE=$(openssl crl -in $1 -$2 -noout | sed "s/^.*=//")
+
+    date -d "$DATE" +%s
+}
+
+verify_dates()
+{
+    START="$1"
+    END="$2"
+    MSG="${3:-Certificate}"
+    NOW=$(date +%s)
+
+    if [ $START -le $NOW -a $NOW -le $END ]
+    then
+        echo "${MSG} dates are OK"
+    else
+        echo "${MSG} date verification failed" >&2 && exit 1
+    fi
+}
+
+crl_serials()
+{
+    openssl crl -in $1 -text -noout | \
+        grep "Serial Number" > $CRL_SERIAL_FILE
+}
+
+check_serial()
+{
+    CERT_SERIAL=$(openssl x509 -in $1 -noout -serial | cut -d = -f 2)
+
+    grep -q $CERT_SERIAL $CRL_SERIAL_FILE
+}
+
+check_file()
+{
+    [ $# = 0 ] ||
+    [ -e "$1" ] ||
+    (echo "File '$1' not found" >&2 && exit 1)
+}
+
+# check args
+CRL_FILE=
+CA_FILE=
+
+args=$(getopt -qu "r:c:h" $*)
+if [ $? = 0 ]
+then
+    set -- $args
+    while [ $1 != "" ]
+    do
+        case $1 in
+            -r) CRL_FILE=$2; shift 2;;
+            -c) CA_FILE=$2; shift 2;;
+            -h) usage $0; exit 0;;
+            --) shift; break;;
+        esac
+    done
+else
+    usage $0 >&2
+    exit 1
+fi
+
+if [ $# -ne 2  ]
+then
+    usage $0 >&2
+    exit 1
+fi
+
+HKD_FILE=$1
+HKSK_FILE=$2
+
+# Check whether all specified files exist
+check_file $HKD_FILE
+check_file $HKSK_FILE
+check_file $CA_FILE
+check_file $CRL_FILE
+
+# Check trust chain
+check_verify_chain $HKSK_FILE $CA_FILE
+
+# Verify host key document signature
+echo -n "Checking host key document signature: "
+extract_pubkey $HKSK_FILE $ISSUER_PUBKEY_FILE &&
+extract_signature $HKD_FILE $SIGNATURE_FILE &&
+extract_body $HKD_FILE $BODY_FILE &&
+verify_signature $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE ||
+exit 1
+
+# Verify the issuer
+canonical_dn x509 $HKD_FILE issuer $ISSUER_DN_FILE
+canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE
+verify_issuer_files
+
+# Verify dates
+verify_dates $(cert_time $HKD_FILE startdate) $(cert_time $HKD_FILE enddate)
+
+# Check CRL if specified
+if [ -n "$CRL_FILE" ]
+then
+    echo -n "Checking CRL signature: "
+    extract_signature $CRL_FILE $SIGNATURE_FILE &&
+    extract_body $CRL_FILE $BODY_FILE &&
+    verify_signature $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE ||
+    exit 1
+
+    echo -n "CRL "
+    canonical_dn crl $CRL_FILE issuer $ISSUER_DN_FILE
+    canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE
+    verify_issuer_files
+
+    verify_dates $(crl_time $CRL_FILE lastupdate) $(crl_time $CRL_FILE nextupdate) 'CRL'
+
+    crl_serials $CRL_FILE
+    check_serial $HKD_FILE &&
+    echo  "Certificate is revoked, do not use it anymore!" >&2 &&
+    exit 1
+fi
+
+# We made it
+echo All checks reqested for \'$HKD_FILE\' were successful

genprotimg/src/Makefile

@@ -0,0 +1,101 @@
+# Common definitions
+include ../../common.mak
+
+bin_PROGRAM = genprotimg
+
+PKGDATADIR ?= "$(DESTDIR)$(TOOLS_DATADIR)/genprotimg"
+SRC_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
+TOP_SRCDIR := $(SRC_DIR)/../
+ROOT_DIR = $(TOP_SRC_DIR)/../../
+ZIPL_DIR = $(ROOT_DIR)/zipl
+LOADER_DIR = $(TOP_SRCDIR)/boot
+
+INCLUDE_PATHS = "$(SRC_DIR)" "$(TOP_SRCDIR)" "$(ROOTDIR)/include"
+INCLUDE_PARMS = $(addprefix -I,$(INCLUDE_PATHS))
+
+WARNINGS := -Wall -Wextra -Wshadow \
+	-Wcast-align -Wwrite-strings -Wmissing-prototypes \
+	-Wmissing-declarations -Wredundant-decls -Wnested-externs -Winline \
+	-Wno-long-long -Wuninitialized -Wconversion -Wstrict-prototypes \
+	-Wpointer-arith -Werror \
+	$(NULL)
+
+$(bin_PROGRAM)_SRCS := $(bin_PROGRAM).c pv/pv_stage3.c pv/pv_image.c \
+	pv/pv_comp.c pv/pv_hdr.c pv/pv_ipib.c utils/crypto.c utils/file_utils.c \
+	pv/pv_args.c utils/buffer.c pv/pv_comps.c pv/pv_error.c \
+	pv/pv_opt_item.c \
+	$(NULL)
+$(bin_PROGRAM)_OBJS := $($(bin_PROGRAM)_SRCS:.c=.o)
+
+ALL_CFLAGS += -std=gnu11 -DPKGDATADIR=$(PKGDATADIR) \
+	$(GLIB2_CFLAGS) $(LIBCRYPTO_CFLAGS) \
+	$(WARNINGS) \
+	$(NULL)
+ALL_CPPFLAGS += $(INCLUDE_PARMS)
+LDLIBS += $(GLIB2_LIBS) $(LIBCRYPTO_LIBS)
+
+
+ifneq ($(shell sh -c 'command -v pkg-config'),)
+GLIB2_CFLAGS := $(shell pkg-config --silence-errors --cflags glib-2.0)
+GLIB2_LIBS := $(shell pkg-config --silence-errors --libs glib-2.0)
+LIBCRYPTO_CFLAGS := $(shell pkg-config --silence-errors --cflags libcrypto)
+LIBCRYPTO_LIBS := $(shell pkg-config --silence-errors --libs libcrypto)
+else
+GLIB2_CFLAGS := -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include
+GLIB2_LIBS := -lglib-2.0
+LIBCRYPTO_CFLAGS :=
+LIBCRYPTO_LIBS := -lcrypto
+endif
+
+BUILD_TARGETS := skip-$(bin_PROGRAM)
+INSTALL_TARGETS := skip-$(bin_PROGRAM)
+ifneq (${HAVE_OPENSSL},0)
+ifneq (${HAVE_GLIB2},0)
+BUILD_TARGETS := $(bin_PROGRAM)
+INSTALL_TARGETS := install-$(bin_PROGRAM)
+endif
+endif
+
+all: $(BUILD_TARGETS)
+
+install: $(INSTALL_TARGETS)
+
+$(bin_PROGRAM): $($(bin_PROGRAM)_OBJS)
+
+skip-$(bin_PROGRAM):
+	echo "  SKIP    $(bin_PROGRAM) due to unresolved dependencies"
+
+install-$(bin_PROGRAM): $(bin_PROGRAM)
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
+	$(INSTALL) -c $^ $(DESTDIR)$(USRBINDIR)
+
+clean:
+	$(RM) -f $($(bin_PROGRAM)_OBJS) $(bin_PROGRAM) .check-dep-$(bin_PROGRAM) .detect-openssl.dep.c
+
+.PHONY: all install clean skip-$(bin_PROGRAM) install-$(bin_PROGRAM)
+
+$($(bin_PROGRAM)_OBJS): .check-dep-$(bin_PROGRAM)
+
+.detect-openssl.dep.c:
+	echo "#include <openssl/evp.h>" > $@
+	echo "#if OPENSSL_VERSION_NUMBER < 0x10100000L" >> $@
+	echo "  #error openssl version 1.1.0 is required" >> $@
+	echo "#endif" >> $@
+	echo "static void __attribute__((unused)) test(void) {" >> $@
+	echo "    EVP_MD_CTX *ctx = EVP_MD_CTX_new();" >> $@
+	echo "    EVP_MD_CTX_free(ctx);" >> $@
+	echo "}" >> $@
+
+.check-dep-$(bin_PROGRAM): .detect-openssl.dep.c
+	$(call check_dep, \
+		"$(bin_PROGRAM)", \
+		"glib.h", \
+		"glib2-devel / libglib2.0-dev", \
+		"HAVE_GLIB2=0")
+	$(call check_dep, \
+		"$(bin_PROGRAM)", \
+		$^, \
+		"openssl-devel / libssl-dev version >= 1.1.0", \
+		"HAVE_OPENSSL=0", \
+		"-I.")
+	touch $@

genprotimg/src/common.h

@@ -0,0 +1,35 @@
+#ifndef COMMON_H
+#define COMMON_H
+
+#define GETTEXT_PACKAGE "genprotimg"
+#include <glib.h>
+#include <glib/gi18n-lib.h>
+
+#include "boot/linux_layout.h"
+#include "boot/s390.h"
+#include "lib/zt_common.h"
+
+static const gchar tool_name[] = "genprotimg";
+static const gchar copyright_notice[] = "Copyright IBM Corp. 2020";
+
+/* default values */
+#define GENPROTIMG_STAGE3A_PATH (STRINGIFY(PKGDATADIR) "/stage3a.bin")
+#define GENPROTIMG_STAGE3B_PATH (STRINGIFY(PKGDATADIR) "/stage3b_reloc.bin")
+
+#define DEFAULT_INITIAL_PSW_ADDR IMAGE_ENTRY
+#define DEFAULT_INITIAL_PSW_MASK (PSW_MASK_EA | PSW_MASK_BA)
+
+#define DO_PRAGMA(x) _Pragma(#x)
+
+# ifdef __clang__
+#  define WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(...) \
+	DO_PRAGMA(clang diagnostic push) \
+	DO_PRAGMA(clang diagnostic ignored "-Wunused-function") \
+	G_DEFINE_AUTOPTR_CLEANUP_FUNC(__VA_ARGS__) \
+	DO_PRAGMA(clang diagnostic pop)
+# else
+#  define WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(...) \
+	G_DEFINE_AUTOPTR_CLEANUP_FUNC(__VA_ARGS__)
+# endif
+
+#endif

genprotimg/src/genprotimg.c

@@ -0,0 +1,181 @@
+/*
+ * genprotimg - build relocatable secure images
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <errno.h>
+#include <glib.h>
+#include <glib/gstdio.h>
+#include <glib/gtypes.h>
+#include <locale.h>
+#include <signal.h>
+#include <stdio.h>
+
+#include "common.h"
+#include "pv/pv_args.h"
+#include "pv/pv_image.h"
+
+enum {
+	LOG_LEVEL_CRITICAL = 0,
+	LOG_LEVEL_INFO = 1,
+	LOG_LEVEL_DEBUG = 2,
+};
+
+static gint log_level = LOG_LEVEL_CRITICAL;
+static gchar *tmp_dir;
+
+static void rmdir_recursive(gchar *dir_path, GError **err)
+{
+	const gchar *file = NULL;
+	g_autoptr(GDir) d = NULL;
+
+	if (!dir_path)
+		return;
+
+	d = g_dir_open(dir_path, 0, err);
+	if (!d) {
+		g_set_error(err, G_FILE_ERROR,
+			    (gint)g_file_error_from_errno(errno),
+			    _("Failed to open directory '%s': %s"), dir_path,
+			    g_strerror(errno));
+		return;
+	}
+
+	while ((file = g_dir_read_name(d)) != NULL) {
+		g_autofree gchar *file_path =
+			g_build_filename(dir_path, file, NULL);
+		/* ignore error */
+		(void)g_unlink(file_path);
+	}
+
+	if (g_rmdir(dir_path) != 0) {
+		g_set_error(err, G_FILE_ERROR,
+			    (gint)g_file_error_from_errno(errno),
+			    _("Failed to remove directory '%s': %s"), dir_path,
+			    g_strerror(errno));
+		return;
+	}
+}
+
+static void sig_term_handler(int signal G_GNUC_UNUSED)
+{
+	rmdir_recursive(tmp_dir, NULL);
+	exit(EXIT_FAILURE);
+}
+
+static void log_handler_cb(const gchar *log_domain G_GNUC_UNUSED,
+			   GLogLevelFlags level, const gchar *message,
+			   gpointer user_data G_GNUC_UNUSED)
+{
+	const gchar *prefix = "";
+
+	/* filter out messages depending on debugging level */
+	if ((level & G_LOG_LEVEL_DEBUG) && log_level < LOG_LEVEL_DEBUG)
+		return;
+
+	if ((level & G_LOG_LEVEL_INFO) && log_level < LOG_LEVEL_INFO)
+		return;
+
+	if (level & G_LOG_LEVEL_WARNING)
+		prefix = "WARNING: ";
+
+	if (level & G_LOG_LEVEL_ERROR)
+		prefix = "ERROR: ";
+
+	if (level & (G_LOG_LEVEL_WARNING | G_LOG_LEVEL_ERROR))
+		g_printerr("%s%s\n", prefix, message);
+	else
+		g_print("%s%s\n", prefix, message);
+}
+
+static void setup_prgname(const gchar *name)
+{
+	g_set_prgname(name);
+	g_set_application_name(_(name));
+}
+
+static void setup_handler(const gint *signals, const gsize signals_n)
+{
+	/* set up logging handler */
+	g_log_set_handler(NULL,
+			  G_LOG_LEVEL_MASK | G_LOG_FLAG_FATAL |
+				  G_LOG_FLAG_RECURSION,
+			  log_handler_cb, NULL);
+
+	/* set signal handler */
+	for (gsize i = 0; i < signals_n; i++)
+		signal(signals[i], sig_term_handler);
+}
+
+static void remove_signal_handler(const gint *signals, const gsize signals_n)
+{
+	for (gsize i = 0; i < signals_n; i++)
+		signal(signals[i], SIG_DFL);
+}
+
+gint main(gint argc, gchar *argv[])
+{
+	g_autoptr(PvArgs) args = pv_args_new();
+	gint signals[] = { SIGINT, SIGTERM };
+	g_autoptr(PvImage) img = NULL;
+	gint ret = EXIT_FAILURE;
+	GError *err = NULL;
+
+	setlocale(LC_CTYPE, "");
+	setup_prgname(tool_name);
+	setup_handler(signals, G_N_ELEMENTS(signals));
+
+	if (pv_args_parse_options(args, &argc, &argv, &err) < 0)
+		goto error;
+
+	/* set new log level */
+	log_level = args->log_level;
+
+	/* if the user has not specified a temporary directory let's
+	 * create one
+	 */
+	if (!args->tmp_dir) {
+		tmp_dir = g_dir_make_tmp("genprotimg-XXXXXX", &err);
+		if (!tmp_dir)
+			goto error;
+		args->tmp_dir = g_strdup(tmp_dir);
+	}
+
+	/* allocate and initialize ``pv_img`` data structure */
+	img = pv_img_new(args, GENPROTIMG_STAGE3A_PATH, &err);
+	if (!img)
+		goto error;
+
+	/* add user components: `args->comps` must be sorted by the
+	 * component type => by memory address
+	 */
+	for (GSList *iterator = args->comps; iterator; iterator = iterator->next) {
+		const PvArg *arg = iterator->data;
+
+		if (pv_img_add_component(img, arg, &err) < 0)
+			goto error;
+	}
+
+	if (pv_img_finalize(img, GENPROTIMG_STAGE3B_PATH, &err) < 0)
+		goto error;
+
+	if (pv_img_write(img, args->output_path, &err) < 0)
+		goto error;
+
+	ret = EXIT_SUCCESS;
+
+error:
+	if (err) {
+		fputs(err->message, stderr);
+		fputc('\n', stderr);
+		g_clear_error(&err);
+	}
+	rmdir_recursive(tmp_dir, NULL);
+	remove_signal_handler(signals, G_N_ELEMENTS(signals));
+	g_free(tmp_dir);
+	exit(ret);
+}

genprotimg/src/include/pv_crypto_def.h

@@ -0,0 +1,25 @@
+/*
+ * PV cryptography related definitions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_CRYPTO_DEF_H
+#define PV_CRYPTO_DEF_H
+
+#include <stdint.h>
+
+#include "lib/zt_common.h"
+
+union ecdh_pub_key {
+	struct {
+		uint8_t x[80];
+		uint8_t y[80];
+	};
+	uint8_t data[160];
+} __packed;
+
+#endif

genprotimg/src/include/pv_hdr_def.h

@@ -0,0 +1,84 @@
+/*
+ * PV header definitions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_HDR_DEF_H
+#define PV_HDR_DEF_H
+
+#include <openssl/sha.h>
+
+#include "boot/s390.h"
+#include "lib/zt_common.h"
+#include "utils/crypto.h"
+
+#include "pv_crypto_def.h"
+
+/* Magic number which is used to identify the file containing the PV
+ * header
+ */
+#define PV_MAGIC_NUMBER 0x49424d5365634578ULL
+#define PV_VERSION_1	0x00000100U
+
+/* prevent Ultravisor decryption during unpack operation */
+#define PV_CFLAG_NO_DECRYPTION 0x10000000ULL
+
+/* maxima for the PV version 1 */
+#define PV_V1_IPIB_MAX_SIZE	PAGE_SIZE
+#define PV_V1_PV_HDR_MAX_SIZE	(2 * PAGE_SIZE)
+
+typedef struct pv_hdr_key_slot {
+	uint8_t digest_key[SHA256_DIGEST_LENGTH];
+	uint8_t wrapped_key[32];
+	uint8_t tag[AES_256_GCM_TAG_SIZE];
+} __packed PvHdrKeySlot;
+
+typedef struct pv_hdr_opt_item {
+	uint32_t otype;
+	uint8_t ibk[32];
+	uint8_t data[];
+} __packed PvHdrOptItem;
+
+/* integrity protected data (by GCM tag), but non-encrypted */
+struct pv_hdr_head {
+	uint64_t magic;
+	uint32_t version;
+	uint32_t phs;
+	uint8_t iv[AES_256_GCM_IV_SIZE];
+	uint32_t res1;
+	uint64_t nks;
+	uint64_t sea;
+	uint64_t nep;
+	uint64_t pcf;
+	union ecdh_pub_key cust_pub_key;
+	uint8_t pld[SHA512_DIGEST_LENGTH];
+	uint8_t ald[SHA512_DIGEST_LENGTH];
+	uint8_t tld[SHA512_DIGEST_LENGTH];
+} __packed;
+
+/* Must not have any padding */
+struct pv_hdr_encrypted {
+	uint8_t cust_comm_key[32];
+	uint8_t img_enc_key_1[AES_256_XTS_KEY_SIZE / 2];
+	uint8_t img_enc_key_2[AES_256_XTS_KEY_SIZE / 2];
+	struct psw_t psw;
+	uint64_t scf;
+	uint32_t noi;
+	uint32_t res2;
+};
+STATIC_ASSERT(sizeof(struct pv_hdr_encrypted) ==
+	      32 + 32 + 32 + sizeof(struct psw_t) + 8 + 4 + 4)
+
+typedef struct pv_hdr {
+	struct pv_hdr_head head;
+	struct pv_hdr_key_slot *slots;
+	struct pv_hdr_encrypted *encrypted;
+	struct pv_hdr_opt_item **optional_items;
+	uint8_t tag[AES_256_GCM_TAG_SIZE];
+} PvHdr;
+
+#endif

genprotimg/src/pv/pv_args.c

@@ -0,0 +1,405 @@
+/*
+ * PV arguments related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <glib/gprintf.h>
+
+#include "common.h"
+
+#include "pv_comp.h"
+#include "pv_error.h"
+#include "pv_args.h"
+
+static gchar summary[] =
+	"Use genprotimg to create a protected virtualization kernel image file,\n"
+	"which can be loaded using zipl or QEMU.";
+
+static gint pv_arg_compare(gconstpointer arg_1, gconstpointer arg_2)
+{
+	g_assert(arg_1);
+	g_assert(arg_2);
+
+	PvComponentType a = ((PvArg *)arg_1)->type;
+	PvComponentType b = ((PvArg *)arg_2)->type;
+
+	if (a < b)
+		return -1;
+	if (a == b)
+		return 0;
+	return 1;
+}
+
+static gint pv_arg_has_type(gconstpointer arg, gconstpointer type)
+{
+	const PvArg *c = arg;
+	const PvComponentType *t = type;
+
+	g_assert(arg);
+
+	if (c->type == *t)
+		return 0;
+	if (c->type < *t)
+		return -1;
+	return 1;
+}
+
+static gint pv_args_set_defaults(PvArgs *args, GError **err G_GNUC_UNUSED)
+{
+	if (!args->psw_addr)
+		args->psw_addr =
+			g_strdup_printf("0x%lx", DEFAULT_INITIAL_PSW_ADDR);
+
+	return 0;
+}
+
+static gint pv_args_validate_options(PvArgs *args, GError **err)
+{
+	PvComponentType KERNEL = PV_COMP_TYPE_KERNEL;
+
+	if (args->unused_values->len > 0) {
+		g_autofree gchar *unused = NULL;
+
+		for (gsize i = args->unused_values->len; i > 0; i--) {
+			g_autofree gchar *tmp = unused;
+
+			unused = g_strjoin(" ", g_ptr_array_index(args->unused_values, i - 1),
+					   tmp,
+					   NULL);
+		}
+
+		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_INVALID_ARGUMENT,
+			    _("Unrecognized arguments: '%s'.\nUse 'genprotimg --help' for more information"),
+			    unused);
+		return -1;
+	}
+
+	if (!args->output_path) {
+		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			    _("Option '--output' is required.\nUse 'genprotimg --help' for more information"));
+		return -1;
+	}
+
+	if (!g_slist_find_custom(args->comps, &KERNEL, pv_arg_has_type)) {
+		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			    _("Option '--image' is required.\nUse 'genprotimg --help' for more information"));
+		return -1;
+	}
+
+	if (!args->host_keys || g_strv_length(args->host_keys) == 0) {
+		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			    _("Option '--host-key-document' is required.\nUse 'genprotimg --help' for more information"));
+		return -1;
+	}
+
+	if (!args->no_verify) {
+		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			    _("Use the option '--no-verify' as the verification support is not available yet."));
+		return -1;
+	}
+
+	return 0;
+}
+
+static gboolean cb_add_component(const gchar *option, const gchar *value,
+				 PvArgs *args, GError **err)
+{
+	PvArg *comp = NULL;
+	gint type = -1;
+
+	if (g_str_equal(option, "-i") || g_str_equal(option, "--image"))
+		type = PV_COMP_TYPE_KERNEL;
+	if (g_str_equal(option, "-r") || g_str_equal(option, "--ramdisk"))
+		type = PV_COMP_TYPE_INITRD;
+	if (g_str_equal(option, "-p") || g_str_equal(option, "--parmfile"))
+		type = PV_COMP_TYPE_CMDLINE;
+
+	if (type < 0) {
+		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			    _("Invalid option '%s': "), option);
+		return FALSE;
+	}
+
+	if (g_slist_find_custom(args->comps, &type, pv_arg_has_type)) {
+		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			    _("Multiple values for option '%s'"), option);
+		return FALSE;
+	}
+
+	comp = pv_arg_new((PvComponentType)type, value);
+	args->comps = g_slist_insert_sorted(args->comps, comp, pv_arg_compare);
+	return TRUE;
+}
+
+static gboolean cb_set_string_option(const gchar *option, const gchar *value,
+				     PvArgs *args, GError **err)
+{
+	gchar **args_option = NULL;
+
+	if (g_str_equal(option, "-o") || g_str_equal(option, "--output"))
+		args_option = &args->output_path;
+	if (g_str_equal(option, "--x-comp-key"))
+		args_option = &args->xts_key_path;
+	if (g_str_equal(option, "--x-comm-key"))
+		args_option = &args->cust_comm_key_path;
+	if (g_str_equal(option, "--x-header-key"))
+		args_option = &args->cust_root_key_path;
+	if (g_str_equal(option, "--x-pcf"))
+		args_option = &args->pcf;
+	if (g_str_equal(option, "--x-psw"))
+		args_option = &args->psw_addr;
+	if (g_str_equal(option, "--x-scf"))
+		args_option = &args->scf;
+
+	if (!args_option) {
+		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			    _("Invalid option '%s': "), option);
+		return FALSE;
+	}
+
+	if (*args_option) {
+		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			    _("Multiple values for option '%s'"), option);
+		return FALSE;
+	}
+
+	*args_option = g_strdup(value);
+	return TRUE;
+}
+
+static gboolean cb_set_log_level(const gchar *option G_GNUC_UNUSED,
+				 const gchar *value G_GNUC_UNUSED, PvArgs *args,
+				 GError **err G_GNUC_UNUSED)
+{
+	args->log_level++;
+	return TRUE;
+}
+
+static gboolean cb_remaining_values(const gchar *option G_GNUC_UNUSED,
+				    const gchar *value, PvArgs *args,
+				    GError **err G_GNUC_UNUSED)
+{
+	g_ptr_array_add(args->unused_values, g_strdup(value));
+	return TRUE;
+}
+
+#define INDENT "                                   "
+
+gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
+			   GError **err)
+{
+	g_autoptr(GOptionContext) context = NULL;
+	gboolean print_version = FALSE;
+	GOptionGroup *group, *x_group;
+
+	g_autofree gchar *psw_desc = g_strdup_printf(
+		_("Load from the specified hexadecimal ADDRESS.\n" INDENT
+		  "Optional; default: '0x%lx'."),
+		DEFAULT_INITIAL_PSW_ADDR);
+	GOptionEntry entries[] = {
+		{ .long_name = "host-key-document",
+		  .short_name = 'k',
+		  .flags = G_OPTION_FLAG_NONE,
+		  .arg = G_OPTION_ARG_FILENAME_ARRAY,
+		  .arg_data = &args->host_keys,
+		  .description =
+			_("FILE specifies a host-key document. At least\n" INDENT
+			  "one is required."),
+		  .arg_description = _("FILE") },
+		{ .long_name = "output",
+		  .short_name = 'o',
+		  .flags = G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description = _("Set FILE as the output file."),
+		  .arg_description = _("FILE") },
+		{ .long_name = "image",
+		  .short_name = 'i',
+		  .flags = G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_add_component,
+		  .description = _("Use IMAGE as the Linux kernel image."),
+		  .arg_description = _("IMAGE") },
+		{ .long_name = "ramdisk",
+		  .short_name = 'r',
+		  .flags = G_OPTION_FLAG_OPTIONAL_ARG | G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_add_component,
+		  .description = _("Use RAMDISK as the initial RAM disk\n" INDENT
+				   "(optional)."),
+		  .arg_description = _("RAMDISK") },
+		{ .long_name = "parmfile",
+		  .short_name = 'p',
+		  .flags = G_OPTION_FLAG_OPTIONAL_ARG | G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_add_component,
+		  .description = _("Use the kernel parameters stored in PARMFILE\n" INDENT
+				   "(optional)."),
+		  .arg_description = _("PARMFILE") },
+		{ .long_name = "no-verify",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_NONE,
+		  .arg = G_OPTION_ARG_NONE,
+		  .arg_data = &args->no_verify,
+		  .description = _("Disable the host-key document verification\n" INDENT
+				   "(optional)."),
+		  .arg_description = NULL },
+		{ .long_name = "verbose",
+		  .short_name = 'V',
+		  .flags = G_OPTION_FLAG_NO_ARG,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_log_level,
+		  .description = _("Provide more detailed output (optional)."),
+		  .arg_description = NULL },
+		{ .long_name = "version",
+		  .short_name = 'v',
+		  .flags = G_OPTION_FLAG_NONE,
+		  .arg = G_OPTION_ARG_NONE,
+		  .arg_data = &print_version,
+		  .description = _("Print the version and exit."),
+		  .arg_description = NULL },
+		{ .long_name = G_OPTION_REMAINING,
+		  .short_name = 0,
+		  .flags = 0,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_remaining_values,
+		  .description = NULL,
+		  .arg_description = NULL },
+		{ 0 },
+	};
+
+	GOptionEntry x_entries[] = {
+		{ .long_name = "x-comm-key",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description = _(
+			  "Use FILE as the customer communication key.\n" INDENT
+			  "Optional; default: auto-generated."),
+		  .arg_description = _("FILE") },
+		{ .long_name = "x-comp-key",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description = _(
+			  "Use FILE as the AES 256-bit XTS key\n" INDENT
+			  "that is used for the component encryption.\n" INDENT
+			  "Optional; default: auto-generated."),
+		  .arg_description = _("FILE") },
+		{ .long_name = "x-header-key",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_FILENAME,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description = _(
+			  "Use FILE as the AES 256-bit GCM header key\n" INDENT
+			  "that protects the PV header.\n" INDENT
+			  "Optional; default: auto-generated."),
+		  .arg_description = _("FILE") },
+		{ .long_name = "x-pcf",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_NONE,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description =
+			  _("Specify the plaintext control flags\n" INDENT
+			    "as a hexadecimal value.\n" INDENT
+			    "Optional; default: '0x0'."),
+		  .arg_description = _("VALUE") },
+		{ .long_name = "x-psw",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_NONE,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description = psw_desc,
+		  .arg_description = _("ADDRESS") },
+		{ .long_name = "x-scf",
+		  .short_name = 0,
+		  .flags = G_OPTION_FLAG_NONE,
+		  .arg = G_OPTION_ARG_CALLBACK,
+		  .arg_data = cb_set_string_option,
+		  .description = _("Specify the secret control flags\n" INDENT
+				   "as a hexadecimal value.\n" INDENT
+				   "Optional; default: '0x0'."),
+		  .arg_description = _("VALUE") },
+		{ 0 },
+	};
+
+	context = g_option_context_new(
+		_("- Create a protected virtualization image"));
+	g_option_context_set_summary(context, _(summary));
+	group = g_option_group_new(GETTEXT_PACKAGE, _("Application Options:"),
+				   _("Show help options"), args, NULL);
+	g_option_group_add_entries(group, entries);
+	g_option_context_set_main_group(context, group);
+
+	x_group = g_option_group_new("experimental", _("Experimental Options:"),
+				     _("Show experimental options"), args, NULL);
+	g_option_group_add_entries(x_group, x_entries);
+	g_option_context_add_group(context, x_group);
+	if (!g_option_context_parse(context, argc, argv, err))
+		return -1;
+
+	if (print_version) {
+		g_printf(_("%s version %s\n"), tool_name, RELEASE_STRING);
+		g_printf("%s\n", copyright_notice);
+		exit(EXIT_SUCCESS);
+	}
+
+	if (pv_args_set_defaults(args, err) < 0)
+		return -1;
+
+	return pv_args_validate_options(args, err);
+}
+
+PvArgs *pv_args_new(void)
+{
+	g_autoptr(PvArgs) args = g_new0(PvArgs, 1);
+
+	args->unused_values = g_ptr_array_new_with_free_func(g_free);
+	return g_steal_pointer(&args);
+}
+
+void pv_args_free(PvArgs *args)
+{
+	if (!args)
+		return;
+
+	g_free(args->pcf);
+	g_free(args->scf);
+	g_free(args->psw_addr);
+	g_free(args->cust_root_key_path);
+	g_free(args->cust_comm_key_path);
+	g_free(args->gcm_iv_path);
+	g_strfreev(args->host_keys);
+	g_free(args->xts_key_path);
+	g_slist_free_full(args->comps, (GDestroyNotify)pv_arg_free);
+	g_ptr_array_free(args->unused_values, TRUE);
+	g_free(args->output_path);
+	g_free(args->tmp_dir);
+	g_free(args);
+}
+
+void pv_arg_free(PvArg *arg)
+{
+	if (!arg)
+		return;
+
+	g_free(arg->path);
+	g_free(arg);
+}
+PvArg *pv_arg_new(PvComponentType type, const gchar *path)
+{
+	g_autoptr(PvArg) ret = g_new0(struct pv_arg, 1);
+
+	ret->type = type;
+	ret->path = g_strdup(path);
+	return g_steal_pointer(&ret);
+}

genprotimg/src/pv/pv_args.h

@@ -0,0 +1,53 @@
+/*
+ * PV arguments related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_ARGS_H
+#define PV_ARGS_H
+
+#include <glib.h>
+
+#include "pv_comp.h"
+
+typedef struct pv_arg {
+	PvComponentType type;
+	gchar *path;
+} PvArg;
+
+PvArg *pv_arg_new(PvComponentType type, const gchar *path);
+void pv_arg_free(PvArg *arg);
+
+typedef struct {
+	gint log_level;
+	gint no_verify;
+	gchar *pcf;
+	gchar *scf;
+	gchar *psw_addr; /* PSW address which will be used for the start of
+			  * the actual component (e.g. Linux kernel)
+			  */
+	gchar *cust_root_key_path;
+	gchar *cust_comm_key_path;
+	gchar *gcm_iv_path;
+	gchar **host_keys;
+	gchar *xts_key_path;
+	GSList *comps;
+	gchar *output_path;
+	gchar *tmp_dir;
+	GPtrArray *unused_values;
+} PvArgs;
+
+PvArgs *pv_args_new(void);
+void pv_args_free(PvArgs *args);
+
+gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
+			   GError **err);
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvArg, pv_arg_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvArgs, pv_args_free)
+
+#endif

genprotimg/src/pv/pv_comp.c

@@ -0,0 +1,446 @@
+/*
+ * PV component related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <openssl/bn.h>
+#include <openssl/evp.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "boot/s390.h"
+#include "common.h"
+#include "utils/align.h"
+#include "utils/buffer.h"
+#include "utils/crypto.h"
+#include "utils/file_utils.h"
+
+#include "pv_comp.h"
+#include "pv_error.h"
+
+static void comp_file_free(CompFile *comp)
+{
+	if (!comp)
+		return;
+
+	g_free(comp->path);
+	g_free(comp);
+}
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(CompFile, comp_file_free)
+
+static PvComponent *pv_component_new(PvComponentType type, gsize size,
+				     PvComponentDataType d_type, void **data,
+				     GError **err)
+{
+	g_autoptr(PvComponent) ret = g_new0(PvComponent, 1);
+
+	g_assert(type >= 0 && type <= UINT16_MAX);
+
+	ret->type = (int)type;
+	ret->d_type = (int)d_type;
+	ret->data = g_steal_pointer(data);
+	ret->orig_size = size;
+
+	if (generate_tweak(&ret->tweak, (uint16_t)type, err) < 0)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+PvComponent *pv_component_new_file(PvComponentType type, const gchar *path,
+				   GError **err)
+{
+	g_autoptr(CompFile) file = g_new0(CompFile, 1);
+	gsize size;
+	gint rc;
+
+	g_assert(path != NULL);
+
+	rc = file_size(path, &size, err);
+	if (rc < 0)
+		return NULL;
+
+	file->path = g_strdup(path);
+	file->size = size;
+	return pv_component_new(type, size, DATA_FILE, (void **)&file, err);
+}
+
+PvComponent *pv_component_new_buf(PvComponentType type, const Buffer *buf,
+				  GError **err)
+{
+	g_assert(buf);
+
+	g_autoptr(Buffer) dup_buf = buffer_dup(buf, FALSE);
+	return pv_component_new(type, buf->size, DATA_BUFFER, (void **)&dup_buf,
+				err);
+}
+
+void pv_component_free(PvComponent *component)
+{
+	if (!component)
+		return;
+
+	switch ((PvComponentDataType)component->d_type) {
+	case DATA_BUFFER:
+		buffer_clear(&component->buf);
+		break;
+	case DATA_FILE:
+		comp_file_free(component->file);
+		break;
+	}
+
+	g_free(component);
+}
+
+gint pv_component_type(const PvComponent *component)
+{
+	return component->type;
+}
+
+const gchar *pv_component_name(const PvComponent *component)
+{
+	gint type = pv_component_type(component);
+
+	switch ((PvComponentType)type) {
+	case PV_COMP_TYPE_KERNEL:
+		return "kernel";
+	case PV_COMP_TYPE_INITRD:
+		return "ramdisk";
+	case PV_COMP_TYPE_CMDLINE:
+		return "parmline";
+	case PV_COMP_TYPE_STAGE3B:
+		return "stage3b";
+	}
+
+	g_assert_not_reached();
+}
+
+uint64_t pv_component_size(const PvComponent *component)
+{
+	switch ((PvComponentDataType)component->d_type) {
+	case DATA_BUFFER:
+		return component->buf->size;
+	case DATA_FILE:
+		return component->file->size;
+	}
+
+	g_assert_not_reached();
+}
+
+uint64_t pv_component_get_src_addr(const PvComponent *component)
+{
+	return component->src_addr;
+}
+
+uint64_t pv_component_get_orig_size(const PvComponent *component)
+{
+	return component->orig_size;
+}
+
+uint64_t pv_component_get_tweak_prefix(const PvComponent *component)
+{
+	return GUINT64_FROM_BE(component->tweak.cmp_idx.data);
+}
+
+gboolean pv_component_is_stage3b(const PvComponent *component)
+{
+	return pv_component_type(component) == PV_COMP_TYPE_STAGE3B;
+}
+
+gint pv_component_align_and_encrypt(PvComponent *component, const gchar *tmp_path,
+				    void *opaque, GError **err)
+{
+	struct cipher_parms *parms = opaque;
+
+	switch ((PvComponentDataType)component->d_type) {
+	case DATA_BUFFER: {
+		g_autoptr(Buffer) enc_buf = NULL;
+
+		if (!(IS_PAGE_ALIGNED(pv_component_size(component)))) {
+			g_autoptr(Buffer) new = NULL;
+
+			/* create a page aligned copy */
+			new = buffer_dup(component->buf, TRUE);
+			buffer_clear(&component->buf);
+			component->buf = g_steal_pointer(&new);
+		}
+		enc_buf = encrypt_buf(parms, component->buf, err);
+		if (!enc_buf)
+			return -1;
+
+		buffer_clear(&component->buf);
+		component->buf = g_steal_pointer(&enc_buf);
+		return 0;
+	}
+	case DATA_FILE: {
+		const gchar *comp_name = pv_component_name(component);
+		gchar *path_in = component->file->path;
+		g_autofree gchar *path_out = NULL;
+		gsize orig_size;
+		gsize prep_size;
+
+		g_assert(path_in);
+
+		path_out = g_build_filename(tmp_path, comp_name, NULL);
+		if (encrypt_file(parms, path_in, path_out, &orig_size,
+				 &prep_size, err) < 0)
+			return -1;
+
+		if (component->orig_size != orig_size) {
+			g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
+				    _("File has changed during the preparation '%s'"),
+				    path_out);
+			return -1;
+		}
+
+		g_free(component->file->path);
+		component->file->size = prep_size;
+		component->file->path = g_steal_pointer(&path_out);
+		return 0;
+	}
+	}
+
+	g_assert_not_reached();
+}
+
+/* Page align the size of the component */
+gint pv_component_align(PvComponent *component, const gchar *tmp_path,
+			void *opaque G_GNUC_UNUSED, GError **err)
+{
+	if (IS_PAGE_ALIGNED(pv_component_size(component)))
+		return 0;
+
+	switch (component->d_type) {
+	case DATA_BUFFER: {
+		g_autoptr(Buffer) buf = NULL;
+
+		buf = buffer_dup(component->buf, TRUE);
+		buffer_clear(&component->buf);
+		component->buf = g_steal_pointer(&buf);
+		return 0;
+	} break;
+	case DATA_FILE: {
+		const gchar *comp_name = pv_component_name(component);
+		g_autofree gchar *path_out =
+			g_build_filename(tmp_path, comp_name, NULL);
+		gchar *path_in = component->file->path;
+		gsize size_out;
+
+		if (pad_file_right(path_out, path_in, &size_out, PAGE_SIZE,
+				   err) < 0)
+			return -1;
+
+		g_free(component->file->path);
+		component->file->path = g_steal_pointer(&path_out);
+		component->file->size = size_out;
+		return 0;
+	} break;
+	}
+
+	g_assert_not_reached();
+}
+
+/* Convert uint64_t address to byte array */
+static void uint64_to_uint8_buf(uint8_t dst[8], uint64_t addr)
+{
+	uint8_t *p = (uint8_t *)&addr;
+
+	g_assert(dst);
+
+	for (gint i = 0; i < 8; i++) {
+		/* cppcheck-suppress objectIndex */
+		dst[i] = p[i];
+	}
+}
+
+int64_t pv_component_update_ald(const PvComponent *comp, EVP_MD_CTX *ctx,
+				GError **err)
+{
+	uint64_t addr = pv_component_get_src_addr(comp);
+	uint64_t size = pv_component_size(comp);
+	uint64_t cur = addr;
+	int64_t nep = 0;
+
+	g_assert(IS_PAGE_ALIGNED(size) && size != 0);
+
+	do {
+		uint64_t cur_be = GUINT64_TO_BE(cur);
+		uint8_t addr_buf[8];
+
+		uint64_to_uint8_buf(addr_buf, cur_be);
+
+		if (EVP_DigestUpdate(ctx, addr_buf, sizeof(addr_buf)) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("EVP_DigestUpdate failed"));
+			return -1;
+		}
+
+		cur += PAGE_SIZE;
+		nep++;
+	} while (cur < addr + size);
+
+	return nep;
+}
+
+int64_t pv_component_update_pld(const PvComponent *comp, EVP_MD_CTX *ctx,
+				GError **err)
+{
+	uint64_t size = pv_component_size(comp);
+	int64_t nep = 0;
+
+	g_assert(IS_PAGE_ALIGNED(size) && size != 0);
+
+	switch (comp->d_type) {
+	case DATA_BUFFER: {
+		const Buffer *buf = comp->buf;
+
+		g_assert(buf->size <= INT64_MAX);
+		g_assert(buf->size == size);
+
+		if (EVP_DigestUpdate(ctx, buf->data, buf->size) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("EVP_DigestUpdate failed"));
+			return -1;
+		}
+
+		nep = (int64_t)(buf->size / PAGE_SIZE);
+		break;
+	}
+	case DATA_FILE: {
+		const gchar *in_path = comp->file->path;
+		guchar in_buf[PAGE_SIZE];
+		gsize num_bytes_read_total = 0;
+		gsize num_bytes_read = 0;
+		FILE *f_in;
+
+		f_in = file_open(in_path, "rb", err);
+		if (!f_in)
+			return -1;
+
+		do {
+			/* Read data in blocks. Update the digest
+			 * context each read.
+			 */
+			if (file_read(f_in, in_buf, sizeof(*in_buf),
+				      sizeof(in_buf), &num_bytes_read,
+				      err) < 0) {
+				fclose(f_in);
+				return -1;
+			}
+			num_bytes_read_total += num_bytes_read;
+
+			if (EVP_DigestUpdate(ctx, in_buf, sizeof(in_buf)) != 1) {
+				g_set_error(err, PV_CRYPTO_ERROR,
+					    PV_CRYPTO_ERROR_INTERNAL,
+					    _("EVP_DigestUpdate failed"));
+				fclose(f_in);
+				return -1;
+			}
+
+			nep++;
+		} while (num_bytes_read_total < pv_component_size(comp) &&
+			 num_bytes_read != 0);
+
+		if (num_bytes_read_total != pv_component_size(comp)) {
+			g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
+				    _("'%s' has changed during the preparation"),
+				    in_path);
+			fclose(f_in);
+			return -1;
+		}
+		fclose(f_in);
+		break;
+	}
+	default:
+		g_assert_not_reached();
+	}
+
+	return nep;
+}
+
+int64_t pv_component_update_tld(const PvComponent *comp, EVP_MD_CTX *ctx,
+				GError **err)
+{
+	uint64_t size = pv_component_size(comp);
+	const union tweak *tweak = &comp->tweak;
+	g_autoptr(BIGNUM) tweak_num = NULL;
+	int64_t nep = 0;
+
+	g_assert(IS_PAGE_ALIGNED(size) && size != 0);
+
+	tweak_num = BN_bin2bn(tweak->data, sizeof(tweak->data), NULL);
+	if (!tweak_num) {
+		g_set_error(err, PV_CRYPTO_ERROR,
+			    PV_CRYPTO_ERROR_INTERNAL,
+			    _("BN_bin2bn failed"));
+	}
+
+	for (uint64_t cur = 0; cur < size; cur += PAGE_SIZE) {
+		guchar tmp[sizeof(tweak->data)] = { 0 };
+
+		g_assert(BN_num_bytes(tweak_num) >= 0);
+		g_assert(sizeof(tmp) - (guint)BN_num_bytes(tweak_num) > 0);
+
+		if (BN_bn2binpad(tweak_num, tmp, sizeof(tmp)) < 0) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("BN_bn2binpad failed"));
+		}
+
+		if (EVP_DigestUpdate(ctx, tmp, sizeof(tmp)) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("EVP_DigestUpdate failed"));
+			return -1;
+		}
+
+		/* calculate new tweak value */
+		if (BN_add_word(tweak_num, PAGE_SIZE) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("BN_add_word failed"));
+		}
+
+		nep++;
+	}
+
+	return nep;
+}
+
+gint pv_component_write(const PvComponent *component, FILE *f, GError **err)
+{
+	uint64_t offset = pv_component_get_src_addr(component);
+
+	g_assert(f);
+
+	switch (component->d_type) {
+	case DATA_BUFFER: {
+		const Buffer *buf = component->buf;
+
+		if (seek_and_write_buffer(f, buf, offset, err) < 0)
+			return -1;
+
+		return 0;
+	}
+	case DATA_FILE: {
+		const CompFile *file = component->file;
+
+		if (seek_and_write_file(f, file, offset, err) < 0)
+			return -1;
+
+		return 0;
+	}
+	}
+
+	g_assert_not_reached();
+}

genprotimg/src/pv/pv_comp.h

@@ -0,0 +1,78 @@
+/*
+ * PV component related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_COMP_H
+#define PV_COMP_H
+
+#include <glib.h>
+#include <openssl/evp.h>
+#include <stdint.h>
+
+#include "utils/crypto.h"
+
+/* The order of this enum also implicitly defines the order of the
+ * components within the PV image!
+ */
+typedef enum {
+	PV_COMP_TYPE_KERNEL  = 0,
+	PV_COMP_TYPE_CMDLINE = 1,
+	PV_COMP_TYPE_INITRD  = 2,
+	PV_COMP_TYPE_STAGE3B = 3,
+} PvComponentType;
+
+typedef enum {
+	DATA_FILE = 0,
+	DATA_BUFFER,
+} PvComponentDataType;
+
+typedef struct comp_file {
+	gchar *path;
+	gsize size;
+} CompFile;
+
+typedef struct {
+	gint type; /* PvComponentType */
+	gint d_type; /* PvComponentDataType */
+	union {
+		struct comp_file *file;
+		Buffer *buf;
+		void *data;
+	};
+	uint64_t src_addr;
+	uint64_t orig_size;
+	union tweak tweak; /* used for the AES XTS encryption */
+} PvComponent;
+
+PvComponent *pv_component_new_file(PvComponentType type, const gchar *path,
+				   GError **err);
+PvComponent *pv_component_new_buf(PvComponentType type, const Buffer *buf,
+				  GError **err);
+void pv_component_free(PvComponent *component);
+gint pv_component_type(const PvComponent *component);
+const gchar *pv_component_name(const PvComponent *component);
+uint64_t pv_component_size(const PvComponent *component);
+uint64_t pv_component_get_src_addr(const PvComponent *component);
+uint64_t pv_component_get_orig_size(const PvComponent *component);
+uint64_t pv_component_get_tweak_prefix(const PvComponent *component);
+gboolean pv_component_is_stage3b(const PvComponent *component);
+gint pv_component_align_and_encrypt(PvComponent *component, const gchar *tmp_path,
+				    void *opaque, GError **err);
+gint pv_component_align(PvComponent *component, const gchar *tmp_path,
+			void *opaque G_GNUC_UNUSED, GError **err);
+int64_t pv_component_update_pld(const PvComponent *comp, EVP_MD_CTX *ctx,
+				GError **err);
+int64_t pv_component_update_ald(const PvComponent *comp, EVP_MD_CTX *ctx,
+				GError **err);
+int64_t pv_component_update_tld(const PvComponent *comp, EVP_MD_CTX *ctx,
+				GError **err);
+gint pv_component_write(const PvComponent *component, FILE *f, GError **err);
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvComponent, pv_component_free)
+
+#endif

genprotimg/src/pv/pv_comps.c

@@ -0,0 +1,252 @@
+/*
+ * PV components related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <openssl/evp.h>
+#include <stdint.h>
+
+#include "boot/s390.h"
+#include "boot/stage3b.h"
+#include "common.h"
+#include "utils/align.h"
+#include "utils/crypto.h"
+
+#include "pv_comp.h"
+#include "pv_comps.h"
+#include "pv_error.h"
+#include "pv_stage3.h"
+
+struct _pv_img_comps {
+	gboolean finalized;
+	uint64_t next_src;
+	uint64_t nep;
+	EVP_MD_CTX *ald; /* context used for the hash of the addresses */
+	EVP_MD_CTX *pld; /* context used for the hash of the pages content */
+	EVP_MD_CTX *tld; /* context used for the hash of the tweaks */
+	GSList *comps; /* elements sorted by component type */
+};
+
+void pv_img_comps_free(PvImgComps *comps)
+{
+	if (!comps)
+		return;
+
+	EVP_MD_CTX_free(comps->ald);
+	EVP_MD_CTX_free(comps->pld);
+	EVP_MD_CTX_free(comps->tld);
+	g_slist_free_full(comps->comps, (GDestroyNotify)pv_component_free);
+	g_free(comps);
+}
+
+PvImgComps *pv_img_comps_new(const EVP_MD *ald_md, const EVP_MD *pld_md,
+			     const EVP_MD *tld_md, GError **err)
+{
+	g_autoptr(PvImgComps) ret = g_new0(PvImgComps, 1);
+
+	ret->ald = digest_ctx_new(ald_md, err);
+	if (!ret->ald)
+		return NULL;
+
+	ret->pld = digest_ctx_new(pld_md, err);
+	if (!ret->pld)
+		return NULL;
+
+	ret->tld = digest_ctx_new(tld_md, err);
+	if (!ret->tld)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+guint pv_img_comps_length(const PvImgComps *comps)
+{
+	return g_slist_length(comps->comps);
+}
+
+/* Update hashes and nep */
+/* Returns 0 in case of success and -1 in case of a failure */
+static gint pv_img_comps_hash_comp(PvImgComps *comps, const PvComponent *comp,
+				   GError **err)
+{
+	int64_t nep_1 = 0;
+	int64_t nep_2 = 0;
+	int64_t nep_3 = 0;
+
+	/* update pld */
+	nep_1 = pv_component_update_pld(comp, comps->pld, err);
+	if (nep_1 < 0)
+		return -1;
+
+	/* update ald */
+	nep_2 = pv_component_update_ald(comp, comps->ald, err);
+	if (nep_2 < 0)
+		return -1;
+
+	/* update tld */
+	nep_3 = pv_component_update_tld(comp, comps->tld, err);
+	if (nep_3 < 0)
+		return -1;
+
+	g_assert(nep_1 == nep_2);
+	g_assert(nep_2 == nep_3);
+
+	/* update comps->nep */
+	g_assert_true(g_uint64_checked_add(&comps->nep, comps->nep,
+					   (uint64_t)nep_1));
+	return 0;
+}
+
+gint pv_img_comps_add_component(PvImgComps *comps, PvComponent **comp,
+				GError **err)
+{
+	g_assert(comp);
+	g_assert(*comp);
+	g_assert(comps);
+	g_assert(IS_PAGE_ALIGNED(comps->next_src));
+
+	uint64_t src_addr = comps->next_src;
+	uint64_t src_size = pv_component_size(*comp)
+				    ? PAGE_ALIGN(pv_component_size(*comp))
+				    : PAGE_SIZE;
+
+	if (comps->finalized) {
+		g_set_error(err, PV_COMPONENT_ERROR, PV_COMPONENT_ERROR_FINALIZED,
+			    _("Failed to add component, image is already finalized"));
+		return -1;
+	}
+
+	/* set the address of the component in the memory layout */
+	(*comp)->src_addr = src_addr;
+
+	g_info("%12s:\t0x%012lx (%12ld / %12ld Bytes)",
+	       pv_component_name(*comp), pv_component_get_src_addr(*comp),
+	       pv_component_size(*comp), pv_component_get_orig_size(*comp));
+
+	/* append the component and pass the responsibility of @comp
+	 * to @comps
+	 */
+	comps->comps = g_slist_append(comps->comps, g_steal_pointer(comp));
+	comps->next_src += src_size;
+
+	g_assert(IS_PAGE_ALIGNED(comps->next_src));
+	g_assert(!*comp);
+	return 0;
+}
+
+struct stage3b_args *pv_img_comps_get_stage3b_args(const PvImgComps *comps,
+						   struct psw_t *psw)
+{
+	g_autofree struct stage3b_args *ret = g_new0(struct stage3b_args, 1);
+
+	for (GSList *iterator = comps->comps; iterator; iterator = iterator->next) {
+		const PvComponent *img_comp = iterator->data;
+		uint64_t src_addr, dst_size;
+
+		g_assert(img_comp);
+
+		src_addr = pv_component_get_src_addr(img_comp);
+		dst_size = pv_component_get_orig_size(img_comp);
+
+		g_assert(dst_size <= pv_component_size(img_comp));
+
+		switch ((PvComponentType)pv_component_type(img_comp)) {
+		case PV_COMP_TYPE_KERNEL:
+			memblob_init(&ret->kernel, src_addr, dst_size);
+			break;
+		case PV_COMP_TYPE_CMDLINE:
+			memblob_init(&ret->cmdline, src_addr, dst_size);
+			break;
+		case PV_COMP_TYPE_INITRD:
+			memblob_init(&ret->initrd, src_addr, dst_size);
+			break;
+		case PV_COMP_TYPE_STAGE3B:
+			/* nothing needs to be done since it is the
+			 * stage3b itself
+			 */
+			break;
+		default:
+			g_assert_not_reached();
+			break;
+		}
+	}
+
+	/* for `stage3b_args` big-endian format must be used */
+	ret->psw.mask = GUINT64_TO_BE(psw->mask);
+	ret->psw.addr = GUINT64_TO_BE(psw->addr);
+	return g_steal_pointer(&ret);
+}
+
+gint pv_img_comps_set_offset(PvImgComps *comps, gsize offset, GError **err)
+{
+	g_assert(IS_PAGE_ALIGNED(comps->next_src));
+
+	if (!IS_PAGE_ALIGNED(offset)) {
+		g_set_error(err, PV_IMAGE_ERROR, PV_IMAGE_ERROR_OFFSET,
+			    _("Offset must be page aligned"));
+		return -1;
+	}
+
+	if (pv_img_comps_length(comps) > 0) {
+		g_set_error(err, PV_IMAGE_ERROR, PV_IMAGE_ERROR_OFFSET,
+			    _("Offset cannot be changed after a component was added"));
+		return -1;
+	}
+
+	comps->next_src += offset;
+
+	g_assert(IS_PAGE_ALIGNED(comps->next_src));
+	return 0;
+}
+
+GSList *pv_img_comps_get_comps(const PvImgComps *comps)
+{
+	return comps->comps;
+}
+
+gint pv_img_comps_finalize(PvImgComps *comps, Buffer **pld_digest,
+			   Buffer **ald_digest, Buffer **tld_digest,
+			   uint64_t *nep, GError **err)
+{
+	g_autoptr(Buffer) tmp_pld_digest = NULL;
+	g_autoptr(Buffer) tmp_ald_digest = NULL;
+	g_autoptr(Buffer) tmp_tld_digest = NULL;
+
+	comps->finalized = TRUE;
+	for (GSList *iterator = comps->comps; iterator; iterator = iterator->next) {
+		const PvComponent *comp = iterator->data;
+
+		/* update hashes and nep */
+		if (pv_img_comps_hash_comp(comps, comp, err) < 0)
+			return -1;
+	}
+
+	tmp_pld_digest = digest_ctx_finalize(comps->pld, err);
+	if (!tmp_pld_digest)
+		return -1;
+
+	tmp_ald_digest = digest_ctx_finalize(comps->ald, err);
+	if (!tmp_ald_digest)
+		return -1;
+
+	tmp_tld_digest = digest_ctx_finalize(comps->tld, err);
+	if (!tmp_tld_digest)
+		return -1;
+
+	*pld_digest = g_steal_pointer(&tmp_pld_digest);
+	*ald_digest = g_steal_pointer(&tmp_ald_digest);
+	*tld_digest = g_steal_pointer(&tmp_tld_digest);
+	*nep = comps->nep;
+	return 0;
+}
+
+PvComponent *pv_img_comps_get_nth_comp(PvImgComps *comps, guint n)
+{
+	return g_slist_nth_data(comps->comps, n);
+}

genprotimg/src/pv/pv_comps.h

@@ -0,0 +1,42 @@
+/*
+ * PV components related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_COMPS_H
+#define PV_COMPS_H
+
+#include <glib.h>
+#include <openssl/evp.h>
+#include <stdint.h>
+
+#include "boot/s390.h"
+#include "boot/stage3b.h"
+#include "utils/buffer.h"
+
+#include "pv_comp.h"
+
+typedef struct _pv_img_comps PvImgComps;
+
+PvImgComps *pv_img_comps_new(const EVP_MD *ald_md, const EVP_MD *pld_md,
+			     const EVP_MD *tld_md, GError **err);
+guint pv_img_comps_length(const PvImgComps *comps);
+GSList *pv_img_comps_get_comps(const PvImgComps *comps);
+struct stage3b_args *pv_img_comps_get_stage3b_args(const PvImgComps *comps,
+						   struct psw_t *psw);
+gint pv_img_comps_add_component(PvImgComps *comps, PvComponent **comp,
+				GError **err);
+PvComponent *pv_img_comps_get_nth_comp(PvImgComps *comps, guint n);
+gint pv_img_comps_set_offset(PvImgComps *comps, gsize offset, GError **err);
+gint pv_img_comps_finalize(PvImgComps *comps, Buffer **pld_digest,
+			   Buffer **ald_digest, Buffer **tld_digest,
+			   uint64_t *nep, GError **err);
+void pv_img_comps_free(PvImgComps *comps);
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvImgComps, pv_img_comps_free)
+
+#endif

genprotimg/src/pv/pv_error.c

@@ -0,0 +1,37 @@
+/*
+ * PV error related functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+
+#include "pv_error.h"
+
+GQuark pv_error_quark(void)
+{
+	return g_quark_from_static_string("pv-error-quark");
+}
+
+GQuark pv_crypto_error_quark(void)
+{
+	return g_quark_from_static_string("pv-crypto-error-quark");
+}
+
+GQuark pv_component_error_quark(void)
+{
+	return g_quark_from_static_string("pv-component-error-quark");
+}
+
+GQuark pv_image_error_quark(void)
+{
+	return g_quark_from_static_string("pv-image-error-quark");
+}
+
+GQuark pv_parse_error_quark(void)
+{
+	return g_quark_from_static_string("pv-parse-error-quark");
+}

genprotimg/src/pv/pv_error.h

@@ -0,0 +1,62 @@
+/*
+ * PV error related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_ERROR_H
+#define PV_ERROR_H
+
+#include <glib.h>
+
+GQuark pv_error_quark(void);
+GQuark pv_parse_error_quark(void);
+GQuark pv_component_error_quark(void);
+GQuark pv_crypto_error_quark(void);
+GQuark pv_image_error_quark(void);
+
+#define PV_ERROR	   pv_error_quark()
+#define PV_PARSE_ERROR	   pv_parse_error_quark()
+#define PV_CRYPTO_ERROR	   pv_crypto_error_quark()
+#define PV_COMPONENT_ERROR pv_component_error_quark()
+#define PV_IMAGE_ERROR	   pv_image_error_quark()
+
+typedef enum {
+	PV_ERROR_IPIB_SIZE,
+	PV_ERROR_PV_HDR_SIZE,
+	PV_ERROR_INTERNAL,
+} PvErrors;
+
+typedef enum {
+	PV_PARSE_ERROR_OK = 0,
+	PV_PARSE_ERROR_SYNTAX,
+	PR_PARSE_ERROR_INVALID_ARGUMENT,
+	PR_PARSE_ERROR_MISSING_ARGUMENT,
+} PvParseErrors;
+
+typedef enum {
+	PV_COMPONENT_ERROR_UNALIGNED,
+	PV_COMPONENT_ERROR_FINALIZED,
+} PvComponentErrors;
+
+typedef enum {
+	PV_IMAGE_ERROR_OFFSET,
+	PV_IMAGE_ERROR_FINALIZED,
+} PvImageErrors;
+
+typedef enum {
+	PV_CRYPTO_ERROR_VERIFICATION,
+	PV_CRYPTO_ERROR_INIT,
+	PV_CRYPTO_ERROR_READ_CERTIFICATE,
+	PV_CRYPTO_ERROR_INTERNAL,
+	PV_CRYPTO_ERROR_DERIVE,
+	PV_CRYPTO_ERROR_KEYGENERATION,
+	PV_CRYPTO_ERROR_RANDOMIZATION,
+	PV_CRYPTO_ERROR_INVALID_PARM,
+	PV_CRYPTO_ERROR_INVALID_KEY_SIZE,
+} PvCryptoErrors;
+
+#endif

genprotimg/src/pv/pv_hdr.c

@@ -0,0 +1,293 @@
+/*
+ * PV header related functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <openssl/aes.h>
+#include <openssl/evp.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "boot/s390.h"
+#include "include/pv_crypto_def.h"
+#include "utils/buffer.h"
+#include "utils/crypto.h"
+
+#include "pv_comp.h"
+#include "pv_hdr.h"
+#include "pv_image.h"
+
+void pv_hdr_free(PvHdr *hdr)
+{
+	if (!hdr)
+		return;
+
+	g_free(hdr->optional_items);
+	g_free(hdr->encrypted);
+	g_free(hdr->slots);
+	g_free(hdr);
+}
+
+uint32_t pv_hdr_size(const PvHdr *hdr)
+{
+	return GUINT32_FROM_BE(hdr->head.phs);
+}
+
+gboolean pv_hdr_uses_encryption(const PvHdr *hdr)
+{
+	return !(GUINT64_FROM_BE(hdr->head.pcf) & PV_CFLAG_NO_DECRYPTION);
+}
+
+uint64_t pv_hdr_enc_size(const PvHdr *hdr)
+{
+	return GUINT64_FROM_BE(hdr->head.sea);
+}
+
+uint32_t pv_hdr_enc_size_casted(const PvHdr *hdr)
+{
+	uint64_t size = pv_hdr_enc_size(hdr);
+
+	if (size > UINT32_MAX)
+		g_abort();
+
+	return (uint32_t)size;
+}
+
+static guint pv_hdr_tag_size(const PvHdr *hdr)
+{
+	return sizeof(hdr->tag);
+}
+
+uint32_t pv_hdr_aad_size(const PvHdr *hdr)
+{
+	return pv_hdr_size(hdr) - pv_hdr_enc_size_casted(hdr) -
+	       pv_hdr_tag_size(hdr);
+}
+
+uint64_t pv_hdr_get_nks(const PvHdr *hdr)
+{
+	return GUINT64_FROM_BE(hdr->head.nks);
+}
+
+/* In-place modification of ``buf`` */
+static gint pv_hdr_encrypt(const PvHdr *hdr, const PvImage *img, Buffer *buf,
+			   GError **err)
+{
+	uint32_t hdr_len = pv_hdr_size(hdr);
+	uint32_t aad_len = pv_hdr_aad_size(hdr);
+	guint tag_len = pv_hdr_tag_size(hdr);
+	uint32_t enc_len = pv_hdr_enc_size_casted(hdr);
+	const Buffer aad_part = { .data = buf->data, .size = aad_len };
+	Buffer enc_part = { .data = (uint8_t *)buf->data + aad_len,
+			    .size = enc_len };
+	Buffer tag_part = { .data = (uint8_t *)buf->data + hdr_len - tag_len,
+			    .size = tag_len };
+	struct cipher_parms parms;
+	int64_t c_len;
+
+	g_assert(aad_part.size + enc_part.size + tag_part.size == buf->size);
+	g_assert(img->cust_root_key->size <= INT_MAX);
+	g_assert(img->gcm_iv->size <= INT_MAX);
+	g_assert(EVP_CIPHER_key_length(img->gcm_cipher) ==
+		 (int)img->cust_root_key->size);
+	g_assert(EVP_CIPHER_iv_length(img->gcm_cipher) == (int)img->gcm_iv->size);
+
+	parms.key = img->cust_root_key;
+	parms.iv_or_tweak = img->gcm_iv;
+	parms.cipher = img->gcm_cipher;
+
+	/* in-place encryption */
+	c_len = gcm_encrypt(&enc_part, &aad_part, &parms, &enc_part, &tag_part, err);
+	if (c_len < 0)
+		return -1;
+
+	g_assert(c_len == enc_len);
+	return 0;
+}
+
+/* Initializes the unencrypted, but integrity protected part of the PV
+ * header
+ */
+static gint pv_hdr_aad_init(PvHdr *hdr, const PvImage *img, GError **err)
+{
+	g_autofree union ecdh_pub_key *cust_pub_key = NULL;
+	struct pv_hdr_key_slot *hdr_slot = hdr->slots;
+	struct pv_hdr_head *head = &hdr->head;
+	g_autoptr(Buffer) pld = NULL;
+	g_autoptr(Buffer) ald = NULL;
+	g_autoptr(Buffer) tld = NULL;
+	uint64_t nep = 0;
+
+	g_assert(sizeof(head->iv) == img->gcm_iv->size);
+	g_assert(sizeof(head->cust_pub_key) == sizeof(*cust_pub_key));
+
+	cust_pub_key = evp_pkey_to_ecdh_pub_key(img->cust_pub_priv_key, err);
+	if (!cust_pub_key)
+		return -1;
+
+	head->magic = GUINT64_TO_BE(PV_MAGIC_NUMBER);
+	head->version = GUINT32_TO_BE(PV_VERSION_1);
+	/* ``phs`` is already set so we can skip it here */
+	memcpy(head->iv, img->gcm_iv->data, sizeof(head->iv));
+	/* ``nks`` is already set so we can skip it here */
+	/* ``sea`` is already set so we can skip it here */
+	head->pcf = GUINT64_TO_BE(img->pcf);
+	memcpy(head->cust_pub_key.data, cust_pub_key,
+	       sizeof(head->cust_pub_key));
+
+	if (pv_img_calc_pld_ald_tld_nep(img, &pld, &ald, &tld, &nep, err) < 0)
+		return -1;
+
+	g_assert(sizeof(head->pld) == pld->size);
+	g_assert(sizeof(head->ald) == ald->size);
+	g_assert(sizeof(head->tld) == tld->size);
+
+	head->nep = GUINT64_TO_BE(nep);
+	memcpy(head->pld, pld->data, sizeof(head->pld));
+	memcpy(head->ald, ald->data, sizeof(head->ald));
+	memcpy(head->tld, tld->data, sizeof(head->tld));
+
+	/* set the key slots */
+	for (GSList *iterator = img->key_slots; iterator; iterator = iterator->next) {
+		const PvHdrKeySlot *slot = iterator->data;
+
+		g_assert(slot);
+
+		/* the memory for the slots is pre-allocated so we
+		 * have not to allocate and since PvHdrKeySlot is
+		 * stored in the big-edian format we can simply use
+		 * memcpy.
+		 */
+		memcpy(hdr_slot++, slot, sizeof(*slot));
+	}
+
+	return 0;
+}
+
+/* Initializes the encrypted and also integrity protected part of the
+ * PV header
+ */
+static gint pv_hdr_enc_init(PvHdr *hdr, const PvImage *img, GError **err)
+{
+	struct pv_hdr_encrypted *enc = hdr->encrypted;
+	const PvComponent *stage3b;
+	struct psw_t psw;
+
+	g_assert(sizeof(enc->img_enc_key_1) + sizeof(enc->img_enc_key_2) ==
+		 EVP_CIPHER_key_length(img->xts_cipher));
+	g_assert(sizeof(enc->cust_comm_key) == img->cust_comm_key->size);
+	g_assert(img->xts_key->size ==
+		 (guint)EVP_CIPHER_key_length(img->xts_cipher));
+
+	stage3b = pv_img_get_stage3b_comp(img, err);
+	if (!stage3b)
+		return -1;
+
+	memcpy(enc->cust_comm_key, img->cust_comm_key->data,
+	       sizeof(enc->cust_comm_key));
+	memcpy(enc->img_enc_key_1, img->xts_key->data,
+	       sizeof(enc->img_enc_key_1));
+	memcpy(enc->img_enc_key_2,
+	       (uint8_t *)img->xts_key->data + sizeof(enc->img_enc_key_1),
+	       sizeof(enc->img_enc_key_2));
+
+	/* Setup program check handler */
+	psw.mask = GUINT64_TO_BE(DEFAULT_INITIAL_PSW_MASK);
+	psw.addr = GUINT64_TO_BE(pv_component_get_src_addr(stage3b));
+	enc->psw = psw;
+	enc->scf = GUINT64_TO_BE(img->scf);
+	enc->noi = GUINT32_TO_BE(g_slist_length(img->optional_items));
+
+	/* set the optional items */
+	for (GSList *iterator = img->optional_items; iterator;
+	     iterator = iterator->next) {
+		const struct pv_hdr_opt_item *item = iterator->data;
+
+		g_assert(item);
+
+		/* not supported in the first version */
+		g_assert_not_reached();
+	}
+
+	return 0;
+}
+
+PvHdr *pv_hdr_new(const PvImage *img, GError **err)
+{
+	uint32_t noi = g_slist_length(img->optional_items);
+	uint32_t hdr_size = pv_img_get_pv_hdr_size(img);
+	gsize nks = g_slist_length(img->key_slots);
+	uint32_t sea = pv_img_get_enc_size(img);
+	g_autoptr(PvHdr) ret = NULL;
+
+	g_assert(nks > 0);
+	/* must be a multiple of AES block size */
+	g_assert(sea % AES_BLOCK_SIZE == 0);
+	g_assert(sea >= sizeof(struct pv_hdr_encrypted));
+
+	ret = g_new0(PvHdr, 1);
+	ret->slots = g_new0(struct pv_hdr_key_slot, nks);
+	ret->head.phs = GUINT32_TO_BE(hdr_size);
+	ret->head.nks = GUINT64_TO_BE(nks);
+	ret->head.sea = GUINT64_TO_BE(sea);
+
+	ret->encrypted = g_new0(struct pv_hdr_encrypted, 1);
+	ret->optional_items = g_malloc0(sea - sizeof(struct pv_hdr_encrypted));
+	ret->encrypted->noi = GUINT32_TO_BE(noi);
+
+	if (pv_hdr_aad_init(ret, img, err) < 0)
+		return NULL;
+
+	if (pv_hdr_enc_init(ret, img, err) < 0)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+static void pv_hdr_memcpy(const PvHdr *hdr, const Buffer *dst)
+{
+	uint64_t nks = pv_hdr_get_nks(hdr);
+	uint8_t *data;
+
+	g_assert(dst->size == pv_hdr_size(hdr));
+	g_assert(pv_hdr_enc_size_casted(hdr) >= sizeof(*hdr->encrypted));
+
+	data = memcpy(dst->data, &hdr->head, sizeof(hdr->head));
+	data = memcpy(data + sizeof(hdr->head), hdr->slots,
+		      sizeof(struct pv_hdr_key_slot) * nks);
+	data = memcpy(data + sizeof(struct pv_hdr_key_slot) * nks,
+		      hdr->encrypted, sizeof(*hdr->encrypted));
+	if (pv_hdr_enc_size_casted(hdr) - sizeof(*hdr->encrypted) > 0) {
+		(void)memcpy(data + sizeof(*hdr->encrypted),
+			     hdr->optional_items,
+			     pv_hdr_enc_size_casted(hdr) - sizeof(*hdr->encrypted));
+	}
+}
+
+Buffer *pv_hdr_serialize(const PvHdr *hdr, const PvImage *img,
+			 enum PvCryptoMode mode, GError **err)
+{
+	uint32_t hdr_size = pv_hdr_size(hdr);
+	g_autoptr(Buffer) ret = NULL;
+
+	ret = buffer_alloc(hdr_size);
+	pv_hdr_memcpy(hdr, ret);
+
+	if (mode == PV_ENCRYPT) {
+		/* The buffer @ret is modified in-place */
+		if (pv_hdr_encrypt(hdr, img, ret, err) < 0)
+			return NULL;
+	} else {
+		/* Simply copy the tag */
+		memcpy((uint8_t *)ret->data + hdr_size - pv_hdr_tag_size(hdr),
+		       hdr->tag, pv_hdr_tag_size(hdr));
+	}
+
+	return g_steal_pointer(&ret);
+}

genprotimg/src/pv/pv_hdr.h

@@ -0,0 +1,36 @@
+/*
+ * PV header related functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_HDR_H
+#define PV_HDR_H
+
+#include <glib.h>
+#include <stdint.h>
+
+#include "boot/s390.h"
+#include "include/pv_hdr_def.h"
+#include "utils/crypto.h"
+#include "utils/buffer.h"
+
+#include "pv_image.h"
+
+PvHdr *pv_hdr_new(const PvImage *img, GError **err);
+void pv_hdr_free(PvHdr *hdr);
+G_GNUC_UNUSED gboolean pv_hdr_uses_encryption(const PvHdr *hdr);
+Buffer *pv_hdr_serialize(const PvHdr *hdr, const PvImage *img,
+			 enum PvCryptoMode mode, GError **err);
+uint32_t pv_hdr_size(const PvHdr *hdr);
+uint32_t pv_hdr_aad_size(const PvHdr *hdr);
+uint64_t pv_hdr_enc_size(const PvHdr *hdr);
+uint32_t pv_hdr_enc_size_casted(const PvHdr *hdr);
+uint64_t pv_hdr_get_nks(const PvHdr *hdr);
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvHdr, pv_hdr_free)
+
+#endif

genprotimg/src/pv/pv_image.c

@@ -0,0 +1,821 @@
+/*
+ * PV image related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <errno.h>
+#include <glib.h>
+#include <openssl/evp.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "boot/s390.h"
+#include "boot/stage3a.h"
+#include "common.h"
+#include "include/pv_crypto_def.h"
+#include "include/pv_hdr_def.h"
+#include "utils/align.h"
+#include "utils/crypto.h"
+#include "utils/file_utils.h"
+
+#include "pv_args.h"
+#include "pv_comps.h"
+#include "pv_error.h"
+#include "pv_hdr.h"
+#include "pv_image.h"
+#include "pv_ipib.h"
+#include "pv_opt_item.h"
+#include "pv_stage3.h"
+
+const PvComponent *pv_img_get_stage3b_comp(const PvImage *img, GError **err)
+{
+	const PvComponent *comp;
+
+	g_return_val_if_fail(pv_img_comps_length(img->comps) >= 1, NULL);
+
+	comp = pv_img_comps_get_nth_comp(img->comps,
+					 pv_img_comps_length(img->comps) - 1);
+	if (!pv_component_is_stage3b(comp)) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("Failed to get 'stage3b' component"));
+		return NULL;
+	}
+	return comp;
+}
+
+typedef gint (*prepare_func)(PvComponent *obj, const gchar *tmp_path,
+			     void *opaque, GError **err);
+
+static gint pv_img_prepare_component(const PvImage *img, PvComponent *comp,
+				     GError **err)
+{
+	struct cipher_parms parms = { 0 };
+	g_autoptr(Buffer) tweak = NULL;
+	prepare_func func = NULL;
+	void *opaque = NULL;
+	gint rc;
+
+	if (img->pcf & PV_CFLAG_NO_DECRYPTION) {
+		/* we only need to align the components */
+		func = pv_component_align;
+		opaque = NULL;
+	} else {
+		const EVP_CIPHER *cipher = img->xts_cipher;
+
+		g_assert_cmpint((int)img->xts_key->size, ==,
+				EVP_CIPHER_key_length(cipher));
+		g_assert_cmpint((int)PAGE_SIZE % EVP_CIPHER_block_size(cipher),
+				==, 0);
+		g_assert_cmpint(sizeof(comp->tweak), ==,
+				EVP_CIPHER_iv_length(cipher));
+		g_assert(img->xts_key->size <= UINT_MAX);
+
+		tweak = buffer_alloc(sizeof(comp->tweak.data));
+		memcpy(tweak->data, comp->tweak.data, tweak->size);
+		func = pv_component_align_and_encrypt;
+		parms.cipher = cipher;
+		parms.key = img->xts_key;
+		parms.iv_or_tweak = tweak;
+
+		opaque = &parms;
+	}
+
+	rc = (*func)(comp, img->tmp_dir, opaque, err);
+	if (rc < 0)
+		return -1;
+
+	return 0;
+}
+
+static Buffer *pv_img_read_key(const gchar *path, guint key_size,
+			       GError **err)
+{
+	g_autoptr(Buffer) tmp_ret = NULL;
+	Buffer *ret = NULL;
+	gsize bytes_read;
+	FILE *f = NULL;
+	gsize size;
+
+	if (file_size(path, &size, err) != 0)
+		return NULL;
+
+	if (size - key_size != 0) {
+		g_set_error(err, PV_ERROR, PV_CRYPTO_ERROR_INVALID_KEY_SIZE,
+			    _("Wrong file size '%s': read %zd, expected %u"), path, size,
+			    key_size);
+		return NULL;
+	}
+
+	f = file_open(path, "rb", err);
+	if (!f)
+		return NULL;
+
+	tmp_ret = buffer_alloc(size);
+	if (file_read(f, tmp_ret->data, 1, tmp_ret->size, &bytes_read, err) < 0)
+		goto err;
+
+	if (bytes_read - key_size != 0) {
+		g_set_error(err, PV_ERROR, PV_CRYPTO_ERROR_INVALID_KEY_SIZE,
+			    _("Wrong file size '%s': read %zd, expected %u"),
+			    path, bytes_read, key_size);
+		goto err;
+	}
+
+	ret = g_steal_pointer(&tmp_ret);
+err:
+	if (f)
+		fclose(f);
+	return ret;
+}
+
+static EVP_PKEY *pv_img_get_cust_pub_priv_key(gint nid, GError **err)
+{
+	return generate_ec_key(nid, err);
+}
+
+static HostKeyList *pv_img_get_host_keys(gchar **host_cert_paths,
+					 X509_STORE *store, gint nid,
+					 GError **err)
+{
+	g_autoslist(EVP_PKEY) ret = NULL;
+
+	g_assert(host_cert_paths);
+
+	for (gchar **iterator = host_cert_paths; iterator != NULL && *iterator != NULL;
+	     iterator++) {
+		g_autoptr(EVP_PKEY) host_key = NULL;
+		const gchar *path = *iterator;
+
+		g_assert(path);
+
+		host_key = read_ec_pubkey_cert(store, nid, path, err);
+		if (!host_key)
+			return NULL;
+
+		ret = g_slist_append(ret, g_steal_pointer(&host_key));
+	}
+
+	return g_steal_pointer(&ret);
+}
+
+static Buffer *pv_img_get_key(const EVP_CIPHER *cipher, const gchar *path,
+			      GError **err)
+{
+	gint key_len = EVP_CIPHER_key_length(cipher);
+
+	g_assert(key_len > 0);
+
+	if (path)
+		return pv_img_read_key(path, (guint)key_len, err);
+
+	return generate_aes_key((guint)key_len, err);
+}
+
+static Buffer *pv_img_get_iv(const EVP_CIPHER *cipher, const gchar *path,
+			     GError **err)
+{
+	gint iv_len = EVP_CIPHER_iv_length(cipher);
+
+	g_assert(iv_len > 0);
+
+	if (path)
+		return pv_img_read_key(path, (guint)iv_len, err);
+
+	return generate_aes_iv((guint)iv_len, err);
+}
+
+static int hex_str_toull(const gchar *nptr, uint64_t *dst,
+			 GError **err)
+{
+	uint64_t value;
+	gchar *end;
+
+	g_assert(dst);
+
+	if (!g_str_is_ascii(nptr)) {
+		g_set_error(err, PV_ERROR, EINVAL,
+			    _("Invalid value: '%s'. A hexadecimal value is required, for example '0xcfe'"),
+			    nptr);
+		return -1;
+	}
+
+	value = g_ascii_strtoull(nptr, &end, 16);
+	if ((value == G_MAXUINT64 && errno == ERANGE) ||
+	    (end && *end != '\0')) {
+		g_set_error(err, PV_ERROR, EINVAL,
+			    _("Invalid value: '%s'. A hexadecimal value is required, for example '0xcfe'"),
+			    nptr);
+		return -1;
+	}
+	*dst = value;
+	return 0;
+}
+
+static gint pv_img_set_psw_addr(PvImage *img, const gchar *psw_addr_s,
+				GError **err)
+{
+	if (psw_addr_s) {
+		uint64_t psw_addr;
+
+		if (hex_str_toull(psw_addr_s, &psw_addr, err) < 0)
+			return -1;
+
+		img->initial_psw.addr = psw_addr;
+	}
+
+	return 0;
+}
+
+static gint pv_img_set_control_flags(PvImage *img, const gchar *pcf_s,
+				     const gchar *scf_s, GError **err)
+{
+	uint64_t flags;
+
+	if (pcf_s) {
+		if (hex_str_toull(pcf_s, &flags, err) < 0)
+			return -1;
+
+		img->pcf = flags;
+	}
+
+	if (scf_s) {
+		if (hex_str_toull(scf_s, &flags, err) < 0)
+			return -1;
+
+		img->scf = flags;
+	}
+
+	return 0;
+}
+
+/* read in the keys or auto-generate them */
+static gint pv_img_set_keys(PvImage *img, const PvArgs *args, GError **err)
+{
+	g_autoptr(X509_STORE) store = NULL;
+
+	g_assert(img->xts_cipher);
+	g_assert(img->cust_comm_cipher);
+	g_assert(img->gcm_cipher);
+	g_assert(img->nid);
+
+	img->xts_key = pv_img_get_key(img->xts_cipher, args->xts_key_path, err);
+	if (!img->xts_key)
+		return -1;
+
+	img->cust_comm_key = pv_img_get_key(img->cust_comm_cipher,
+					    args->cust_comm_key_path, err);
+	if (!img->cust_comm_key)
+		return -1;
+
+	img->cust_root_key =
+		pv_img_get_key(img->gcm_cipher, args->cust_root_key_path, err);
+	if (!img->cust_root_key)
+		return -1;
+
+	img->gcm_iv = pv_img_get_iv(img->gcm_cipher, args->gcm_iv_path, err);
+	if (!img->gcm_iv)
+		return -1;
+
+	img->cust_pub_priv_key = pv_img_get_cust_pub_priv_key(img->nid, err);
+	if (!img->cust_pub_priv_key)
+		return -1;
+
+	img->host_pub_keys =
+		pv_img_get_host_keys(args->host_keys, store, img->nid, err);
+	if (!img->host_pub_keys)
+		return -1;
+
+	return 0;
+}
+
+static void pv_img_add_host_slot(PvImage *img, PvHdrKeySlot *slot)
+{
+	img->key_slots = g_slist_append(img->key_slots, slot);
+}
+
+static void pv_hdr_key_slot_free(PvHdrKeySlot *slot)
+{
+	if (!slot)
+		return;
+
+	g_free(slot);
+}
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvHdrKeySlot, pv_hdr_key_slot_free)
+
+static PvHdrKeySlot *pv_hdr_key_slot_new(const EVP_CIPHER *gcm_cipher,
+					 const Buffer *cust_root_key,
+					 EVP_PKEY *cust_key, EVP_PKEY *host_key,
+					 GError **err)
+{
+	g_autoptr(PvHdrKeySlot) ret = g_new0(PvHdrKeySlot, 1);
+	g_autofree union ecdh_pub_key *pub = NULL;
+	g_autoptr(Buffer) exchange_key = NULL;
+	g_autoptr(Buffer) digest_key = NULL;
+	g_autoptr(Buffer) iv = NULL;
+	Buffer pub_buf;
+	/* No AAD data is used */
+	Buffer aad = { .data = NULL, .size = 0 };
+	/* Set the output buffers for the encrypted data and the
+	 * generated GCM tag
+	 */
+	Buffer enc = { .data = ret->wrapped_key, .size = sizeof(ret->wrapped_key) };
+	Buffer tag = { .data = ret->tag, .size = sizeof(ret->tag) };
+	struct cipher_parms parms;
+	int64_t c_len = 0;
+
+	g_assert(EVP_CIPHER_iv_length(gcm_cipher) >= 0);
+
+	pub = evp_pkey_to_ecdh_pub_key(host_key, err);
+	if (!pub)
+		return NULL;
+
+	pub_buf.data = pub->data;
+	pub_buf.size = sizeof(*pub);
+	digest_key = sha256_buffer(&pub_buf, err);
+	if (!digest_key)
+		return NULL;
+
+	g_assert(digest_key->size == sizeof(ret->digest_key));
+	/* set `digest_key` field */
+	memcpy(ret->digest_key, digest_key->data, sizeof(ret->digest_key));
+
+	exchange_key = compute_exchange_key(cust_key, host_key, err);
+	if (!exchange_key)
+		return NULL;
+
+	/* initialize cipher parameters */
+	g_assert(exchange_key->size <= INT_MAX);
+	g_assert(exchange_key->size == (guint)EVP_CIPHER_key_length(gcm_cipher));
+
+	/* create zero IV */
+	iv = buffer_alloc((guint)EVP_CIPHER_iv_length(gcm_cipher));
+	parms.iv_or_tweak = iv;
+	parms.key = exchange_key;
+	parms.cipher = gcm_cipher;
+
+	/* Encrypt the customer root key that is used for the encryption
+	 * of the PV header
+	 */
+	c_len = gcm_encrypt(cust_root_key, &aad, &parms, &enc, &tag, err);
+	if (c_len < 0)
+		return NULL;
+
+	g_assert(c_len == (int64_t)cust_root_key->size);
+	return g_steal_pointer(&ret);
+}
+
+static gint pv_img_set_host_slots(PvImage *img, GError **err)
+{
+	for (GSList *iterator = img->host_pub_keys; iterator; iterator = iterator->next) {
+		EVP_PKEY *host_key = iterator->data;
+
+		g_assert(host_key);
+
+		PvHdrKeySlot *slot = pv_hdr_key_slot_new(img->gcm_cipher,
+							 img->cust_root_key,
+							 img->cust_pub_priv_key,
+							 host_key, err);
+		if (!slot)
+			return -1;
+
+		pv_img_add_host_slot(img, slot);
+	}
+
+	return 0;
+}
+
+static gint pv_img_set_comps_offset(PvImage *img, uint64_t offset, GError **err)
+{
+	return pv_img_comps_set_offset(img->comps, offset, err);
+}
+
+PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err)
+{
+	g_autoptr(PvImage) ret = g_new0(PvImage, 1);
+	uint64_t offset;
+
+	g_assert(args->tmp_dir);
+	g_assert(stage3a_path);
+
+	if (args->no_verify)
+		g_warning(_("host-key document verification is disabled. Your workload is not secured."));
+
+	ret->comps = pv_img_comps_new(EVP_sha512(), EVP_sha512(), EVP_sha512(), err);
+	if (!ret->comps)
+		return NULL;
+
+	ret->cust_comm_cipher = EVP_aes_256_gcm();
+	ret->gcm_cipher = EVP_aes_256_gcm();
+	ret->initial_psw.addr = DEFAULT_INITIAL_PSW_ADDR;
+	ret->initial_psw.mask = DEFAULT_INITIAL_PSW_MASK;
+	ret->nid = NID_secp521r1;
+	ret->tmp_dir = g_strdup(args->tmp_dir);
+	ret->xts_cipher = EVP_aes_256_xts();
+
+	/* set initial PSW that will be loaded by the stage3b */
+	if (pv_img_set_psw_addr(ret, args->psw_addr, err) < 0)
+		return NULL;
+
+	/* set the control flags: PCF and SCF */
+	if (pv_img_set_control_flags(ret, args->pcf, args->scf, err) < 0)
+		return NULL;
+
+	/* read in the keys */
+	if (pv_img_set_keys(ret, args, err) < 0)
+		return NULL;
+
+	if (pv_img_set_host_slots(ret, err) < 0)
+		return NULL;
+
+	/* allocate enough memory for the stage3a args and load the
+	 * stage3a template into memory and set the loader_psw
+	 */
+	if (pv_img_load_and_set_stage3a(ret, stage3a_path, err) < 0)
+		return NULL;
+
+	offset = PAGE_ALIGN(STAGE3A_LOAD_ADDRESS + ret->stage3a->size);
+
+	/* shift right all components by the size of stage3a loader */
+	if (pv_img_set_comps_offset(ret, offset, err) < 0)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+void pv_img_free(PvImage *img)
+{
+	if (!img)
+		return;
+
+	g_slist_free_full(img->optional_items,
+			  (GDestroyNotify)pv_opt_item_free);
+	g_slist_free_full(img->key_slots, (GDestroyNotify)pv_hdr_key_slot_free);
+	g_slist_free_full(img->host_pub_keys, (GDestroyNotify)EVP_PKEY_free);
+	EVP_PKEY_free(img->cust_pub_priv_key);
+	buffer_clear(&img->stage3a);
+	pv_img_comps_free(img->comps);
+	g_free(img->tmp_dir);
+	buffer_free(img->xts_key);
+	buffer_free(img->cust_root_key);
+	buffer_free(img->gcm_iv);
+	buffer_free(img->cust_comm_key);
+	g_free(img);
+}
+
+static gint pv_img_prepare_and_add_component(PvImage *img, PvComponent **comp,
+					     GError **err)
+{
+	g_assert(comp);
+	g_assert(*comp);
+
+	/* prepares the component: does the alignment and encryption
+	 * if required
+	 */
+	if (pv_img_prepare_component(img, *comp, err) < 0)
+		return -1;
+
+	/* calculates the memory layout and adds the component to its
+	 * internal list
+	 */
+	if (pv_img_comps_add_component(img->comps, comp, err) < 0)
+		return -1;
+
+	g_assert(!*comp);
+	return 0;
+}
+
+gint pv_img_add_component(PvImage *img, const PvArg *arg, GError **err)
+{
+	g_autoptr(PvComponent) comp = NULL;
+
+	comp = pv_component_new_file(arg->type, arg->path, err);
+	if (!comp)
+		return -1;
+
+	if (pv_img_prepare_and_add_component(img, &comp, err) < 0)
+		return -1;
+
+	g_assert(!comp);
+	return 0;
+}
+
+gint pv_img_calc_pld_ald_tld_nep(const PvImage *img, Buffer **pld, Buffer **ald,
+				 Buffer **tld, uint64_t *nep, GError **err)
+{
+	return pv_img_comps_finalize(img->comps, pld, ald, tld, nep, err);
+}
+
+static gint pv_img_build_stage3b(PvImage *img, Buffer *stage3b, GError **err)
+{
+	g_autofree struct stage3b_args *args = NULL;
+
+	args = pv_img_comps_get_stage3b_args(img->comps, &img->initial_psw);
+	if (!args) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("Cannot generate stage3b arguments"));
+		return -1;
+	}
+
+	build_stage3b(stage3b, args);
+	return 0;
+}
+
+gint pv_img_add_stage3b_comp(PvImage *img, const gchar *path, GError **err)
+{
+	g_autoptr(PvComponent) comp = NULL;
+	g_autoptr(Buffer) stage3b = NULL;
+
+	stage3b = stage3b_getblob(path, err);
+	if (!stage3b)
+		return -1;
+
+	/* set the stage3b data */
+	if (pv_img_build_stage3b(img, stage3b, err) < 0)
+		return -1;
+
+	comp = pv_component_new_buf(PV_COMP_TYPE_STAGE3B, stage3b, err);
+	if (!comp)
+		return -1;
+
+	if (pv_img_prepare_and_add_component(img, &comp, err) < 0)
+		return -1;
+
+	g_assert(!comp);
+	return 0;
+}
+
+static uint32_t pv_img_get_aad_size(const PvImage *img)
+{
+	uint32_t key_size, size = 0;
+
+	g_assert(sizeof(struct pv_hdr_head) <= UINT32_MAX);
+	g_assert(sizeof(struct pv_hdr_key_slot) <= UINT32_MAX);
+
+	g_assert_true(g_uint_checked_add(&size, size,
+					 (uint32_t)sizeof(struct pv_hdr_head)));
+	g_assert_true(g_uint_checked_mul(&key_size,
+					 (uint32_t)sizeof(struct pv_hdr_key_slot),
+					 g_slist_length(img->key_slots)));
+	g_assert_true(g_uint_checked_add(&size, size, key_size));
+	return size;
+}
+
+static uint32_t pv_img_get_opt_items_size(const PvImage *img)
+{
+	uint32_t ret = 0;
+
+	g_assert(img);
+
+	for (GSList *iterator = img->optional_items; iterator;
+	     iterator = iterator->next) {
+		const struct pv_hdr_opt_item *item = iterator->data;
+
+		g_assert(item);
+		g_assert_true(g_uint_checked_add(&ret, ret, pv_opt_item_size(item)));
+	}
+	return ret;
+}
+
+uint32_t pv_img_get_enc_size(const PvImage *img)
+{
+	uint32_t ret = 0;
+
+	g_assert(sizeof(struct pv_hdr_encrypted) <= UINT32_MAX);
+
+	g_assert_true(g_uint_checked_add(
+		&ret, ret, (uint32_t)sizeof(struct pv_hdr_encrypted)));
+	g_assert_true(
+		g_uint_checked_add(&ret, ret, pv_img_get_opt_items_size(img)));
+	return ret;
+}
+
+static uint32_t pv_img_get_tag_size(const PvImage *img G_GNUC_UNUSED)
+{
+	g_assert(sizeof(((struct pv_hdr *)0)->tag) <= UINT32_MAX);
+
+	return (uint32_t)sizeof(((struct pv_hdr *)0)->tag);
+}
+
+uint32_t pv_img_get_pv_hdr_size(const PvImage *img)
+{
+	uint32_t size = 0;
+
+	g_assert_true(
+		g_uint_checked_add(&size, size, pv_img_get_aad_size(img)));
+	g_assert_true(
+		g_uint_checked_add(&size, size, pv_img_get_enc_size(img)));
+	g_assert_true(
+		g_uint_checked_add(&size, size, pv_img_get_tag_size(img)));
+	return size;
+}
+
+static gint get_stage3a_data_size(const PvImage *img, gsize *data_size,
+				  GError **err)
+{
+	gsize ipib_size, hdr_size;
+
+	g_assert(data_size);
+	g_assert(*data_size == 0);
+
+	ipib_size = pv_ipib_get_size(pv_img_comps_length(img->comps));
+	if (ipib_size > PV_V1_IPIB_MAX_SIZE) {
+		g_set_error(err, PV_ERROR, PV_ERROR_IPIB_SIZE,
+			    _("IPIB size is too large: '%zu' > '%zu'"),
+			    ipib_size, PV_V1_IPIB_MAX_SIZE);
+		return -1;
+	}
+
+	hdr_size = pv_img_get_pv_hdr_size(img);
+	if (hdr_size > PV_V1_PV_HDR_MAX_SIZE) {
+		g_set_error(err, PV_ERROR, PV_ERROR_PV_HDR_SIZE,
+			    _("PV header size is too large: '%zu' > '%zu'"),
+			    hdr_size, PV_V1_PV_HDR_MAX_SIZE);
+		return -1;
+	}
+
+	*data_size += PAGE_ALIGN(ipib_size);
+	*data_size += PAGE_ALIGN(hdr_size);
+	return 0;
+}
+
+gint pv_img_load_and_set_stage3a(PvImage *img, const gchar *path, GError **err)
+{
+	g_autoptr(Buffer) stage3a = NULL;
+	gsize bin_size, data_size = 0;
+
+	if (get_stage3a_data_size(img, &data_size, err) < 0)
+		return -1;
+
+	stage3a = stage3a_getblob(path, &bin_size, data_size, err);
+	if (!stage3a)
+		return -1;
+
+	img->stage3a_psw.addr = STAGE3A_ENTRY;
+	img->stage3a_psw.mask = DEFAULT_INITIAL_PSW_MASK;
+
+	/* set addresses and size */
+	img->stage3a = g_steal_pointer(&stage3a);
+	img->stage3a_bin_size = bin_size;
+	return 0;
+}
+
+/* Creates the PV IPIB and sets the stage3a arguments */
+static gint pv_img_build_stage3a(Buffer *stage3a, gsize stage3a_bin_size,
+				 GSList *comps, const Buffer *hdr, GError **err)
+{
+	g_autofree struct ipl_parameter_block *ipib = NULL;
+
+	g_assert(stage3a);
+	g_assert(hdr);
+
+	ipib = pv_ipib_new(comps, hdr, err);
+	if (!ipib)
+		return -1;
+
+	if (build_stage3a(stage3a, stage3a_bin_size, hdr, ipib, err) < 0)
+		return -1;
+
+	g_info("%12s:\t0x%012lx (%12ld / %12ld Bytes)", "stage3a",
+	       STAGE3A_LOAD_ADDRESS, stage3a->size, stage3a->size);
+	return 0;
+}
+
+/* Creates the actual PV header (serialized and AES-GCM encrypted) */
+static Buffer *pv_img_create_pv_hdr(PvImage *img, GError **err)
+{
+	g_autoptr(Buffer) hdr_buf = NULL;
+	g_autoptr(PvHdr) hdr = NULL;
+
+	hdr = pv_hdr_new(img, err);
+	if (!hdr)
+		return NULL;
+
+	hdr_buf = pv_hdr_serialize(hdr, img, PV_ENCRYPT, err);
+	if (!hdr_buf)
+		return NULL;
+
+	return g_steal_pointer(&hdr_buf);
+}
+
+/* No changes to the components are allowed after calling this
+ * function
+ */
+gint pv_img_finalize(PvImage *pv, const gchar *stage3b_path, GError **err)
+{
+	g_autoptr(Buffer) hdr = NULL;
+
+	/* load stage3b template into memory and add it to the list of
+	 * components. This must be done before calling
+	 * `pv_img_load_and_set_stage3a`.
+	 */
+	if (pv_img_add_stage3b_comp(pv, stage3b_path, err) < 0)
+		return -1;
+
+	/* create the PV header */
+	hdr = pv_img_create_pv_hdr(pv, err);
+	if (!hdr)
+		return -1;
+
+	/* generate stage3a. At this point in time the PV header and
+	 * the stage3b must be generated and encrypted
+	 */
+	if (pv_img_build_stage3a(pv->stage3a, pv->stage3a_bin_size,
+				 pv_img_comps_get_comps(pv->comps), hdr, err) < 0)
+		return -1;
+
+	return 0;
+}
+
+static gint convert_psw_to_short_psw(const struct psw_t *psw, uint64_t *dst,
+				    GError **err)
+{
+	g_assert(psw);
+	g_assert(dst);
+
+	uint64_t psw_addr = psw->addr;
+	uint64_t psw_mask = psw->mask;
+
+	/* test if PSW mask can be converted */
+	if (psw_mask & PSW32_ADDR_MASK) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("Failed to convert PSW to short PSW"));
+		return -1;
+	}
+
+	/* test for bit 12 */
+	if (psw_mask & PSW_MASK_BIT_12) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("Failed to convert PSW to short PSW"));
+		return -1;
+	}
+
+	/* test if PSW addr can be converted  */
+	if (psw_addr & ~PSW32_ADDR_MASK) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("Failed to convert PSW to short PSW"));
+		return -1;
+	}
+
+	*dst = psw_mask;
+	/* set bit 12 to 1 */
+	*dst |= PSW_MASK_BIT_12;
+	*dst |= psw_addr;
+	return 0;
+}
+
+static gint write_short_psw(FILE *f, struct psw_t *psw, GError **err)
+{
+	uint64_t short_psw, short_psw_be;
+
+	if (convert_psw_to_short_psw(psw, &short_psw, err) < 0)
+		return -1;
+
+	short_psw_be = GUINT64_TO_BE(short_psw);
+	return file_write(f, &short_psw_be, 1, sizeof(short_psw_be), NULL, err);
+}
+
+gint pv_img_write(PvImage *img, const gchar *path, GError **err)
+{
+	gint ret = -1;
+	FILE *f = file_open(path, "wb", err);
+
+	if (!f)
+		return -1;
+
+	if (write_short_psw(f, &img->stage3a_psw, err) < 0) {
+		g_prefix_error(err, _("Failed to write image '%s': "), path);
+		goto err;
+	}
+
+	if (seek_and_write_buffer(f, img->stage3a, STAGE3A_LOAD_ADDRESS, err) <
+	    0) {
+		g_prefix_error(err, _("Failed to write image '%s': "), path);
+		goto err;
+	}
+
+	/* list is sorted by component type => by address */
+	for (GSList *iterator = pv_img_comps_get_comps(img->comps); iterator;
+	     iterator = iterator->next) {
+		gint rc;
+		const PvComponent *comp = iterator->data;
+
+		rc = pv_component_write(comp, f, err);
+		if (rc < 0) {
+			g_prefix_error(err, _("Failed to write image '%s': "),
+				       path);
+			goto err;
+		}
+	}
+
+	ret = 0;
+err:
+	if (f)
+		fclose(f);
+	return ret;
+}

genprotimg/src/pv/pv_image.h

@@ -0,0 +1,68 @@
+/*
+ * PV image related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_IMAGE_H
+#define PV_IMAGE_H
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <openssl/evp.h>
+#include <stdint.h>
+
+#include "boot/s390.h"
+#include "utils/buffer.h"
+
+#include "pv_args.h"
+#include "pv_comp.h"
+#include "pv_comps.h"
+#include "pv_stage3.h"
+
+typedef struct {
+	gchar *tmp_dir; /* directory used for temporary files */
+	Buffer *stage3a; /* stage3a containing IPIB and PV header */
+	gsize stage3a_bin_size; /* size of stage3a.bin */
+	struct psw_t stage3a_psw; /* (short) PSW that is written to
+				   * location 0 of the created image
+				   */
+	struct psw_t initial_psw; /* PSW loaded by stage3b */
+	EVP_PKEY *cust_pub_priv_key; /* customer private/public key */
+	GSList *host_pub_keys; /* public host keys */
+	gint nid; /* Elliptic Curve used for the key derivation */
+	/* keys and cipher used for the AES-GCM encryption */
+	Buffer *cust_root_key;
+	Buffer *gcm_iv;
+	const EVP_CIPHER *gcm_cipher;
+	/* Information for the IPIB and PV header */
+	uint64_t pcf;
+	uint64_t scf;
+	Buffer *cust_comm_key;
+	const EVP_CIPHER *cust_comm_cipher;
+	Buffer *xts_key;
+	const EVP_CIPHER *xts_cipher;
+	GSList *key_slots;
+	GSList *optional_items;
+	PvImgComps *comps;
+} PvImage;
+
+PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err);
+void pv_img_free(PvImage *img);
+gint pv_img_add_component(PvImage *img, const PvArg *arg, GError **err);
+gint pv_img_finalize(PvImage *img, const gchar *stage3b_path, GError **err);
+gint pv_img_calc_pld_ald_tld_nep(const PvImage *img, Buffer **pld, Buffer **ald,
+				 Buffer **tld, uint64_t *nep, GError **err);
+gint pv_img_load_and_set_stage3a(PvImage *img, const gchar *path, GError **err);
+const PvComponent *pv_img_get_stage3b_comp(const PvImage *img, GError **err);
+gint pv_img_add_stage3b_comp(PvImage *img, const gchar *path, GError **err);
+uint32_t pv_img_get_enc_size(const PvImage *img);
+uint32_t pv_img_get_pv_hdr_size(const PvImage *img);
+gint pv_img_write(PvImage *img, const gchar *path, GError **err);
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvImage, pv_img_free)
+
+#endif

genprotimg/src/pv/pv_ipib.c

@@ -0,0 +1,128 @@
+/*
+ * PV IPIB related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#include "boot/ipl.h"
+#include "boot/s390.h"
+#include "common.h"
+#include "include/pv_hdr_def.h"
+#include "lib/zt_common.h"
+#include "utils/align.h"
+#include "utils/buffer.h"
+
+#include "pv_comp.h"
+#include "pv_error.h"
+#include "pv_ipib.h"
+
+uint64_t pv_ipib_get_size(uint32_t num_comp)
+{
+	gsize ipib_size = sizeof(struct ipl_pl_hdr) +
+			  sizeof(struct ipl_pb0_pv) +
+			  num_comp * sizeof(struct ipl_pb0_pv_comp);
+
+	/* the minimal size is one page */
+	return MAX(ipib_size, PAGE_SIZE);
+}
+
+static gint pv_ipib_init(IplParameterBlock *ipib, GSList *comps,
+			 const Buffer *hdr)
+{
+	g_assert(sizeof(struct ipl_pl_hdr) <= UINT32_MAX);
+	g_assert(sizeof(struct ipl_pb0_pv_comp) <= UINT32_MAX);
+	g_assert(sizeof(struct ipl_pb0_pv) <= UINT32_MAX);
+	g_assert(ipib);
+
+	guint comps_length = g_slist_length(comps);
+	uint32_t ipl_pl_hdr_size = (uint32_t)sizeof(struct ipl_pl_hdr);
+	struct ipl_pb0_pv *pv = &ipib->pv;
+	uint32_t ipib_comps_size;
+	uint32_t blk0_len;
+	uint32_t ipib_size;
+	gsize i;
+
+	g_assert_true(
+		g_uint_checked_mul(&ipib_comps_size, comps_length,
+				   (uint32_t)sizeof(struct ipl_pb0_pv_comp)));
+	g_assert_true(g_uint_checked_add(&blk0_len, (uint32_t)sizeof(*pv),
+					 ipib_comps_size));
+	g_assert(ipl_pl_hdr_size + blk0_len <= PAGE_SIZE);
+
+	ipib_size = MAX(ipl_pl_hdr_size + blk0_len, (uint32_t)PAGE_SIZE);
+	g_assert(pv_ipib_get_size(comps_length) == ipib_size);
+
+	pv->pbt = IPL_TYPE_PV;
+	pv->len = GUINT32_TO_BE(blk0_len);
+	pv->num_comp = GUINT32_TO_BE(comps_length);
+	/* both values will be overwritten during the IPL process by
+	 * the stage3a loader
+	 */
+	pv->pv_hdr_addr = GUINT64_TO_BE(0x0);
+	pv->pv_hdr_size = GUINT64_TO_BE(hdr->size);
+
+	ipib->hdr.len = GUINT32_TO_BE(ipib_size);
+	ipib->hdr.version = IPL_PARM_BLOCK_VERSION;
+
+	i = 0;
+	for (GSList *iterator = comps; iterator; iterator = iterator->next, i++) {
+		const PvComponent *comp = iterator->data;
+		uint64_t comp_addr, comp_size;
+
+		g_assert(comp);
+
+		comp_addr = pv_component_get_src_addr(comp);
+		comp_size = pv_component_size(comp);
+
+		g_assert(IS_PAGE_ALIGNED(comp_size));
+
+		pv->components[i].addr = GUINT64_TO_BE(comp_addr);
+		pv->components[i].len = GUINT64_TO_BE(comp_size);
+		pv->components[i].tweak_pref =
+			GUINT64_TO_BE(pv_component_get_tweak_prefix(comp));
+		if (i > 0) {
+			/* tweak prefixes of the components must grow
+			 * strictly monotonous
+			 */
+			g_assert(GUINT64_FROM_BE(pv->components[i].tweak_pref) >
+				 GUINT64_FROM_BE(pv->components[i - 1].tweak_pref));
+		}
+	}
+
+	return 0;
+}
+
+IplParameterBlock *pv_ipib_new(GSList *comps, const Buffer *hdr, GError **err)
+{
+	uint64_t ipib_size = pv_ipib_get_size(g_slist_length(comps));
+	g_autoptr(IplParameterBlock) ret = NULL;
+
+	if (ipib_size > PV_V1_IPIB_MAX_SIZE) {
+		g_set_error(err, PV_ERROR, PV_ERROR_IPIB_SIZE,
+			    _("IPIB size is too large: %lu < %lu"), ipib_size,
+			    PAGE_SIZE);
+		return NULL;
+	}
+
+	ret = g_malloc0(ipib_size);
+	if (pv_ipib_init(ret, comps, hdr) < 0)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+void pv_ipib_free(IplParameterBlock *ipib)
+{
+	if (!ipib)
+		return;
+
+	g_free(ipib);
+}

genprotimg/src/pv/pv_ipib.h

@@ -0,0 +1,27 @@
+/*
+ * PV IPIB related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_IPIB_H
+#define PV_IPIB_H
+
+#include <glib.h>
+#include <stdint.h>
+
+#include "boot/ipl.h"
+#include "utils/buffer.h"
+
+typedef struct ipl_parameter_block IplParameterBlock;
+
+uint64_t pv_ipib_get_size(uint32_t num_comp);
+IplParameterBlock *pv_ipib_new(GSList *comps, const Buffer *hdr, GError **err);
+void pv_ipib_free(IplParameterBlock *ipib);
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(IplParameterBlock, pv_ipib_free)
+
+#endif

genprotimg/src/pv/pv_opt_item.c

@@ -0,0 +1,26 @@
+/*
+ * PV optional item related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+
+#include "pv_opt_item.h"
+
+uint32_t pv_opt_item_size(const struct pv_hdr_opt_item *item G_GNUC_UNUSED)
+{
+	/* not implemented yet */
+	g_assert_not_reached();
+}
+
+void pv_opt_item_free(struct pv_hdr_opt_item *item)
+{
+	if (!item)
+		return;
+
+	g_free(item);
+}

genprotimg/src/pv/pv_opt_item.h

@@ -0,0 +1,20 @@
+/*
+ * PV optional item related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_OPT_ITEM_H
+#define PV_OPT_ITEM_H
+
+#include <stdint.h>
+
+#include "include/pv_hdr_def.h"
+
+uint32_t pv_opt_item_size(const struct pv_hdr_opt_item *item);
+void pv_opt_item_free(struct pv_hdr_opt_item *item);
+
+#endif

genprotimg/src/pv/pv_stage3.c

@@ -0,0 +1,164 @@
+/*
+ * PV stage3 loader related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "boot/ipl.h"
+#include "boot/stage3a.h"
+#include "boot/stage3b.h"
+#include "common.h"
+#include "utils/align.h"
+
+#include "pv_error.h"
+#include "pv_stage3.h"
+
+#define STAGE3A_ARGS(data_ptr, loader_size)                         \
+	((struct stage3a_args *)((uint64_t)data_ptr + loader_size - \
+				 sizeof(struct stage3a_args)))
+
+static Buffer *loader_getblob(const gchar *filename, gsize *loader_size,
+			      gsize args_size, gsize data_size,
+			      gboolean data_aligned, GError **err)
+{
+	g_autoptr(GMappedFile) mapped_file = NULL;
+	g_autoptr(Buffer) ret = NULL;
+	gsize size, tmp_loader_size;
+	gchar *loader_data;
+
+	g_assert(loader_size);
+
+	mapped_file = g_mapped_file_new(filename, FALSE, err);
+	if (!mapped_file)
+		return NULL;
+
+	loader_data = g_mapped_file_get_contents(mapped_file);
+	if (!loader_data) {
+		g_set_error(err, G_FILE_ERROR, G_FILE_ERROR_BADF,
+			    _("File '%s' is empty"), filename);
+		return NULL;
+	}
+	tmp_loader_size = g_mapped_file_get_length(mapped_file);
+
+	if (tmp_loader_size < args_size) {
+		g_set_error(err, G_FILE_ERROR, G_FILE_ERROR_BADF,
+			    _("File size less than expected: %lu < %ln"),
+			    tmp_loader_size, loader_size);
+		return NULL;
+	}
+
+	/* For example, the PV header and IPIB data must be page
+	 * aligned.
+	 */
+	size = (data_aligned ? PAGE_ALIGN(tmp_loader_size) : tmp_loader_size) +
+	       data_size;
+
+	ret = buffer_alloc(size);
+
+	/* copy the loader "template" */
+	memcpy(ret->data, loader_data, tmp_loader_size);
+	/* reset our dummy data (offsets and length) to zeros */
+	memset((uint8_t *)ret->data + tmp_loader_size - args_size, 0,
+	       args_size);
+	*loader_size = tmp_loader_size;
+	return g_steal_pointer(&ret);
+}
+
+Buffer *stage3a_getblob(const gchar *filename, gsize *loader_size,
+			gsize data_size, GError **err)
+{
+	return loader_getblob(filename, loader_size,
+			      sizeof(struct stage3a_args), data_size, TRUE,
+			      err);
+}
+
+/* For the memory layout see stage3a.lds */
+/* Set the right offsets and sizes in the stage3a template + add
+ * the IPIB block with the PV header
+ */
+static gint stage3a_set_data(Buffer *loader, gsize loader_size,
+			     const Buffer *hdr, struct ipl_parameter_block *ipib,
+			     GError **err)
+{
+	uint32_t ipib_size = GUINT32_FROM_BE(ipib->hdr.len);
+	gsize args_size = sizeof(struct stage3a_args);
+	uint32_t hdr_size = (uint32_t)hdr->size;
+	uint64_t args_addr, next_data_addr;
+
+	if (hdr->size > UINT32_MAX) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("Invalid header size: %zu"), hdr->size);
+		return -1;
+	}
+
+	/* we assume here that the loader ``stage3a`` is loaded page
+	 * aligned in the guest
+	 */
+	args_addr = (uint64_t)loader->data + loader_size - args_size;
+
+	/* therefore `next_data_addr` is also page aligned */
+	next_data_addr = (uint64_t)loader->data + PAGE_ALIGN(loader_size);
+
+	/* copy IPIB data */
+	memcpy((void *)next_data_addr, ipib, ipib_size);
+
+	/* set IPIB offset in relation to the stage3a arguments */
+	STAGE3A_ARGS(loader->data, loader_size)->ipib_offs =
+		GUINT64_TO_BE(next_data_addr - args_addr);
+
+	next_data_addr = next_data_addr + PAGE_ALIGN(ipib_size);
+	/* copy PV header */
+	memcpy((void *)next_data_addr, hdr->data, hdr_size);
+	/* set PV header size and offset in relation to the stage3a
+	 * arguments
+	 */
+	STAGE3A_ARGS(loader->data, loader_size)->hdr_offs =
+		GUINT64_TO_BE(next_data_addr - args_addr);
+	STAGE3A_ARGS(loader->data, loader_size)->hdr_size = GUINT64_TO_BE(hdr_size);
+
+	return 0;
+}
+
+gint build_stage3a(Buffer *loader, gsize loader_size, const Buffer *hdr,
+		   struct ipl_parameter_block *ipib, GError **err)
+{
+	return stage3a_set_data(loader, loader_size, hdr, ipib, err);
+}
+
+Buffer *stage3b_getblob(const gchar *filename, GError **err)
+{
+	g_autoptr(Buffer) ret = NULL;
+	gsize rb_size;
+
+	ret = loader_getblob(filename, &rb_size, sizeof(struct stage3b_args), 0,
+			     FALSE, err);
+	if (!ret)
+		return NULL;
+
+	g_assert(ret->size == rb_size);
+	return g_steal_pointer(&ret);
+}
+
+void build_stage3b(Buffer *stage3b, const struct stage3b_args *args)
+{
+	g_assert(stage3b->size > sizeof(*args));
+
+	/* at the end of the stage3b there are the stage3b args
+	 * positioned
+	 */
+	memcpy((uint8_t *)stage3b->data + stage3b->size - sizeof(*args), args,
+	       sizeof(*args));
+}
+
+void memblob_init(struct memblob *arg, uint64_t src, uint64_t size)
+{
+	arg->src = GUINT64_TO_BE(src);
+	arg->size = GUINT64_TO_BE(size);
+}

genprotimg/src/pv/pv_stage3.h

@@ -0,0 +1,30 @@
+/*
+ * PV stage3 loader related definitions and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_STAGE3_H
+#define PV_STAGE3_H
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <stdint.h>
+
+#include "boot/ipl.h"
+#include "boot/s390.h"
+#include "boot/stage3b.h"
+#include "utils/buffer.h"
+
+Buffer *stage3a_getblob(const gchar *filename, gsize *loader_size,
+			gsize data_size, GError **err);
+gint build_stage3a(Buffer *dc, gsize dc_size, const Buffer *hdr,
+		   struct ipl_parameter_block *ipib, GError **err);
+Buffer *stage3b_getblob(const gchar *filename, GError **err);
+void build_stage3b(Buffer *stage3b, const struct stage3b_args *args);
+void memblob_init(struct memblob *arg, uint64_t src, uint64_t size);
+
+#endif

genprotimg/src/utils/align.h

@@ -0,0 +1,24 @@
+/*
+ * Alignment utils
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_UTILS_ALIGN_H
+#define PV_UTILS_ALIGN_H
+
+#include "boot/s390.h"
+#include "lib/zt_common.h"
+
+#define IS_ALIGNED(addr, size) (!(addr & (size - 1)))
+
+/* align addr to the next page boundary */
+#define PAGE_ALIGN(addr) ALIGN((unsigned long)addr, PAGE_SIZE)
+
+/* test whether an address is aligned to PAGE_SIZE or not */
+#define IS_PAGE_ALIGNED(addr) IS_ALIGNED((unsigned long)(addr), PAGE_SIZE)
+
+#endif

genprotimg/src/utils/buffer.c

@@ -0,0 +1,69 @@
+/*
+ * Buffer functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <errno.h>
+#include <glib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "align.h"
+#include "buffer.h"
+#include "common.h"
+#include "file_utils.h"
+
+Buffer *buffer_alloc(gsize size)
+{
+	Buffer *ret = g_new0(Buffer, 1);
+
+	ret->data = g_malloc0(size);
+	ret->size = size;
+	return ret;
+}
+
+Buffer *buffer_dup(const Buffer *buf, gboolean page_aligned)
+{
+	Buffer *ret;
+	gsize size;
+
+	if (!buf)
+		return NULL;
+
+	size = buf->size;
+	if (page_aligned)
+		size = PAGE_ALIGN(size);
+
+	ret = buffer_alloc(size);
+
+	/* content will be 0-right-padded */
+	memcpy(ret->data, buf->data, buf->size);
+	return ret;
+}
+
+gint buffer_write(const Buffer *buf, FILE *file, GError **err)
+{
+	return file_write(file, buf->data, buf->size, 1, NULL, err);
+}
+
+void buffer_free(Buffer *buf)
+{
+	if (!buf)
+		return;
+
+	g_free(buf->data);
+	g_free(buf);
+}
+
+void buffer_clear(Buffer **buf)
+{
+	if (!buf || !*buf)
+		return;
+
+	buffer_free(*buf);
+	*buf = NULL;
+}

genprotimg/src/utils/buffer.h

@@ -0,0 +1,31 @@
+/*
+ * Buffer definition and functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_UTILS_BUFFER_H
+#define PV_UTILS_BUFFER_H
+
+#include <glib.h>
+#include <stdio.h>
+
+#include "common.h"
+
+typedef struct Buffer {
+	void *data;
+	gsize size; /* in bytes */
+} Buffer;
+
+Buffer *buffer_alloc(gsize size);
+void buffer_free(Buffer *buf);
+void buffer_clear(Buffer **buf);
+gint buffer_write(const Buffer *buf, FILE *file, GError **err);
+Buffer *buffer_dup(const Buffer *buf, gboolean page_aligned);
+
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(Buffer, buffer_free)
+
+#endif

genprotimg/src/utils/crypto.c

@@ -0,0 +1,798 @@
+/*
+ * General cryptography helper functions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <glib.h>
+#include <glib/gtypes.h>
+#include <limits.h>
+#include <openssl/aes.h>
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/rand.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "boot/s390.h"
+#include "common.h"
+#include "include/pv_crypto_def.h"
+#include "pv/pv_error.h"
+
+#include "buffer.h"
+#include "crypto.h"
+
+EVP_MD_CTX *digest_ctx_new(const EVP_MD *md, GError **err)
+{
+	g_autoptr(EVP_MD_CTX) ctx = EVP_MD_CTX_new();
+
+	if (!ctx)
+		g_abort();
+
+	if (EVP_DigestInit_ex(ctx, md, NULL) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_DigestInit_ex failed"));
+		return NULL;
+	}
+
+	return g_steal_pointer(&ctx);
+}
+
+Buffer *digest_ctx_finalize(EVP_MD_CTX *ctx, GError **err)
+{
+	gint md_size = EVP_MD_size(EVP_MD_CTX_md(ctx));
+	g_autoptr(Buffer) ret = NULL;
+	guint digest_size;
+
+	g_assert(md_size > 0);
+
+	ret = buffer_alloc((guint)md_size);
+	if (EVP_DigestFinal_ex(ctx, ret->data, &digest_size) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_DigestFinal_ex failed"));
+		return NULL;
+	}
+
+	g_assert(digest_size == (guint)md_size);
+	g_assert(digest_size == ret->size);
+	return g_steal_pointer(&ret);
+}
+
+/* Returns the digest of @buf using the hash algorithm @md */
+static Buffer *digest_buffer(const EVP_MD *md, const Buffer *buf, GError **err)
+{
+	g_autoptr(EVP_MD_CTX) md_ctx = NULL;
+	g_autoptr(Buffer) ret = NULL;
+	g_assert(buf);
+
+	md_ctx = digest_ctx_new(md, err);
+	if (!md_ctx)
+		return NULL;
+
+	if (EVP_DigestUpdate(md_ctx, buf->data, buf->size) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_DigestUpdate failed"));
+		return NULL;
+	}
+
+	ret = digest_ctx_finalize(md_ctx, err);
+	if (!ret)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+/* Returns the SHA256 digest of @buf */
+Buffer *sha256_buffer(const Buffer *buf, GError **err)
+{
+	g_autoptr(Buffer) ret = NULL;
+
+	ret = digest_buffer(EVP_sha256(), buf, err);
+	if (!ret)
+		return NULL;
+
+	g_assert(ret->size == SHA256_DIGEST_LENGTH);
+	return g_steal_pointer(&ret);
+}
+
+/* Convert a EVP_PKEY to the key format used in the PV header */
+union ecdh_pub_key *evp_pkey_to_ecdh_pub_key(EVP_PKEY *key, GError **err)
+{
+	g_autofree union ecdh_pub_key *ret = g_new0(union ecdh_pub_key, 1);
+	g_autoptr(BIGNUM) pub_x_big = NULL;
+	g_autoptr(BIGNUM) pub_y_big = NULL;
+	g_autoptr(EC_KEY) ec_key = NULL;
+	const EC_POINT *pub_key;
+	const EC_GROUP *grp;
+
+	ec_key = EVP_PKEY_get1_EC_KEY(key);
+	if (!ec_key) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Key has the wrong type"));
+		return NULL;
+	}
+
+	pub_key = EC_KEY_get0_public_key(ec_key);
+	if (!pub_key) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Failed to get public key"));
+		return NULL;
+	}
+
+	grp = EC_KEY_get0_group(ec_key);
+	if (!grp) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Failed to get EC group"));
+		return NULL;
+	}
+
+	pub_x_big = BN_new();
+	if (!pub_x_big)
+		g_abort();
+
+	pub_y_big = BN_new();
+	if (!pub_y_big)
+		g_abort();
+
+	if (EC_POINT_get_affine_coordinates_GFp(grp, pub_key, pub_x_big,
+						pub_y_big, NULL) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Cannot convert key to internal format"));
+		return NULL;
+	}
+
+	if (BN_bn2binpad(pub_x_big, ret->x, sizeof(ret->x)) < 0) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Cannot convert key to internal format"));
+		return NULL;
+	}
+
+	if (BN_bn2binpad(pub_y_big, ret->y, sizeof(ret->y)) < 0) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Cannot convert key to internal format"));
+		return NULL;
+	}
+
+	return g_steal_pointer(&ret);
+}
+
+static Buffer *derive_key(EVP_PKEY *cust, EVP_PKEY *host, GError **err)
+{
+	g_autoptr(EVP_PKEY_CTX) ctx = NULL;
+	g_autoptr(Buffer) ret = NULL;
+	gsize key_size;
+
+	ctx = EVP_PKEY_CTX_new(cust, NULL);
+	if (!ctx)
+		g_abort();
+
+	if (EVP_PKEY_derive_init(ctx) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Key derivation failed"));
+		return NULL;
+	}
+
+	if (EVP_PKEY_derive_set_peer(ctx, host) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Key derivation failed"));
+		return NULL;
+	}
+
+	/* Determine buffer length */
+	if (EVP_PKEY_derive(ctx, NULL, &key_size) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_DERIVE,
+			    _("Key derivation failed"));
+		return NULL;
+	}
+
+	ret = buffer_alloc(key_size);
+	if (EVP_PKEY_derive(ctx, ret->data, &key_size) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_DERIVE,
+			    _("Key derivation failed"));
+		return NULL;
+	}
+
+	g_assert(ret->size == key_size);
+	return g_steal_pointer(&ret);
+}
+
+Buffer *compute_exchange_key(EVP_PKEY *cust, EVP_PKEY *host, GError **err)
+{
+	g_autoptr(Buffer) raw = buffer_alloc(70);
+	g_autoptr(Buffer) ret = NULL;
+	g_autoptr(Buffer) key = NULL;
+	guchar *data;
+
+	key = derive_key(cust, host, err);
+	if (!key)
+		return NULL;
+
+	g_assert(key->size == 66);
+	g_assert(key->size < raw->size);
+
+	/* ANSI X.9.63-2011: 66 bytes x with leading 7 bits and
+	 * concatenate 32 bit int '1'
+	 */
+	memcpy(raw->data, key->data, key->size);
+	data = raw->data;
+	data[66] = 0x00;
+	data[67] = 0x00;
+	data[68] = 0x00;
+	data[69] = 0x01;
+
+	ret = sha256_buffer(raw, err);
+	if (!ret)
+		return NULL;
+
+	return g_steal_pointer(&ret);
+}
+
+gint generate_tweak(union tweak *tweak, uint16_t i, GError **err)
+{
+	tweak->cmp_idx.idx = GUINT16_TO_BE(i);
+	if (RAND_bytes(tweak->cmp_idx.rand, sizeof(tweak->cmp_idx.rand)) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_RANDOMIZATION,
+			    _("Generating a tweak failed because the required amount of random data is not available"));
+		return -1;
+	}
+
+	return 0;
+}
+
+static Buffer *generate_rand_data(guint size, const gchar *err_msg,
+				  GError **err)
+{
+	g_autoptr(Buffer) buf = buffer_alloc(size);
+
+	g_assert(size <= INT_MAX);
+
+	if (RAND_bytes(buf->data, (int)size) != 1) {
+		g_set_error_literal(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_RANDOMIZATION,
+				    err_msg);
+		return NULL;
+	}
+
+	return g_steal_pointer(&buf);
+}
+
+Buffer *generate_aes_iv(guint size, GError **err)
+{
+	return generate_rand_data(size,
+				  _("Generating a IV failed because the required amount of random data is not available"),
+				  err);
+}
+
+Buffer *generate_aes_key(guint size, GError **err)
+{
+	return generate_rand_data(size,
+				  _("Generating a key failed because the required amount of random data is not available"),
+				  err);
+}
+
+EVP_PKEY *generate_ec_key(gint nid, GError **err)
+{
+	g_autoptr(EVP_PKEY_CTX) ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
+	g_autoptr(EVP_PKEY) ret = NULL;
+
+	if (!ctx)
+		g_abort();
+
+	if (EVP_PKEY_keygen_init(ctx) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
+			    _("EC key could not be auto-generated"));
+		return NULL;
+	}
+
+	if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
+			    _("EC key could not be auto-generated"));
+		return NULL;
+	}
+
+	if (EVP_PKEY_keygen(ctx, &ret) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_KEYGENERATION,
+			    _("EC key could not be auto-generated"));
+		return NULL;
+	}
+
+	return g_steal_pointer(&ret);
+}
+
+static gboolean certificate_uses_correct_curve(EVP_PKEY *key, gint nid,
+					       GError **err)
+{
+	g_autoptr(EC_KEY) ec = NULL;
+	gint rc;
+
+	g_assert(key);
+
+	if (EVP_PKEY_id(key) != EVP_PKEY_EC) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INVALID_PARM,
+			    _("No EC key found"));
+		return FALSE;
+	}
+
+	ec = EVP_PKEY_get1_EC_KEY(key);
+	if (!ec) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INVALID_PARM,
+			    _("No EC key found"));
+		return FALSE;
+	}
+
+	if (EC_KEY_check_key(ec) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INVALID_PARM,
+			    _("Invalid EC key"));
+		return FALSE;
+	}
+
+	rc = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
+	if (rc != nid) {
+		/* maybe the NID is unset */
+		if (rc == 0) {
+			g_autoptr(EC_GROUP) grp = EC_GROUP_new_by_curve_name(nid);
+			const EC_POINT *pub = EC_KEY_get0_public_key(ec);
+			g_autoptr(BN_CTX) ctx = BN_CTX_new();
+
+			if (EC_POINT_is_on_curve(grp, pub, ctx) != 1) {
+				g_set_error_literal(err, PV_CRYPTO_ERROR,
+						    PV_CRYPTO_ERROR_INVALID_PARM,
+						    _("Invalid EC curve"));
+				return FALSE;
+			}
+		} else {
+			/* NID was set but doesn't match with the expected NID
+			 */
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INVALID_PARM,
+				    _("Wrong NID used: '%d'"),
+				    EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)));
+			return FALSE;
+		}
+	}
+
+	return TRUE;
+}
+
+static gboolean verify_certificate(X509_STORE *store, X509 *cert, GError **err)
+{
+	g_autoptr(X509_STORE_CTX) csc = X509_STORE_CTX_new();
+	if (!csc)
+		g_abort();
+
+	if (X509_STORE_CTX_init(csc, store, cert, NULL) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INIT,
+			    _("Failed to initialize X.509 store"));
+		return FALSE;
+	}
+
+	if (X509_verify_cert(csc) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_VERIFICATION,
+			    _("Failed to verify host-key document"));
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static X509 *load_certificate(const gchar *path, GError **err)
+{
+	g_autoptr(X509) ret = NULL;
+	g_autoptr(BIO) bio = BIO_new_file(path, "rb");
+
+	if (!bio) {
+		g_set_error(err, PV_CRYPTO_ERROR,
+			    PV_CRYPTO_ERROR_READ_CERTIFICATE,
+			    _("Failed to read host-key document: '%s'"), path);
+		return NULL;
+	}
+
+	ret = PEM_read_bio_X509(bio, NULL, 0, NULL);
+	if (!ret) {
+		g_set_error(err, PV_CRYPTO_ERROR,
+			    PV_CRYPTO_ERROR_READ_CERTIFICATE,
+			    _("Failed to load host-key document: '%s'"), path);
+		return NULL;
+	}
+
+	return g_steal_pointer(&ret);
+}
+
+EVP_PKEY *read_ec_pubkey_cert(X509_STORE *store, gint nid, const gchar *path,
+			      GError **err)
+{
+	g_autoptr(EVP_PKEY) ret = NULL;
+	g_autoptr(X509) cert = NULL;
+
+	cert = load_certificate(path, err);
+	if (!cert)
+		return NULL;
+
+	if (store && !verify_certificate(store, cert, err)) {
+		g_prefix_error(err,
+			       _("Failed to load host-key document: '%s': "),
+			       path);
+		return NULL;
+	}
+
+	ret = X509_get_pubkey(cert);
+	if (!ret) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INVALID_PARM,
+			    _("Failed to get public key from host-key document: '%s'"),
+			    path);
+		return NULL;
+	}
+
+	if (!certificate_uses_correct_curve(ret, nid, err)) {
+		g_prefix_error(err,
+			       _("Failed to load host-key document: '%s': "),
+			       path);
+		return NULL;
+	}
+
+	return g_steal_pointer(&ret);
+}
+
+static gint __encrypt_decrypt_bio(const struct cipher_parms *parms, BIO *b_in,
+				  BIO *b_out, gsize *size_in, gsize *size_out,
+				  gboolean encrypt, GError **err)
+{
+	gint num_bytes_read, num_bytes_written;
+	g_autoptr(EVP_CIPHER_CTX) ctx = NULL;
+	g_autoptr(BIGNUM) tweak_num = NULL;
+	const EVP_CIPHER *cipher = parms->cipher;
+	gint cipher_block_size = EVP_CIPHER_block_size(cipher);
+	guchar in_buf[PAGE_SIZE],
+		out_buf[PAGE_SIZE + (guint)cipher_block_size];
+	const Buffer *key = parms->key;
+	const Buffer *tweak = parms->iv_or_tweak;
+	g_autofree guchar *tmp_tweak = NULL;
+	gint out_len, tweak_size;
+	gsize tmp_size_in = 0, tmp_size_out = 0;
+
+	g_assert(cipher_block_size > 0);
+	g_assert(key);
+	g_assert(tweak);
+	g_assert(tweak->size <= INT_MAX);
+
+	/* copy the value for leaving the original value untouched */
+	tmp_tweak = g_malloc0(tweak->size);
+	memcpy(tmp_tweak, tweak->data, tweak->size);
+	tweak_size = (int)tweak->size;
+	tweak_num = BN_bin2bn(tmp_tweak, tweak_size, NULL);
+	if (!tweak_num) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("BN_bin2bn failed"));
+		return -1;
+	}
+
+	ctx = EVP_CIPHER_CTX_new();
+	if (!ctx)
+		g_abort();
+
+	/* don't set the key or tweak right away as we want to check
+	 * lengths before
+	 */
+	if (EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, encrypt) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CipherInit_ex failed"));
+		return -1;
+	}
+
+	/* Now we can set the key and tweak */
+	if (EVP_CipherInit_ex(ctx, NULL, NULL, key->data, tmp_tweak, encrypt) !=
+	    1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CipherInit_ex failed"));
+		return -1;
+	}
+
+	do {
+		memset(in_buf, 0, sizeof(in_buf));
+		/* Read in data in 4096 bytes blocks. Update the ciphering
+		 * with each read.
+		 */
+		num_bytes_read = BIO_read(b_in, in_buf, (int)PAGE_SIZE);
+		if (num_bytes_read < 0) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("Failed to read"));
+			return -1;
+		}
+		tmp_size_in += (guint)num_bytes_read;
+
+		/* in case we reached the end and it's not the special
+		 * case of an empty component we can break here
+		 */
+		if (num_bytes_read == 0 && tmp_size_in != 0)
+			break;
+
+		if (EVP_CipherUpdate(ctx, out_buf, &out_len, in_buf,
+				     sizeof(in_buf)) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("EVP_CipherUpdate failed"));
+			return -1;
+		}
+		g_assert(out_len >= 0);
+
+		num_bytes_written = BIO_write(b_out, out_buf, out_len);
+		if (num_bytes_written < 0) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("Failed to write"));
+			return -1;
+		}
+		g_assert(num_bytes_written == out_len);
+
+		tmp_size_out += (guint)num_bytes_written;
+
+		/* Set new tweak value. Please keep in mind that the
+		 * tweaks are stored in big-endian form. Therefore we
+		 * must use the correct OpenSSL functions
+		 */
+		if (BN_add_word(tweak_num, PAGE_SIZE) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("BN_add_word failed"));
+		}
+		g_assert(BN_num_bytes(tweak_num) > 0);
+		g_assert(BN_num_bytes(tweak_num) <= tweak_size);
+
+		if (BN_bn2binpad(tweak_num, tmp_tweak, tweak_size) < 0) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("BN_bn2binpad failed"));
+		};
+
+		/* set new tweak */
+		if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, tmp_tweak,
+				      encrypt) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("EVP_CipherInit_ex failed"));
+			return -1;
+		}
+	} while (num_bytes_read == PAGE_SIZE);
+
+	/* Now cipher the final block and write it out to file */
+	if (EVP_CipherFinal_ex(ctx, out_buf, &out_len) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CipherFinal_ex failed"));
+		return -1;
+	}
+	g_assert(out_len >= 0);
+
+	num_bytes_written = BIO_write(b_out, out_buf, out_len);
+	if (num_bytes_written < 0) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Failed to write"));
+		return -1;
+	}
+	g_assert(out_len == num_bytes_written);
+	tmp_size_out += (guint)out_len;
+
+	if (BIO_flush(b_out) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Failed to flush"));
+		return -1;
+	}
+
+	*size_in = tmp_size_in;
+	*size_out = tmp_size_out;
+	return 0;
+}
+
+static Buffer *__encrypt_decrypt_buffer(const struct cipher_parms *parms,
+					const Buffer *in, gboolean encrypt,
+					GError **err)
+{
+	g_autoptr(Buffer) ret = NULL;
+	g_autoptr(BIO) b_out = NULL;
+	g_autoptr(BIO) b_in = NULL;
+	gsize in_size, out_size;
+	gchar *data = NULL;
+	long data_size;
+
+	g_assert(in->size <= INT_MAX);
+
+	b_in = BIO_new_mem_buf(in->data, (int)in->size);
+	if (!b_in)
+		g_abort();
+
+	b_out = BIO_new(BIO_s_mem());
+	if (!b_out)
+		g_abort();
+
+	if (__encrypt_decrypt_bio(parms, b_in, b_out, &in_size, &out_size,
+				  encrypt, err) < 0)
+		return NULL;
+
+	data_size = BIO_get_mem_data(b_out, &data);
+	if (data_size < 0) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("Could not read buffer"));
+		return NULL;
+	}
+
+	ret = buffer_alloc((unsigned long)data_size);
+	memcpy(ret->data, data, ret->size);
+	return g_steal_pointer(&ret);
+}
+
+Buffer *encrypt_buf(const struct cipher_parms *parms, const Buffer *in,
+		    GError **err)
+{
+	return __encrypt_decrypt_buffer(parms, in, TRUE, err);
+}
+
+Buffer *decrypt_buf(const struct cipher_parms *parms, const Buffer *in,
+		    GError **err)
+{
+	return __encrypt_decrypt_buffer(parms, in, FALSE, err);
+}
+
+static gint __encrypt_decrypt_file(const struct cipher_parms *parms,
+				   const gchar *path_in, const gchar *path_out,
+				   gsize *size_in, gsize *size_out, gboolean encrypt,
+				   GError **err)
+{
+	g_autoptr(BIO) b_out = NULL;
+	g_autoptr(BIO) b_in = NULL;
+
+	b_in = BIO_new_file(path_in, "rb");
+	if (!b_in) {
+		g_set_error(err, PV_CRYPTO_ERROR,
+			    PV_CRYPTO_ERROR_READ_CERTIFICATE,
+			    _("Failed to read file '%s'"), path_in);
+		return -1;
+	}
+
+	b_out = BIO_new_file(path_out, "wb");
+	if (!b_out) {
+		g_set_error(err, PV_CRYPTO_ERROR,
+			    PV_CRYPTO_ERROR_READ_CERTIFICATE,
+			    _("Failed to write file '%s'"), path_out);
+		return -1;
+	}
+
+	if (__encrypt_decrypt_bio(parms, b_in, b_out, size_in, size_out,
+				  encrypt, err) < 0)
+		return -1;
+
+	return 0;
+}
+
+gint encrypt_file(const struct cipher_parms *parms, const gchar *path_in,
+		  const gchar *path_out, gsize *in_size, gsize *out_size,
+		  GError **err)
+{
+	return __encrypt_decrypt_file(parms, path_in, path_out, in_size,
+				      out_size, TRUE, err);
+}
+
+G_GNUC_UNUSED static gint decrypt_file(const struct cipher_parms *parms,
+				       const gchar *path_in, const gchar *path_out,
+				       gsize *in_size, gsize *out_size,
+				       GError **err)
+{
+	return __encrypt_decrypt_file(parms, path_in, path_out, in_size,
+				      out_size, FALSE, err);
+}
+
+/* GCM mode uses (zero-)padding */
+static int64_t gcm_encrypt_decrypt(const Buffer *in, const Buffer *aad,
+				   const struct cipher_parms *parms,
+				   Buffer *out, Buffer *tag,
+				   enum PvCryptoMode mode, GError **err)
+{
+	g_autoptr(EVP_CIPHER_CTX) ctx = NULL;
+	const EVP_CIPHER *cipher = parms->cipher;
+	const Buffer *iv = parms->iv_or_tweak;
+	gboolean encrypt = mode == PV_ENCRYPT;
+	const Buffer *key = parms->key;
+	int64_t ret = -1;
+	gint len = -1;
+
+	g_assert(cipher);
+	g_assert(key);
+	g_assert(iv);
+	/* Checks for later casts */
+	g_assert(aad->size <= INT_MAX);
+	g_assert(in->size <= INT_MAX);
+	g_assert(tag->size <= INT_MAX);
+	g_assert(iv->size <= INT_MAX);
+	g_assert(out->size == in->size);
+
+	ctx = EVP_CIPHER_CTX_new();
+	if (!ctx)
+		g_abort();
+
+	/* First, set the cipher algorithm so we can verify our key/IV lengths
+	 */
+	if (EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, encrypt) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CIPHER_CTX_new failed"));
+		return -1;
+	}
+
+	/* Set IV length */
+	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, (int)iv->size, NULL) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CIPHER_CTX_ex failed"));
+		return -1;
+	}
+
+	/* Initialise key and IV */
+	if (EVP_CipherInit_ex(ctx, NULL, NULL, key->data, iv->data, encrypt) !=
+	    1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CipherInit_ex failed"));
+		return -1;
+	}
+
+	if (aad->size > 0) {
+		/* Provide any AAD data */
+		if (EVP_CipherUpdate(ctx, NULL, &len, aad->data,
+				     (int)aad->size) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("EVP_CipherUpdate failed"));
+			return -1;
+		}
+		g_assert(len == (int)aad->size);
+	}
+
+	/* Provide data to be en/decrypted */
+	if (EVP_CipherUpdate(ctx, out->data, &len, in->data, (int)in->size) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CipherUpdate failed"));
+		return -1;
+	}
+	ret = len;
+
+	if (!encrypt) {
+		/* Set expected tag value */
+		if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG,
+					(int)tag->size, tag->data) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("Setting the GCM tag failed"));
+			return -1;
+		}
+	}
+
+	/* Finalize the en/decryption */
+	if (EVP_CipherFinal_ex(ctx, (guchar *)out->data + len, &len) != 1) {
+		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
+			    _("EVP_CipherFinal_ex failed"));
+		return -1;
+	}
+	ret += len;
+
+	if (encrypt) {
+		/* Get the tag */
+		if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG,
+					(int)tag->size, tag->data) != 1) {
+			g_set_error(err, PV_CRYPTO_ERROR,
+				    PV_CRYPTO_ERROR_INTERNAL,
+				    _("Getting the GCM tag failed"));
+			return -1;
+		}
+	}
+
+	g_assert(ret == (int)in->size);
+	return ret;
+}
+
+int64_t gcm_encrypt(const Buffer *in, const Buffer *aad,
+		    const struct cipher_parms *parms, Buffer *out, Buffer *tag,
+		    GError **err)
+{
+	return gcm_encrypt_decrypt(in, aad, parms, out, tag, PV_ENCRYPT, err);
+}

genprotimg/src/utils/crypto.h

@@ -0,0 +1,104 @@
+/*
+ * General cryptography helper functions and definitions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_UTILS_CRYPTO_H
+#define PV_UTILS_CRYPTO_H
+
+#include <glib.h>
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+#include <openssl/sha.h>
+#include <openssl/x509.h>
+#include <stdint.h>
+
+#include "common.h"
+#include "include/pv_crypto_def.h"
+#include "lib/zt_common.h"
+
+#include "buffer.h"
+
+#define AES_256_GCM_IV_SIZE  12
+#define AES_256_GCM_TAG_SIZE 16
+
+#define AES_256_XTS_TWEAK_SIZE 16
+#define AES_256_XTS_KEY_SIZE   64
+
+enum PvCryptoMode {
+	PV_ENCRYPT,
+	PV_DECRYPT,
+};
+
+typedef GSList HostKeyList;
+
+/* Register auto cleanup functions */
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIGNUM, BN_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIO, BIO_free_all)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BN_CTX, BN_CTX_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_GROUP, EC_GROUP_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_KEY, EC_KEY_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_POINT, EC_POINT_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_CIPHER_CTX, EVP_CIPHER_CTX_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_MD_CTX, EVP_MD_CTX_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_PKEY, EVP_PKEY_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_PKEY_CTX, EVP_PKEY_CTX_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509, X509_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_LOOKUP, X509_LOOKUP_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_STORE, X509_STORE_free)
+WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_STORE_CTX, X509_STORE_CTX_free)
+
+union cmp_index {
+	struct {
+		uint16_t idx;
+		guchar rand[6];
+	} __packed;
+	uint64_t data;
+};
+
+/* The tweak is always stored in big endian format */
+union tweak {
+	struct {
+		union cmp_index cmp_idx;
+		uint64_t page_idx; /* page index */
+	} __packed;
+	uint8_t data[AES_256_XTS_TWEAK_SIZE];
+};
+
+struct cipher_parms {
+	const EVP_CIPHER *cipher;
+	const Buffer *key;
+	const Buffer *iv_or_tweak;
+};
+
+EVP_PKEY *read_ec_pubkey_cert(X509_STORE *store, gint nid, const gchar *path,
+			      GError **err);
+Buffer *compute_exchange_key(EVP_PKEY *cust, EVP_PKEY *host, GError **err);
+Buffer *generate_aes_key(guint size, GError **err);
+Buffer *generate_aes_iv(guint size, GError **err);
+EVP_PKEY *generate_ec_key(gint nid, GError **err);
+gint generate_tweak(union tweak *tweak, uint16_t i, GError **err);
+union ecdh_pub_key *evp_pkey_to_ecdh_pub_key(EVP_PKEY *key, GError **err);
+EVP_MD_CTX *digest_ctx_new(const EVP_MD *md, GError **err);
+Buffer *digest_ctx_finalize(EVP_MD_CTX *ctx, GError **err);
+Buffer *sha256_buffer(const Buffer *buf, GError **err);
+int64_t gcm_encrypt(const Buffer *in, const Buffer *aad,
+		    const struct cipher_parms *parms, Buffer *out,
+		    Buffer *tag, GError **err);
+gint encrypt_file(const struct cipher_parms *parms, const gchar *in_path,
+		  const gchar *path_out, gsize *in_size, gsize *out_size,
+		  GError **err);
+Buffer *encrypt_buf(const struct cipher_parms *parms, const Buffer *in,
+		    GError **err);
+G_GNUC_UNUSED Buffer *decrypt_buf(const struct cipher_parms *parms,
+				  const Buffer *in, GError **err);
+
+#endif

genprotimg/src/utils/file_utils.c

@@ -0,0 +1,234 @@
+/*
+ * General file utils
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <glib.h>
+#include <glib/gstdio.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "pv/pv_error.h"
+
+#include "align.h"
+#include "buffer.h"
+#include "common.h"
+#include "file_utils.h"
+
+FILE *file_open(const gchar *filename, const gchar *mode, GError **err)
+{
+	FILE *f = fopen(filename, mode);
+
+	if (!f) {
+		g_set_error(err, G_FILE_ERROR,
+			    (gint)g_file_error_from_errno(errno),
+			    _("Failed to open file '%s': %s"), filename,
+			    g_strerror(errno));
+		return NULL;
+	}
+
+	return f;
+}
+
+gint file_size(const gchar *filename, gsize *size, GError **err)
+{
+	GStatBuf st_buf;
+
+	g_assert(size);
+
+	if (g_stat(filename, &st_buf) != 0) {
+		g_set_error(err, G_FILE_ERROR,
+			    (gint)g_file_error_from_errno(errno),
+			    _("Failed to get file status '%s': %s"), filename,
+			    g_strerror(errno));
+		return -1;
+	}
+
+	if (!S_ISREG(st_buf.st_mode)) {
+		g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
+			    _("File '%s' is not a regular file"), filename);
+		return -1;
+	}
+
+	if (st_buf.st_size < 0) {
+		g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
+			    _("Invalid file size for '%s': %zu"), filename,
+			    st_buf.st_size);
+		return -1;
+	}
+
+	*size = (gsize)st_buf.st_size;
+	return 0;
+}
+
+/* Returns 0 on success, otherwise -1. Stores the total number of
+ * elements successfully read in @count_read
+ */
+gint file_read(FILE *in, void *ptr, gsize size, gsize count,
+	       gsize *count_read, GError **err)
+{
+	gsize tmp_count_read;
+
+	tmp_count_read = fread(ptr, size, count, in);
+	if (count_read)
+		*count_read = tmp_count_read;
+
+	if (ferror(in)) {
+		g_set_error(err, G_FILE_ERROR, 0, _("Failed to read file"));
+		return -1;
+	}
+
+	return 0;
+}
+
+gint file_write(FILE *out, const void *ptr, gsize size, gsize count,
+		gsize *count_written, GError **err)
+{
+	gsize tmp_count_written;
+
+	tmp_count_written = fwrite(ptr, size, count, out);
+	if (count_written)
+		*count_written = tmp_count_written;
+
+	if (tmp_count_written != count || ferror(out)) {
+		g_set_error(err, G_FILE_ERROR, 0, _("Failed to write file"));
+		return -1;
+	}
+
+	return 0;
+}
+
+static gint file_seek(FILE *f, uint64_t offset, GError **err)
+{
+	gint rc;
+
+	if (offset > LONG_MAX) {
+		g_set_error(err, PV_ERROR, 0, _("Offset is too large"));
+		return -1;
+	}
+
+	rc = fseek(f, (long)offset, SEEK_SET);
+	if (rc != 0) {
+		g_set_error(err, G_FILE_ERROR,
+			    (gint)g_file_error_from_errno(errno),
+			    _("Failed to seek: '%s'"), g_strerror(errno));
+		return -1;
+	}
+
+	return 0;
+}
+
+gint seek_and_write_file(FILE *o, const CompFile *ifile, uint64_t offset,
+			 GError **err)
+{
+	gsize bytes_read, bytes_written;
+	gsize total_bytes_read = 0;
+	FILE *i = NULL;
+	gchar buf[4096];
+	gint ret = -1;
+
+	if (file_seek(o, offset, err) < 0)
+		return -1;
+
+	i = file_open(ifile->path, "rb", err);
+	if (!i)
+		return -1;
+
+	do {
+		if (file_read(i, buf, 1, sizeof(buf), &bytes_read, err) < 0) {
+			g_prefix_error(err, _("Failed to read file '%s': "),
+				       ifile->path);
+			goto err;
+		}
+
+		if (bytes_read == 0)
+			break;
+
+		total_bytes_read += bytes_read;
+
+		if (file_write(o, buf, bytes_read, 1, &bytes_written, err) < 0)
+			goto err;
+	} while (bytes_written != 0);
+
+	if (ifile->size != total_bytes_read) {
+		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
+			    _("'%s' has changed during the preparation"),
+			    ifile->path);
+		goto err;
+	}
+
+	ret = 0;
+err:
+	fclose(i);
+	return ret;
+}
+
+gint seek_and_write_buffer(FILE *o, const Buffer *buf, uint64_t offset,
+			   GError **err)
+{
+	if (file_seek(o, offset, err) < 0)
+		return -1;
+
+	if (buffer_write(buf, o, err) < 0)
+		return -1;
+
+	return 0;
+}
+
+gint pad_file_right(const gchar *path_out, const gchar *path_in, gsize *size_out,
+		    guint padding, GError **err)
+{
+	FILE *f_in, *f_out = NULL;
+	guchar buf[padding];
+	gsize num_bytes_written;
+	gsize num_bytes_read;
+	uint64_t size_in = 0;
+	gint ret = -1;
+
+	*size_out = 0;
+	f_in = file_open(path_in, "rb", err);
+	if (!f_in)
+		goto err;
+
+	f_out = file_open(path_out, "wb", err);
+	if (!f_out)
+		goto err;
+
+	do {
+		memset(buf, 0, sizeof(buf));
+
+		if (file_read(f_in, buf, 1, sizeof(buf), &num_bytes_read, err) < 0) {
+			g_prefix_error(err, _("Failed to read file '%s': "),
+				       path_in);
+			goto err;
+		}
+
+		size_in += num_bytes_read;
+
+		if (file_write(f_out, buf, 1, sizeof(buf), &num_bytes_written, err)) {
+			g_prefix_error(err, _("Failed to write file '%s': "),
+				       path_out);
+			goto err;
+		}
+
+		*size_out += num_bytes_written;
+	} while (num_bytes_read == padding);
+
+	g_assert(num_bytes_written == ALIGN(num_bytes_read, padding));
+
+	ret = 0;
+err:
+	if (f_out)
+		fclose(f_out);
+	if (f_in)
+		fclose(f_in);
+	return ret;
+}

genprotimg/src/utils/file_utils.h

@@ -0,0 +1,34 @@
+/*
+ * General file utils
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_FILE_UTILS_H
+#define PV_FILE_UTILS_H
+
+#include <glib.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#include "pv/pv_comp.h"
+
+#include "buffer.h"
+
+FILE *file_open(const gchar *filename, const gchar *mode, GError **err);
+gint file_size(const gchar *filename, gsize *size, GError **err);
+gint file_read(FILE *in, void *ptr, gsize size, gsize count,
+	       gsize *count_read, GError **err);
+gint file_write(FILE *out, const void *ptr, gsize size, gsize count,
+		gsize *count_written, GError **err);
+gint pad_file_right(const gchar *path_out, const gchar *path_in,
+		    gsize *size_out, guint padding, GError **err);
+gint seek_and_write_buffer(FILE *out, const Buffer *buf, uint64_t offset,
+			   GError **err);
+gint seek_and_write_file(FILE *o, const CompFile *ifile, uint64_t offset,
+			 GError **err);
+
+#endif

include/boot/ipl.h

@@ -0,0 +1,191 @@
+/*
+ * IPL related definitions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef IPL_H
+#define IPL_H
+
+#include "lib/zt_common.h"
+#include "s390.h"
+
+#define IPL_FLAG_SECURE		 0x40
+
+#define IPL_RB_COMPONENT_FLAG_SIGNED	0x80
+#define IPL_RB_COMPONENT_FLAG_VERIFIED	0x40
+
+#define IPL_MAX_SUPPORTED_VERSION	0
+#define IPL_PARM_BLOCK_VERSION		0x1
+
+/* IPL Types */
+#define IPL_TYPE_PV			0x5
+
+
+#ifndef __ASSEMBLER__
+
+#include <stdint.h>
+
+/* IPL Parameter List header */
+struct ipl_pl_hdr {
+	uint32_t len;
+	uint8_t  flags;
+	uint8_t  reserved1[2];
+	uint8_t  version;
+} __packed;
+
+/* IPL Parameter Block header */
+struct ipl_pb_hdr {
+	uint32_t len;
+	uint8_t  pbt;
+} __packed;
+
+/* IPL Parameter Block 0 with common fields */
+struct ipl_pb0_common {
+	uint32_t len;
+	uint8_t  pbt;
+	uint8_t  flags;
+	uint8_t  reserved1[2];
+	uint8_t  loadparm[8];
+	uint8_t  reserved2[84];
+} __packed;
+
+/* IPL Parameter Block 0 for FCP */
+struct ipl_pb0_fcp {
+	uint32_t len;
+	uint8_t  pbt;
+	uint8_t  reserved1[3];
+	uint8_t  loadparm[8];
+	uint8_t  reserved2[304];
+	uint8_t  opt;
+	uint8_t  reserved3[3];
+	uint8_t  cssid;
+	uint8_t  reserved4[1];
+	uint8_t  devno;
+	uint8_t  reserved5[4];
+	uint64_t wwpn;
+	uint64_t lun;
+	uint32_t bootprog;
+	uint8_t  reserved6[12];
+	uint64_t br_lba;
+	uint32_t scp_data_len;
+	uint8_t  reserved7[260];
+	uint8_t  scp_data[];
+} __packed;
+
+/* IPL Parameter Block 0 for CCW */
+struct ipl_pb0_ccw {
+	uint32_t len;
+	uint8_t  pbt;
+	uint8_t  flags;
+	uint8_t  reserved1[2];
+	uint8_t  loadparm[8];
+	uint8_t  reserved2[84];
+	uint16_t reserved3 : 13;
+	uint8_t  ssid : 3;
+	uint16_t devno;
+	uint8_t  vm_flags;
+	uint8_t  reserved4[3];
+	uint32_t vm_parm_len;
+	uint8_t  nss_name[8];
+	uint8_t  vm_parm[64];
+	uint8_t  reserved5[8];
+} __packed;
+
+/* Structure must not have any padding */
+struct ipl_pb0_pv_comp {
+	uint64_t tweak_pref;
+	uint64_t addr;
+	uint64_t len;
+};
+STATIC_ASSERT(sizeof(struct ipl_pb0_pv_comp) == 3 * 8)
+
+/* IPL Parameter Block 0 for PV */
+struct ipl_pb0_pv {
+	uint32_t len;
+	uint8_t  pbt;
+	uint8_t  reserved1[3];
+	uint8_t  loadparm[8];
+	uint8_t  reserved2[84];
+	uint8_t  reserved3[3];
+	uint8_t  version;
+	uint8_t  reserved4[4];
+	uint32_t num_comp;
+	uint64_t pv_hdr_addr;
+	uint64_t pv_hdr_size;
+	struct ipl_pb0_pv_comp components[];
+} __packed;
+
+struct ipl_parameter_block {
+	struct ipl_pl_hdr hdr;
+	union {
+		struct ipl_pb_hdr pb0_hdr;
+		struct ipl_pb0_common common;
+		struct ipl_pb0_fcp fcp;
+		struct ipl_pb0_ccw ccw;
+		struct ipl_pb0_pv pv;
+		char raw[PAGE_SIZE - sizeof(struct ipl_pl_hdr)];
+	};
+} __packed;
+
+/* IPL Report List header */
+struct ipl_rl_hdr {
+	uint32_t len;
+	uint8_t  flags;
+	uint8_t  reserved1[2];
+	uint8_t  version;
+	uint8_t  reserved2[8];
+} __packed;
+
+/* IPL Report Block header */
+/* Structure must not have any padding */
+struct ipl_rb_hdr {
+	uint32_t len;
+	uint8_t  rbt;
+	uint8_t  reserved1[11];
+};
+STATIC_ASSERT(sizeof(struct ipl_rb_hdr) == 4 + 1 + 11)
+
+/* IPL Report Block types */
+enum ipl_rbt {
+	IPL_RBT_CERTIFICATES = 1,
+	IPL_RBT_COMPONENTS = 2,
+};
+
+/* IPL Report Block for the certificate list */
+struct ipl_rb_certificate_entry {
+	uint64_t addr;
+	uint64_t len;
+} __packed;
+
+struct ipl_rb_certificates {
+	uint32_t len;
+	uint8_t  rbt;
+	uint8_t  reserved1[11];
+	struct ipl_rb_certificate_entry entries[];
+} __packed;
+
+/* IPL Report Block for the component list */
+struct ipl_rb_component_entry {
+	uint64_t addr;
+	uint64_t len;
+	uint8_t  flags;
+	uint8_t  reserved1[5];
+	uint16_t certificate_index;
+	uint8_t  reserved2[8];
+};
+
+/* Structure must not have any padding */
+struct ipl_rb_components {
+	uint32_t len;
+	uint8_t  rbt;
+	uint8_t  reserved1[11];
+	struct ipl_rb_component_entry entries[];
+};
+STATIC_ASSERT(sizeof(struct ipl_rb_components) == 4 + 1 + 11)
+
+#endif /* __ASSEMBLER__ */
+#endif /* IPL_H */

include/boot/linux_layout.h

@@ -0,0 +1,34 @@
+/*
+ * s390 Linux layout definitions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef LINUX_LAYOUT_H
+#define LINUX_LAYOUT_H
+
+#include "lib/zt_common.h"
+
+/* Entry address offsets */
+#define IMAGE_ENTRY		_AC(0x10000, UL)
+#define IMAGE_ENTRY_KDUMP	_AC(0x10010, UL)
+
+/* Parameter address offsets */
+#define PARMAREA		_AC(0x10400, UL)
+#define IPL_DEVICE		_AC(0x10400, UL)
+#define INITRD_START		_AC(0x10408, UL)
+#define INITRD_SIZE		_AC(0x10410, UL)
+#define OLDMEM_BASE		_AC(0x10418, UL)
+#define OLDMEM_SIZE		_AC(0x10420, UL)
+#define COMMAND_LINE		_AC(0x10480, UL)
+
+/* Parameter sizes */
+#define COMMAND_LINE_SIZE	896
+
+
+#ifndef __ASSEMBLER__
+#endif /* __ASSEMBLER__ */
+#endif /* LINUX_LAYOUT_H */

include/boot/loaders_layout.h

@@ -0,0 +1,43 @@
+/*
+ * zipl stage2/stage3 layout definitions
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ *
+ */
+
+#ifndef LOADERS_LAYOUT_H
+#define LOADERS_LAYOUT_H
+
+#include "lib/zt_common.h"
+#include "linux_layout.h"
+
+#define STAGE2_DESC			_AC(0x78, UL)
+#define STAGE2_ENTRY			_AC(0x2018, UL)
+#define STAGE2_HEAP_ADDRESS		_AC(0x6000, UL)
+#define STAGE2_HEAP_SIZE		_AC(0x3000, UL)
+#define STAGE2_STACK_ADDRESS		_AC(0xe400, UL)
+#define STAGE2_STACK_SIZE		_AC(0x1c00, UL)
+
+#define STAGE3_ENTRY			_AC(0xa000, UL)
+
+#define STAGE2_LOAD_ADDRESS		_AC(0x2000, UL)
+#define STAGE3_LOAD_ADDRESS		STAGE3_ENTRY
+#define IMAGE_LOAD_ADDRESS		IMAGE_ENTRY
+
+#define STAGE3_MAXIMUM_SIZE		_AC(0x3000, UL)
+#define STAGE3_HEAP_SIZE		_AC(0x4000, UL)
+#define STAGE3_HEAP_ADDRESS		_AC(0x2000, UL)
+#define STAGE3_STACK_SIZE		_AC(0x1000, UL)
+#define STAGE3_STACK_ADDRESS		_AC(0xF000, UL)
+#define STAGE3_PARAMS_ADDRESS		_AC(0x9000, UL)
+#define STAGE3_PARAMS_MAXIMUM_SIZE	_AC(0x1000, UL)
+
+#define COMMAND_LINE_EXTRA		_AC(0xE000, UL)
+#define COMMAND_LINE_EXTRA_SIZE		_AC(0x0400, UL)
+
+#ifndef __ASSEMBLER__
+#endif /* __ASSEMBLER__ */
+#endif /* LOADERS_LAYOUT_H */

include/boot/s390.h

@@ -1,24 +1,38 @@
 /*
- * zipl - zSeries Initial Program Loader tool
+ * s390 related definitions and functions.
  *
- * System z specific functions
- *
- * Copyright IBM Corp. 2013, 2017
+ * Copyright IBM Corp. 2013, 2020
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
  */
+
 #ifndef S390_H
 #define S390_H
 
-#include "../../include/lib/zt_common.h"
-#include "libc.h"
+#include "lib/zt_common.h"
+#include "boot/sigp.h"
 
-#define __pa32(x) ((uint32_t)(unsigned long)(x))
-#define __pa(x) ((unsigned long)(x))
-#define MIN(x, y) ((x) < (y) ? (x) : (y))
-#define barrier() __asm__ __volatile__("": : :"memory")
-#define inline		inline __attribute__((always_inline))
+#define __LC_IPLDEV		0x0c6c
+#define __LC_OS_INFO		0x0e18
+
+#define PAGE_SIZE		_AC(4096, UL)
+
+/* Minimum size of a stack frame in bytes */
+#define STACK_FRAME_OVERHEAD	_AC(160, U)
+
+/* Facilities */
+#define UNPACK_FACILITY		_AC(161, U)
+
+#define PSW32_ADDR_MASK   _AC(0x000000007fffffff, UL)
+#define PSW_MASK_BA	  _AC(0x0000000080000000, UL)
+#define PSW_MASK_EA	  _AC(0x0000000100000000, UL)
+#define PSW_MASK_BIT_12	  _AC(0x0008000000000000, UL)
+#define PSW_LOAD	  _AC(0x0008000080000000, UL)
+#define PSW_DISABLED_WAIT _AC(0x000a000000000000, UL)
+
+
+#ifndef __ASSEMBLER__
 
 /*
  * Helper macro for exception table entries
@@ -199,21 +213,8 @@ struct _lowcore {
 
 #define S390_lowcore (*((struct _lowcore *) 0))
 
-#define __LC_IPLDEV		0x0c6c
-#define __LC_OS_INFO		0x0e18
 
-#define PAGE_SIZE		4096
-
-void panic_notify(unsigned long reason);
-
-#define panic(reason, x...) \
-do { \
-	printf(x); \
-	panic_notify(reason); \
-	libc_stop(reason); \
-} while (0)
-
-static inline int page_is_valid(unsigned long addr)
+static __always_inline int page_is_valid(unsigned long addr)
 {
 	unsigned long tmp;
 	int rc;
@@ -233,7 +234,7 @@ static inline int page_is_valid(unsigned long addr)
 	return rc;
 }
 
-static inline uint32_t csum_partial(const void *buf, int len, uint32_t sum)
+static __always_inline uint32_t csum_partial(const void *buf, int len, uint32_t sum)
 {
 	register unsigned long reg2 asm("2") = (unsigned long) buf;
 	register unsigned long reg3 asm("3") = (unsigned long) len;
@@ -261,7 +262,7 @@ static inline uint32_t csum_partial(const void *buf, int len, uint32_t sum)
 		  "i" (low), "i" (high));			\
 })
 
-static inline void __ctl_set_bit(unsigned int cr, unsigned int bit)
+static __always_inline void __ctl_set_bit(unsigned int cr, unsigned int bit)
 {
 	unsigned long reg;
 
@@ -274,14 +275,20 @@ static inline void __ctl_set_bit(unsigned int cr, unsigned int bit)
  * DIAG 308 support
  */
 enum diag308_subcode {
-	DIAG308_REL_HSA = 2,
-	DIAG308_IPL	= 3,
-	DIAG308_DUMP	= 4,
-	DIAG308_SET	= 5,
-	DIAG308_STORE	= 6,
+	DIAG308_REL_HSA	  = 2,
+	DIAG308_IPL	  = 3,
+	DIAG308_DUMP	  = 4,
+	DIAG308_SET	  = 5,
+	DIAG308_STORE	  = 6,
+	DIAG308_SET_PV	  = 8,
+	DIAG308_UNPACK_PV = 10,
 };
 
-static inline int diag308(unsigned long subcode, void *addr)
+enum diag308_rc {
+	DIAG308_RC_OK	      = 0x0001,
+};
+
+static __always_inline unsigned long diag308(unsigned long subcode, void *addr)
 {
 	register unsigned long _addr asm("0") = (unsigned long) addr;
 	register unsigned long _rc asm("1") = 0;
@@ -294,47 +301,10 @@ static inline int diag308(unsigned long subcode, void *addr)
 	return _rc;
 }
 
-/*
- * Signal Processor
- */
-#define SIGP_STOP_AND_STORE_STATUS	9
-#define SIGP_SET_MULTI_THREADING	22
-#define SIGP_STORE_ASTATUS_AT_ADDRESS	23
-
-#define SIGP_CC_ORDER_CODE_ACCEPTED	0
-#define SIGP_CC_BUSY			2
-
-static inline int sigp(uint16_t addr, uint8_t order, uint32_t parm,
-		       uint32_t *status)
-{
-	register unsigned int reg1 asm ("1") = parm;
-	int cc;
-
-	asm volatile(
-		"	sigp	%1,%2,0(%3)\n"
-		"	ipm	%0\n"
-		"	srl	%0,28\n"
-		: "=d" (cc), "+d" (reg1) : "d" (addr), "a" (order) : "cc");
-	if (status && cc == 1)
-		*status = reg1;
-	return cc;
-}
-
-static inline int sigp_busy(uint16_t addr, uint8_t order, uint32_t parm,
-			    uint32_t *status)
-{
-	int cc;
-
-	do {
-		cc = sigp(addr, order, parm, status);
-	} while (cc == SIGP_CC_BUSY);
-	return cc;
-}
-
 /*
  * Store CPU address
  */
-static inline unsigned short stap(void)
+static __always_inline unsigned short stap(void)
 {
 	unsigned short cpu_address;
 
@@ -345,7 +315,7 @@ static inline unsigned short stap(void)
 /*
  * Program the clock comparator
  */
-static inline void set_clock_comparator(uint64_t time)
+static __always_inline void set_clock_comparator(uint64_t time)
 {
 	asm volatile("sckc %0" : : "Q" (time));
 }
@@ -353,7 +323,7 @@ static inline void set_clock_comparator(uint64_t time)
 /*
  * Program the CPU timer
  */
-static inline void set_cpu_timer(uint64_t timer)
+static __always_inline void set_cpu_timer(uint64_t timer)
 {
 	asm volatile("spt %0" : : "Q" (timer));
 }
@@ -361,7 +331,7 @@ static inline void set_cpu_timer(uint64_t timer)
 /*
  * Get current time (store clock)
  */
-static inline unsigned long long get_tod_clock(void)
+static __always_inline unsigned long long get_tod_clock(void)
 {
 	unsigned long long clk;
 
@@ -379,7 +349,7 @@ struct cpuid {
 	unsigned int unused:16;
 } __packed __aligned(8);
 
-static inline void get_cpu_id(struct cpuid *ptr)
+static __always_inline void get_cpu_id(struct cpuid *ptr)
 {
 	asm volatile("stidp %0" : "=Q" (*ptr));
 }
@@ -387,7 +357,7 @@ static inline void get_cpu_id(struct cpuid *ptr)
 /*
  * Check if we run under z/VM
  */
-static inline int is_zvm(void)
+static __always_inline int is_zvm(void)
 {
 	struct cpuid cpuid;
 
@@ -395,17 +365,22 @@ static inline int is_zvm(void)
 	return cpuid.version == 0xff;
 }
 
+/* To avoid conflicts add a macro guard since __vector128 is also
+ * defined in 'linux/asm/types.h'.
+ */
+#ifndef _S390_TYPES_H
 /*
  * Vector register definition
  */
 typedef struct {
 	uint32_t u[4];
 } __vector128;
+#endif
 
 /*
  * Save vector registers
  */
-static inline void save_vx_regs(__vector128 *vxrs)
+static __always_inline void save_vx_regs(__vector128 *vxrs)
 {
 	typedef struct { __vector128 _[32]; } addrtype;
 
@@ -419,7 +394,7 @@ static inline void save_vx_regs(__vector128 *vxrs)
 /*
  * Save vector registers safe
  */
-static inline void save_vx_regs_safe(__vector128 *vxrs)
+static __always_inline void save_vx_regs_safe(__vector128 *vxrs)
 {
 	unsigned long cr0;
 
@@ -432,7 +407,7 @@ static inline void save_vx_regs_safe(__vector128 *vxrs)
 
 #define MAX_FACILITY_BIT (256*8)	/* stfle_fac_list has 256 bytes */
 
-static inline int __test_facility(unsigned long nr, void *facilities)
+static __always_inline int __test_facility(unsigned long nr, void *facilities)
 {
 	unsigned char *ptr;
 
@@ -447,12 +422,12 @@ static inline int __test_facility(unsigned long nr, void *facilities)
  * That makes it easier to query facility bits with the bit number as
  * documented in the Principles of Operation.
  */
-static inline int test_facility(unsigned long nr)
+static __always_inline int test_facility(unsigned long nr)
 {
 	return __test_facility(nr, &S390_lowcore.stfle_fac_list);
 }
 
-static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
+static __always_inline unsigned long __stfle_asm(uint64_t *stfle_fac_list, unsigned int size)
 {
 	register unsigned long reg0 asm("0") = size - 1;
 
@@ -469,7 +444,7 @@ static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
  * @stfle_fac_list: array where facility list can be stored
  * @size: size of passed in array in double words
  */
-static inline void stfle(u64 *stfle_fac_list, int size)
+static __always_inline void stfle(uint64_t *stfle_fac_list, unsigned int size)
 {
 	unsigned long nr;
 
@@ -488,4 +463,5 @@ static inline void stfle(u64 *stfle_fac_list, int size)
 	memset((char *) stfle_fac_list + nr, 0, size * 8 - nr);
 }
 
+#endif /* __ASSEMBLER__ */
 #endif /* S390_H */

include/boot/sigp.h

@@ -0,0 +1,56 @@
+/*
+ * SIGP related definitions and functions.
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef S390_SIGP_H
+#define S390_SIGP_H
+
+/* Signal Processor Order Codes */
+#define SIGP_STOP_AND_STORE_STATUS	9
+#define SIGP_SET_ARCHITECTURE		18
+#define SIGP_SET_MULTI_THREADING	22
+#define SIGP_STORE_ASTATUS_AT_ADDRESS	23
+
+/* Signal Processor Condition Codes */
+#define SIGP_CC_ORDER_CODE_ACCEPTED	0
+#define SIGP_CC_BUSY			2
+
+
+#ifndef __ASSEMBLER__
+
+#include <stdint.h>
+
+static inline int sigp(uint16_t addr, uint8_t order, uint32_t parm,
+		       uint32_t *status)
+{
+	register unsigned int reg1 asm ("1") = parm;
+	int cc;
+
+	asm volatile(
+		"	sigp	%1,%2,0(%3)\n"
+		"	ipm	%0\n"
+		"	srl	%0,28\n"
+		: "=d" (cc), "+d" (reg1) : "d" (addr), "a" (order) : "cc");
+	if (status && cc == 1)
+		*status = reg1;
+	return cc;
+}
+
+static inline int sigp_busy(uint16_t addr, uint8_t order, uint32_t parm,
+			    uint32_t *status)
+{
+	int cc;
+
+	do {
+		cc = sigp(addr, order, parm, status);
+	} while (cc == SIGP_CC_BUSY);
+	return cc;
+}
+
+#endif /* __ASSEMBLER__ */
+#endif /* S390_SIGP_H */

include/lib/util_base.h

@@ -14,30 +14,13 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include "zt_common.h"
 
 void util_hexdump(FILE *fh, const char *tag, const void *data, int cnt);
 void util_hexdump_grp(FILE *fh, const char *tag, const void *data, int group,
 		      int cnt, int indent);
 void util_print_indented(const char *str, int indent);
 
-#define UTIL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
-
-#define MIN(x, y)		\
-({				\
-	__typeof__(x) _x = (x);	\
-	__typeof__(y) _y = (y);	\
-				\
-	_x < _y ? _x : _y;	\
-})
-
-#define MAX(x, y)		\
-({				\
-	__typeof__(x) _x = (x);	\
-	__typeof__(y) _y = (y);	\
-				\
-	_x > _y ? _x : _y;	\
-})
-
 static inline void util_ptr_vec_free(void **ptr_vec, int count)
 {
 	int i;

include/lib/util_file.h

@@ -9,7 +9,7 @@
  * it under the terms of the MIT license. See LICENSE for details.
  */
 #ifndef LIB_UTIL_FILE_H
-#define LIB_UITL_FILE_H
+#define LIB_UTIL_FILE_H
 
 int util_file_read_line(char *str, size_t size, const char *fmt, ...);
 int util_file_read_l(long *val, int base, const char *fmt, ...);

include/lib/zt_common.h

@@ -15,6 +15,21 @@
 #define STRINGIFY_1(x)			#x
 #define STRINGIFY(x)			STRINGIFY_1(x)
 
+/* Use this macro to make constant macros usable in both assembler and
+ * C code.
+ *
+ * Usage example:
+ *  #define IMAGE_ENTRY _AC(0x10000, UL)
+ */
+#ifdef __ASSEMBLER__
+#define _AC(X, TYPE)	X
+#else
+#define _AC(X, TYPE)	X##TYPE
+#endif
+
+
+#ifndef __ASSEMBLER__
+
 #ifdef UNUSED
 #elif defined(__GNUC__)
 # define UNUSED(x) UNUSED_ ## x __attribute__((unused))
@@ -22,6 +37,17 @@
 # define UNUSED(x) x
 #endif
 
+#ifdef STATIC_ASSERT
+#elif defined(__GNUC__) && ((__GNUC__ == 4 && __GNUC_MINOR__ >= 6) || __GNUC__ >= 5)
+# define STATIC_ASSERT(test) _Static_assert((test), "(" #test ") failed");
+#else
+# define STATIC_ASSERT(test)
+#endif
+
+#define ALIGN(x, a)		__ALIGN_MASK(x, (typeof(x))(a) - 1)
+#define __ALIGN_MASK(x, mask)	(((x) + (mask)) & ~(mask))
+#define ARRAY_SIZE(x)		(sizeof(x) / sizeof((x)[0]))
+
 #define RELEASE_STRING	STRINGIFY (S390_TOOLS_RELEASE)
 #define TOOLS_LIBDIR	STRINGIFY (S390_TOOLS_LIBDIR)
 #define TOOLS_SYSCONFDIR STRINGIFY (S390_TOOLS_SYSCONFDIR)
@@ -31,6 +57,37 @@
 #define __packed __attribute__((packed))
 #define __aligned(x) __attribute__((aligned(x)))
 #define __may_alias __attribute__((may_alias))
+#define __section(x) __attribute__((__section__(#x)))
+#define __noinline __attribute__((__noinline__))
+/* The Linux kernel (in stddef.h) and glibc (sys/cdefs.h) define
+ * __always_inline. Therefore undefine it first to allow the headers
+ * to be included first.
+ */
+#undef __always_inline
+#define __always_inline inline __attribute__((always_inline))
+
+#define __pa32(x) ((uint32_t)(unsigned long)(x))
+#define __pa(x) ((unsigned long)(x))
+
+#define barrier() __asm__ __volatile__("": : :"memory")
+
+#undef MIN
+#define MIN(x, y)				\
+	({					\
+		__typeof__(x) _x = (x);		\
+		__typeof__(y) _y = (y);		\
+						\
+		_x < _y ? _x : _y;		\
+	})
+
+#undef MAX
+#define MAX(x, y)				\
+	({					\
+		__typeof__(x) _x = (x);		\
+		__typeof__(y) _y = (y);		\
+						\
+		_x > _y ? _x : _y;		\
+	})
 
 typedef unsigned long long	u64;
 typedef signed long long	s64;
@@ -41,4 +98,5 @@ typedef signed short int	s16;
 typedef unsigned char		u8;
 typedef signed char		s8;
 
+#endif /* __ASSEMBLER__ */
 #endif /* LIB_ZT_COMMON_H */

ipl_tools/cmd_chreipl.c

@@ -60,6 +60,7 @@ static const char *const usage_chreipl =
 "Options for ccw target:\n"
 "  -d, --device <DEVICE>   Device number of the CCW IPL device\n"
 "  -L, --loadparm <PARM>   Loadparm specification\n"
+"  -c, --clear 0|1         Control if memory is cleared on re-IPL\n"
 "\n"
 "Options for fcp target:\n"
 "  -d, --device <DEVICE>   Device number of the adapter of the FCP IPL device\n"
@@ -67,6 +68,7 @@ static const char *const usage_chreipl =
 "  -w  --wwpn <WWPN>       World Wide Port Name of the FCP IPL device\n"
 "  -b, --bootprog <BPROG>  Bootprog specification\n"
 "  -L, --loadparm <PARM>   Loadparm specification\n"
+"  -c, --clear 0|1         Control if memory is cleared on re-IPL\n"
 "\n"
 "Options for nss target:\n"
 "  -n, --name <NAME>       Identifier of the NSS\n"
@@ -96,6 +98,7 @@ static struct locals {
 	int			target_type_set;
 	int			target_type_auto_mode;
 	enum reipl_type		reipl_type;	/* CCW, FCP, NSS */
+	int			reipl_clear;
 } l;
 
 static void __noreturn print_usage_chreipl_exit(void)
@@ -460,6 +463,16 @@ static void set_target_type_auto(const char *arg)
 	}
 }
 
+static void set_reipl_clear(const char *arg)
+{
+	if (arg[0] == '1')
+		l.reipl_clear = 1;
+	else if (arg[0] == '0')
+		l.reipl_clear = 0;
+	else
+		ERR_EXIT("re-IPL clear argument must be either 1 or 0");
+}
+
 static void parse_chreipl_options(int argc, char *argv[])
 {
 	int opt, idx;
@@ -474,9 +487,10 @@ static void parse_chreipl_options(int argc, char *argv[])
 		{ "bootparms",	 required_argument,	NULL, 'p' },
 		{ "force",	 no_argument,		NULL, 'f' },
 		{ "version",	 no_argument,		NULL, 'v' },
+		{ "clear",	 required_argument,	NULL, 'c' },
 		{ NULL,		 0,			NULL,  0  }
 	};
-	static const char optstr[] = "hcd:vw:l:fL:b:n:p:";
+	static const char optstr[] = "hd:vw:l:fL:b:n:p:c:";
 
 	/* dont run without any argument */
 	if (argc == 1)
@@ -493,6 +507,8 @@ static void parse_chreipl_options(int argc, char *argv[])
 	else
 		set_target_type_auto(argv[1]);
 
+	l.reipl_clear = -1;
+
 	while ((opt = getopt_long(argc, argv, optstr, long_opts, &idx)) != -1) {
 		switch (opt) {
 		case 'h':
@@ -521,6 +537,9 @@ static void parse_chreipl_options(int argc, char *argv[])
 		case 'f':
 			l.force_set = 1;
 			break;
+		case 'c':
+			set_reipl_clear(optarg);
+			break;
 		case 'v':
 			print_version_exit();
 		default:
@@ -600,6 +619,11 @@ static void chreipl_ccw(void)
 			 strlen(l.bootparms), BOOTPARMS_CCW_MAX);
 	}
 
+	if (l.reipl_clear >= 0) {
+		check_exists("reipl/ccw/clear", "CCW re-IPL clear attribute");
+		write_str(l.reipl_clear ? "1" : "0", "reipl/ccw/clear");
+	}
+
 	/*
 	 * On old systems that use CCW reipl loadparm cannot be set
 	 */
@@ -627,6 +651,12 @@ static void chreipl_fcp(void)
 		ERR_EXIT("Maximum boot parameter length exceeded (%zu/%u)",
 			 strlen(l.bootparms), BOOTPARMS_FCP_MAX);
 	}
+
+	if (l.reipl_clear >= 0) {
+		check_exists("reipl/fcp/clear", "FCP re-IPL clear attribute");
+		write_str(l.reipl_clear ? "1" : "0", "reipl/fcp/clear");
+	}
+
 	/*
 	 * On old systems the FCP reipl loadparm cannot be set
 	 */

ipl_tools/cmd_lsreipl.c

@@ -59,6 +59,7 @@ void print_fcp(int show_ipl, int dump)
 	char *path_loadparm = show_ipl ? "/sys/firmware/ipl/loadparm" :
 		"/sys/firmware/reipl/fcp/loadparm";
 	char loadparm[9], loadparm_path[PATH_MAX];
+	char *path_reipl_clear = "/sys/firmware/reipl/fcp/clear";
 
 	if (dump)
 		printf("%-12s fcp_dump\n", get_ipl_banner(show_ipl));
@@ -79,6 +80,8 @@ void print_fcp(int show_ipl, int dump)
 	}
 	if (access(path_bootparms, R_OK) == 0)
 		print_fw_str("Bootparms:   \"%s\"\n", dir, "scp_data");
+	if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
+		print_fw_str("clear:       %s\n", dir, "clear");
 }
 
 void print_ccw(int show_ipl)
@@ -89,6 +92,7 @@ void print_ccw(int show_ipl)
 		"/sys/firmware/reipl/ccw/loadparm";
 	char *path_bootparms = show_ipl ? "/sys/firmware/ipl/parm" :
 		"/sys/firmware/reipl/ccw/parm";
+	char *path_reipl_clear = "/sys/firmware/reipl/ccw/clear";
 
 	printf("%-12s ccw\n", get_ipl_banner(show_ipl));
 	print_fw_str("Device:      %s\n", dir, "device");
@@ -101,6 +105,8 @@ void print_ccw(int show_ipl)
 	}
 	if (access(path_bootparms, R_OK) == 0)
 		print_fw_str("Bootparms:   \"%s\"\n", dir, "parm");
+	if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
+		print_fw_str("clear:       %s\n", dir, "clear");
 }
 
 static void parse_lsreipl_options(int argc, char *argv[])

ipl_tools/man/chreipl.8

@@ -132,6 +132,14 @@ the same as 0.0.5000).
 Specifies an entry in the
 .BR zipl (8)
 boot menu. If this option is omitted, the default menu entry is used.
+
+.TP
+.BR "\-c" " or " "\-\-clear"
+Specify whether memory should be cleared on re-IPL. Possible values are 0 to
+disable and 1 to enable memory clearing on re-IPL.
+Memory clearing is supported if the "clear" attribute is present in
+/sys/firmware/reipl/ccw/.
+
 .PP
 \fBExamples:\fP
 .br
@@ -176,6 +184,13 @@ configuration that is defined by the
 boot menu. Instead it can be used to control higher level boot loaders
 like GRUB. For more details refer to distribution specific documentation.
 
+.TP
+.BR "\-c" " or " "\-\-clear"
+Specify whether memory should be cleared on re-IPL. Possible values are 0 to
+disable and 1 to enable memory clearing on re-IPL.
+Memory clearing is supported if the "clear" attribute is present in
+/sys/firmware/reipl/fcp/.
+
 .PP
 \fBExamples:\fP
 .br

libdasd/dasd_ioctl.c

@@ -146,9 +146,10 @@ int dasd_is_ro(const char *device, bool *ro)
 {
 	int fd, val;
 
-	fd = dasd_open_device(device, O_RDWR);
+	fd = dasd_open_device(device, O_RDONLY);
 	RUN_IOCTL(fd, BLKROGET, &val);
 	*ro = (val != 0) ? true : false;
+	dasd_close_device(fd);
 
 	return 0;
 }

libdasd/dasd_sys.c

@@ -210,7 +210,7 @@ int dasd_reset_chpid(char *devnode, char *chpid_char)
  */
 int dasd_get_host_access_count(char *device)
 {
-	char busid[9];
+	char busid[DASD_BUS_ID_SIZE];
 	char *path;
 	long value;
 

libutil/util_libc.c

@@ -29,7 +29,7 @@ static void format_size(char *str, size_t size)
 		{"byte", "KiB", "MiB", "GiB", "TiB", "PiB", "EiB"};
 	unsigned int i;
 
-	for (i = 0; i < UTIL_ARRAY_SIZE(unit_vec); i++) {
+	for (i = 0; i < ARRAY_SIZE(unit_vec); i++) {
 		if (size / 1024 == 0) {
 			sprintf(str, "%zu %s", size, unit_vec[i]);
 			return;

libutil/util_panic.c

@@ -31,7 +31,7 @@ static void print_backtrace(void)
 	char **strings;
 
 	fprintf(stderr, "Backtrace:\n\n");
-	size = backtrace(array, UTIL_ARRAY_SIZE(array));
+	size = backtrace(array, ARRAY_SIZE(array));
 	strings = backtrace_symbols(array, size);
 	if (strings == NULL) {
 		fprintf(stderr, " Could not obtain backtrace (ENOMEM)\n");

libutil/util_panic_example.c

@@ -15,10 +15,10 @@
 #include <sys/resource.h>
 #include <sys/time.h>
 
+#include "lib/zt_common.h"
 #include "lib/util_panic.h"
 
 /* Make functions noinline to have a nice backtrace */
-#define __noinline __attribute__((noinline))
 
 /*
  * Test util_panic()

netboot/Makefile.pxelinux.0

@@ -33,8 +33,8 @@ pxelinux.initramfs: $(BBINSTALL)
 $(BUSYBOX)/_install:
 	wget https://busybox.net/downloads/$(BUSYBOX).tar.bz2
 	tar xjf $(BUSYBOX).tar.bz2
-	make -C $(BUSYBOX) defconfig
-	make -C $(BUSYBOX) install
+	$(MAKE) -C $(BUSYBOX) defconfig
+	$(MAKE) -C $(BUSYBOX) install
 
 install:
 

scripts/dbginfo.sh

@@ -2,7 +2,7 @@
 #
 # dbginfo.sh - Tool to collect runtime, configuration, and trace information
 #
-# Copyright IBM Corp. 2002, 2018
+# Copyright IBM Corp. 2002, 2020
 #
 # s390-tools is free software; you can redistribute it and/or modify
 # it under the terms of the MIT license. See LICENSE for details.
@@ -21,7 +21,7 @@ readonly SCRIPTNAME="${0##*/}"
 print_version() {
     cat <<EOF
 ${SCRIPTNAME}: Debug information script version %S390_TOOLS_VERSION%
-Copyright IBM Corp. 2002, 2018
+Copyright IBM Corp. 2002, 2020
 EOF
 }
 
@@ -176,6 +176,12 @@ readonly OUTPUT_FILE_OSAOAT="${WORKPATH}osa_oat"
 # File that includes content of Ethtool commands
 readonly OUTPUT_FILE_ETHTOOL="${WORKPATH}ethtool.out"
 
+# File that includes content of tc commands
+readonly OUTPUT_FILE_TC="${WORKPATH}tc.out"
+
+# File that includes content of bridge commands
+readonly OUTPUT_FILE_BRIDGE="${WORKPATH}bridge.out"
+
 # File that includes the output of journalctl
 readonly OUTPUT_FILE_JOURNALCTL="${WORKPATH}journalctl.out"
 
@@ -195,7 +201,7 @@ readonly OUTPUT_FILE_NVME="${WORKPATH}nvme.out"
 readonly MOUNT_POINT_DEBUGFS="/sys/kernel/debug"
 
 # The amount of steps running the whole collections
-readonly COLLECTION_COUNT=13
+readonly COLLECTION_COUNT=15
 
 # The kernel version (e.g. '2' from 2.6.32 or '3' from 3.2.1)
 readonly KERNEL_VERSION=$(uname -r 2>/dev/null | cut -d'.' -f1)
@@ -254,6 +260,7 @@ PROCFILES="\
   /proc/mounts\
   /proc/net/vlan\
   /proc/net/bonding\
+  /proc/net/softnet_stat\
   /proc/partitions\
   /proc/qeth\
   /proc/qeth_perf\
@@ -313,7 +320,6 @@ LOGFILES="\
   /var/log/lin_tape.trace\
   /var/log/lin_tape.errorlog\
   /var/log/messages*\
-  /var/log/opencryptoki\
   /var/log/syslog*\
   /var/log/sa\
   /var/log/yum.log\
@@ -374,7 +380,7 @@ CONFIGFILES="\
   $(find /lib/modules -name modules.dep 2>/dev/null)\
   /etc/docker\
   /lib/systemd/system/docker.service\
-  /usr/lib/systemd/system/docker.service\
+  /usr/lib/systemd/system\
   /etc/apparmor.d\
   "
 
@@ -401,6 +407,7 @@ CMDS="uname -a\
   :ip link show\
   :ip ntable\
   :ip a sh\
+  :ip -s -s link\
   :firewall-cmd --list-all\
   :ipcs -a\
   :netstat -pantu\
@@ -459,7 +466,7 @@ CMDS="uname -a\
   :java -version\
   :cat /root/.bash_history\
   :env\
-  :journalctl --all --no-pager --since=$(date -d '5 day ago' +%Y-%m-%d) --until=now --lines=50000 \
+  :journalctl --all --no-pager --lines=100000 --output=short-precise\
    > '${OUTPUT_FILE_JOURNALCTL}'\
   :openssl engine\
   :systemd-delta\
@@ -561,6 +568,11 @@ collect_cmdsout() {
     done
     IFS="${ifs_orig}"
 
+    if echo "${RUNTIME_ENVIRONMENT}" | grep -qi "z/VM" >/dev/null 2>&1; then
+        call_run_command "hyptop -b -d 1 -n 5 -f \#,c,m,C:s,M:s,o -S c" "${OUTPUT_FILE_CMD}"
+    else call_run_command "hyptop -b -d 1 -n 5 -f \#,T,c,e,m,C:s,E:s,M:s,o -S c" "${OUTPUT_FILE_CMD}"
+    fi
+
     pr_log_stdout " "
 }
 
@@ -769,6 +781,7 @@ collect_ethtool() {
 		call_run_command "ethtool -k ${network_device}" "${OUTPUT_FILE_ETHTOOL}"
 		call_run_command "ethtool -a ${network_device}" "${OUTPUT_FILE_ETHTOOL}"
 		call_run_command "ethtool -c ${network_device}" "${OUTPUT_FILE_ETHTOOL}"
+		call_run_command "ethtool --per-queue ${network_device} --show-coalesce" "${OUTPUT_FILE_ETHTOOL}"
 		call_run_command "ethtool -g ${network_device}" "${OUTPUT_FILE_ETHTOOL}"
 		call_run_command "ethtool -i ${network_device}" "${OUTPUT_FILE_ETHTOOL}"
 		call_run_command "ethtool -l ${network_device}" "${OUTPUT_FILE_ETHTOOL}"
@@ -786,6 +799,52 @@ collect_ethtool() {
     pr_log_stdout " "
 }
 
+########################################
+collect_tc() {
+    local network_devices
+    local network_device
+
+    network_devices=$(ls /sys/class/net 2>/dev/null)
+    if which tc >/dev/null 2>&1; then
+	if test -n "${network_devices}"; then
+	    pr_syslog_stdout "9 of ${COLLECTION_COUNT}: Collecting tc output"
+	    for network_device in ${network_devices}; do
+		call_run_command "tc -s qdisc show dev ${network_device}" "${OUTPUT_FILE_TC}"
+	    done
+	else
+	    pr_syslog_stdout "9 of ${COLLECTION_COUNT}: Collecting tc output skipped - no devices"
+	fi
+    else
+	pr_syslog_stdout "9 of ${COLLECTION_COUNT}: Collecting tc output skipped - not available"
+    fi
+
+    pr_log_stdout " "
+}
+
+########################################
+collect_bridge() {
+    local network_devices
+    local network_device
+
+    network_devices=$(ls /sys/class/net 2>/dev/null)
+    if which bridge >/dev/null 2>&1; then
+	if test -n "${network_devices}"; then
+	    pr_syslog_stdout "10 of ${COLLECTION_COUNT}: Collecting bridge output"
+	    for network_device in ${network_devices}; do
+		call_run_command "bridge -d link show dev ${network_device}" "${OUTPUT_FILE_BRIDGE}"
+		call_run_command "bridge -s fdb show dev ${network_device}" "${OUTPUT_FILE_BRIDGE}"
+		call_run_command "bridge -d mdb show dev ${network_device}" "${OUTPUT_FILE_BRIDGE}"
+	    done
+	else
+	    pr_syslog_stdout "10 of ${COLLECTION_COUNT}: Collecting bridge output skipped - no devices"
+	fi
+    else
+	pr_syslog_stdout "10 of ${COLLECTION_COUNT}: Collecting bridge output skipped - not available"
+    fi
+
+    pr_log_stdout " "
+}
+
 ########################################
 # OpenVSwitch
 collect_ovs() {
@@ -802,7 +861,7 @@ collect_ovs() {
             :ovsdb-client dump\
             "
     if test -n "${br_list}"; then
-        pr_syslog_stdout "9 of ${COLLECTION_COUNT}: Collecting OpenVSwitch output"
+        pr_syslog_stdout "11 of ${COLLECTION_COUNT}: Collecting OpenVSwitch output"
         IFS=:
           for ovscmd in ${ovscmds}; do
             IFS=${ifs_orig} call_run_command "${ovscmd}" "${OUTPUT_FILE_OVS}.out"
@@ -821,7 +880,7 @@ collect_ovs() {
          IFS="${ifs_orig}"
         done
     else
-        pr_syslog_stdout "9 of ${COLLECTION_COUNT}: Collecting OpenVSwitch output skipped"
+        pr_syslog_stdout "11 of ${COLLECTION_COUNT}: Collecting OpenVSwitch output skipped"
     fi
 
     pr_log_stdout " "
@@ -834,12 +893,12 @@ collect_domain_xml() {
 
     domain_list=$(virsh list --all --name)
     if test -n "${domain_list}"; then
-        pr_syslog_stdout "10 of ${COLLECTION_COUNT}: Collecting domain xml files"
+        pr_syslog_stdout "12 of ${COLLECTION_COUNT}: Collecting domain xml files"
 	  for domain in ${domain_list}; do
 	    call_run_command "virsh dumpxml ${domain}" "${OUTPUT_FILE_XML}_${domain}.xml"
           done
     else
-        pr_syslog_stdout "10 of ${COLLECTION_COUNT}: Collecting domain xml files skipped"
+        pr_syslog_stdout "12 of ${COLLECTION_COUNT}: Collecting domain xml files skipped"
     fi
 
     pr_log_stdout " "
@@ -853,23 +912,23 @@ collect_docker() {
     # call docker inspect for all containers
     item_list=$(docker ps -qa)
     if test -n "${item_list}"; then
-        pr_syslog_stdout "11a of ${COLLECTION_COUNT}: Collecting docker container output"
+        pr_syslog_stdout "13a of ${COLLECTION_COUNT}: Collecting docker container output"
         for item in ${item_list}; do
             call_run_command "docker inspect ${item}" "${OUTPUT_FILE_DOCKER}"
         done
     else
-        pr_syslog_stdout "11a of ${COLLECTION_COUNT}: Collecting docker container output skipped"
+        pr_syslog_stdout "13a of ${COLLECTION_COUNT}: Collecting docker container output skipped"
     fi
 
     # call docker inspect for all networks
     item_list=$(docker network ls -q)
     if test -n "${item_list}"; then
-        pr_syslog_stdout "11b of ${COLLECTION_COUNT}: Collecting docker network output"
+        pr_syslog_stdout "13b of ${COLLECTION_COUNT}: Collecting docker network output"
         for item in ${item_list}; do
             call_run_command "docker network inspect ${item}" "${OUTPUT_FILE_DOCKER}"
         done
     else
-        pr_syslog_stdout "11b of ${COLLECTION_COUNT}: Collecting docker network output skipped"
+        pr_syslog_stdout "13b of ${COLLECTION_COUNT}: Collecting docker network output skipped"
     fi
 
     pr_log_stdout " "
@@ -879,7 +938,7 @@ collect_docker() {
 collect_nvme() {
     local NVME
 
-    pr_syslog_stdout "12 of ${COLLECTION_COUNT}: Collecting nvme output"
+    pr_syslog_stdout "14 of ${COLLECTION_COUNT}: Collecting nvme output"
     call_run_command "nvme list" "${OUTPUT_FILE_NVME}"
 
     for NVME in /dev/nvme[0-9]*; do
@@ -1188,6 +1247,10 @@ collect_osaoat
 
 collect_ethtool
 
+collect_tc
+
+collect_bridge
+
 collect_ovs
 
 collect_domain_xml

scripts/dbginfo.sh.1

@@ -60,32 +60,36 @@ Kernel version        = <kernel\-version>
 .br
 Runtime environment   = z/VM
 .PP
-1 of 13: Collecting command output
+1 of 15: Collecting command output
 .PP
-2 of 13: Collecting z/VM command output
+2 of 15: Collecting z/VM command output
 .PP
-3 of 13: Collecting procfs
+3 of 15: Collecting procfs
 .PP
-4 of 13: Collecting sysfs
+4 of 15: Collecting sysfs
 .PP
-5 of 13: Collecting log files
+5 of 15: Collecting log files
 .PP
-6 of 13: Collecting config files
+6 of 15: Collecting config files
 .PP
-7 of 13: Collecting osa oat output skipped \- not available
+7 of 15: Collecting osa oat output skipped \- not available
 .PP
-8 of 13: Collecting ethtool output
+8 of 15: Collecting ethtool output
 .PP
-9 of 13: Collecting OpenVSwitch output
+9 of 15: Collecting tc output
+.pp
+10 of 15: Collecting bridge output
+.pp
+11 of 15: Collecting OpenVSwitch output
 .PP
-10 of 13: Collecting domain xml files
+12 of 15: Collecting domain xml files
 .PP
-11a of 13: Collecting docker container output
-11b of 13: Collecting docker network output
+13a of 15: Collecting docker container output
+13b of 15: Collecting docker network output
 .PP
-12 of 13: Collecting nvme output
+14 of 15: Collecting nvme output
 .PP
-13 of 13: Postprocessing
+15 of 15: Postprocessing
 .PP
 Finalizing: Creating archive with collected data
 .PP

scripts/zfcpdbf

@@ -2,7 +2,7 @@
 #
 # zfcpdbf - Tool to interpret the information from logging/tracing sources
 #
-# Copyright IBM Corp. 2010, 2017
+# Copyright IBM Corp. 2010, 2020
 #
 # s390-tools is free software; you can redistribute it and/or modify
 # it under the terms of the MIT license. See LICENSE for details.
@@ -652,6 +652,47 @@ sub _print_hba_id3
 	}
 }
 
+sub _print_hba_id5
+{
+	my $fsf_req_id = shift();
+	my $rec = shift();
+	my $payload_length = shift();
+	my $rec_received = shift();
+	my $rec_issued;
+
+	$rec_issued  = stck_to_timeval(substr($rec, 0, 16));
+
+	if (defined $timediff) { # do we want to see delayed responses ?
+		my @t_arr = split(/[-:]/, $rec_received);
+
+		my $ts1 = mktime($t_arr[5], $t_arr[4], $t_arr[3],
+				 $t_arr[2], $t_arr[1] - 1, $t_arr[0] - 1900);
+
+		my ($ts2, $us2) = split(/:/, $rec_issued);
+
+		my $ts_received = $ts1 . "." . $t_arr[6];
+		my $ts_issued = $ts2 . "." . $us2;
+
+		if (($ts_received - $ts_issued) >= $timediff) {
+			print "WARNING: delayed response above ",
+			      "skip level of $timediff seconds.\n";
+		}
+	}
+
+	print "FSF issued     : ",str_timestamp($rec_issued),"\n";
+	print "FSF stat       : 0x", substr($rec, 16, 8), "\n";
+	print "FSF stat qual  : n/a\n";
+	print "Prot stat      : n/a\n";
+	print "Prot stat qual : n/a\n";
+
+	print "Port handle    : 0x", substr($rec, 24, 8), "\n";
+	print "LUN handle     : n/a\n";
+
+	print "WWPN           : 0x", substr($rec, 32, 16), "\n";
+	print "FCES old       : 0x", substr($rec, 48, 8), "\n";
+	print "FCES new       : 0x", substr($rec, 56, 8), "\n";
+}
+
 sub print_deferr_common
 {
 	my $rec = shift();
@@ -854,6 +895,7 @@ sub assign_callback_subs
 	$print_hba_id[1] = \&_print_hba_id1;
 	$print_hba_id[2] = \&_print_hba_id2;
 	$print_hba_id[3] = \&_print_hba_id3;
+	$print_hba_id[5] = \&_print_hba_id5;
 
 	$print_rec_id[1] = \&_print_rec_id1;
 	$print_rec_id[2] = \&_print_rec_id2;

zconf/qeth/misc.h

@@ -12,8 +12,6 @@
 
 #include <stdbool.h>
 
-#define ARRAY_SIZE(x)	(sizeof(x) / sizeof(x[0]))
-
 char *misc_link_target(const char *fmt, ...);
 bool misc_str_in_list(const char *str, const char *strings[], int array_size);
 int misc_argz_add_from_file(char **argz, size_t *argz_len,

zconf/zcrypt/chzcrypt.8

@@ -1,8 +1,8 @@
-.\" Copyright 2017 IBM Corp.
+.\" Copyright 2019 IBM Corp.
 .\" s390-tools is free software; you can redistribute it and/or modify
 .\" it under the terms of the MIT license. See LICENSE for details.
 .\"
-.TH CHZCRYPT 8 "OCT 2017" "s390-tools"
+.TH CHZCRYPT 8 "AUG 2019" "s390-tools"
 .SH NAME
 chzcrypt \- modify zcrypt configuration
 .SH SYNOPSIS

zconf/zcrypt/chzcrypt.c

@@ -1,7 +1,7 @@
 /*
  * chzcrypt - Tool to modify zcrypt configuration
  *
- * Copyright IBM Corp. 2008, 2017
+ * Copyright IBM Corp. 2008, 2019
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -47,7 +47,7 @@ const struct util_prg prg = {
 		{
 			.owner = "IBM Corp.",
 			.pub_first = 2008,
-			.pub_last = 2017,
+			.pub_last = 2019,
 		},
 		UTIL_PRG_COPYRIGHT_END
 	}

zconf/zcrypt/lszcrypt.8

@@ -1,6 +1,6 @@
 .\" lszcrypt.8
 .\"
-.\" Copyright 2017 IBM Corp.
+.\" Copyright 2019 IBM Corp.
 .\" s390-tools is free software; you can redistribute it and/or modify
 .\" it under the terms of the MIT license. See LICENSE for details.
 .\"
@@ -10,7 +10,7 @@
 .\"   nroff -man lszcrypt.8
 .\" to process this source
 .\"
-.TH LSZCRYPT 8 "JAN 2019" "s390-tools"
+.TH LSZCRYPT 8 "AUG 2019" "s390-tools"
 .SH NAME
 lszcrypt \- display zcrypt device and configuration information
 .SH SYNOPSIS
@@ -118,7 +118,7 @@ explanation:
 .B TYPE and HWTYPE
 The HWTYPE is a numeric value showing which type of hardware the zcrypt
 device driver presumes that this crypto card is. The currently known values
-are 7=CEX3C, 8=CEX3A, 10=CEX4, 11=CEX5 and 12=CEX6.
+are 7=CEX3C, 8=CEX3A, 10=CEX4, 11=CEX5, 12=CEX6 and 13=CEX7.
 .br
 The TYPE is a human readable value showing the hardware type and the basic
 function type (A=Accelerator, C=CCA Coprocessor, P=EP11 Coprocessor). So
@@ -167,7 +167,7 @@ operations within the guests.
 .B DRIVER
 .br
 Shows which card or queue device driver currently handles this crypto
-resource. Currently known drivers are cex4card/cex4queue (CEX4-CEX6
+resource. Currently known drivers are cex4card/cex4queue (CEX4-CEX7
 hardware), cex2card/cex2cqueue (CEX2C and CEX3C hardware),
 cex2acard/cex2aqueue (CEX2A and CEX3A hardware) and vfio_ap (queue reserved
 for use by kvm hypervisor for kvm guests and not accessible to host

zconf/zcrypt/lszcrypt.c

@@ -1,7 +1,7 @@
 /**
  * lszcrypt - Display zcrypt devices and configuration settings
  *
- * Copyright IBM Corp. 2008, 2018
+ * Copyright IBM Corp. 2008, 2019
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -86,7 +86,7 @@ const struct util_prg prg = {
 		{
 			.owner = "IBM Corp.",
 			.pub_first = 2008,
-			.pub_last = 2018,
+			.pub_last = 2019,
 		},
 		UTIL_PRG_COPYRIGHT_END
 	}
@@ -302,9 +302,10 @@ static void show_capability(const char *id_str)
 			printf("%s\n", CAP_CCA);
 		printf("%s", CAP_RNG);
 		break;
-	case 10:
-	case 11:
-	case 12:
+	case 10: /* CEX4S */
+	case 11: /* CEX5S */
+	case 12: /* CEX6S */
+	case 13: /* CEX7S */
 		if (func_val & MASK_ACCEL) {
 			if (func_val & MASK_RSA4K)
 				printf("%s", CAP_RSA4K);

zconf/zcrypt/zcryptstats.c

@@ -147,8 +147,9 @@ struct chsc_cmb_area {
 #define CRYPTO_TYPE_CEX4S	10
 #define CRYPTO_TYPE_CEX5S	11
 #define CRYPTO_TYPE_CEX6S	12
+#define CRYPTO_TYPE_CEX7S	13
 
-#define CRYPTO_TYPE_TOLERATION	CRYPTO_TYPE_CEX6S
+#define CRYPTO_TYPE_TOLERATION	CRYPTO_TYPE_CEX7S
 
 struct crypto_counter {
 	const char *name;
@@ -235,8 +236,8 @@ const struct crypto_mode mode_pcica[1] = {
 		  .counters = counter_pcica },
 };
 
-#define NUM_CEX456_MODES	11
-const struct crypto_mode mode_cex456[NUM_CEX456_MODES] = {
+#define NUM_CEX4567_MODES	11
+const struct crypto_mode mode_cex4567[NUM_CEX4567_MODES] = {
 		{ 0 },
 		{ 0 },
 		{ 0 },
@@ -256,7 +257,7 @@ const struct crypto_mode mode_cex456[NUM_CEX456_MODES] = {
 		  .counters = counter_ep11 },
 };
 
-#define NUM_CRYPTO_TYPES	13
+#define NUM_CRYPTO_TYPES	14
 const struct crypto_type crypto_types[NUM_CRYPTO_TYPES] = {
 		{ 0 },
 		{ 0 },
@@ -275,12 +276,14 @@ const struct crypto_type crypto_types[NUM_CRYPTO_TYPES] = {
 		  .modes = mode_accel },
 		{ .name = "CEX3C", .num_modes = NUM_COPROC_MODES,
 		  .modes = mode_coproc },
-		{ .name = "CEX4", .num_modes = NUM_CEX456_MODES,
-		  .modes = mode_cex456 },
-		{ .name = "CEX5", .num_modes = NUM_CEX456_MODES,
-		  .modes = mode_cex456 },
-		{ .name = "CEX6", .num_modes = NUM_CEX456_MODES,
-		  .modes = mode_cex456 },
+		{ .name = "CEX4", .num_modes = NUM_CEX4567_MODES,
+		  .modes = mode_cex4567 },
+		{ .name = "CEX5", .num_modes = NUM_CEX4567_MODES,
+		  .modes = mode_cex4567 },
+		{ .name = "CEX6", .num_modes = NUM_CEX4567_MODES,
+		  .modes = mode_cex4567 },
+		{ .name = "CEX7", .num_modes = NUM_CEX4567_MODES,
+		  .modes = mode_cex4567 },
 };
 
 

zdev/dracut/95zdev/module-setup.sh

@@ -32,7 +32,7 @@ depends() {
 installkernel() {
     # Add modules for all device types supported by chzdev (required for
     # auto-configuration)
-    instmods lcs qeth qeth_l2 qeth_l3 dasd_mod dasd_eckd_mod dasd_fba_mod \
+    instmods ctcm lcs qeth qeth_l2 qeth_l3 dasd_mod dasd_eckd_mod dasd_fba_mod \
 	     dasd_diag_mod zfcp
 }
 

zdev/include/attrib.h

@@ -1,7 +1,7 @@
 /*
  * zdev - Modify and display the persistent configuration of devices
  *
- * Copyright IBM Corp. 2016, 2017
+ * Copyright IBM Corp. 2016, 2019
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -181,6 +181,7 @@ struct value_map {
  * @activeonly: This attribute should only be changed in the active config
  * @unstable:   The value read is not the last value written
  * @writeonly:  This attribute cannot be read from
+ * @readonly:   This attribute cannot be written to
  * @rewrite:    Writing the same value multiple times has side-effects
  * @mandatory:	This attribute cannot be removed from a configured device
  * @newline:    There must be a newline when writing to this attribute
@@ -211,6 +212,7 @@ struct attrib {
 	unsigned int activeonly	:1;
 	unsigned int unstable	:1;
 	unsigned int writeonly	:1;
+	unsigned int readonly	:1;
 	unsigned int rewrite	:1;
 	unsigned int mandatory	:1;
 	unsigned int newline	:1;

zdev/include/misc.h

@@ -15,10 +15,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include "lib/zt_common.h"
 #include "lib/util_list.h"
 #include "exit_code.h"
 
-#define ARRAY_SIZE(x)	(sizeof(x) / sizeof((x)[0]))
 #define SCOPE_ACTIVE(x)		((x) & config_active ? 1 : 0)
 #define SCOPE_PERSISTENT(x)	((x) & config_persistent ? 1 : 0)
 #define SCOPE_AUTOCONF(x)	((x) & config_autoconf ? 1 : 0)

zdev/src/device.c

@@ -215,6 +215,9 @@ static exit_code_t apply_setting(struct device *dev, config_t config,
 	/* Check for known attribute. */
 	a = subtype_find_dev_attrib(st, key);
 	if (a) {
+		/* Check for read-only attribute. */
+		if (a->readonly)
+			goto err_readonly;
 		/* Check for acceptable value of known attribute. */
 		if (!force && !attrib_check_value(a, value))
 			goto err_invalid_forceable;
@@ -307,6 +310,10 @@ err_int_noactive:
 	delayed_err("Internal attribute '%s' cannot be set in the active config\n",
 		    key);
 	return EXIT_INVALID_SETTING;
+
+err_readonly:
+	delayed_err("Cannot modify read-only attribute: %s\n", key);
+	return EXIT_INVALID_SETTING;
 }
 
 /* Apply device settings from strlist to device. */
@@ -521,7 +528,7 @@ void device_read_active_settings(struct device *dev, read_scope_t scope)
 		a = attrib_find(st->dev_attribs, name);
 		s = setting_list_apply_actual(dev->active.settings, a, name,
 					      value);
-		if (link || (scope == scope_all &&
+		if ((a && a->readonly) || link || (scope == scope_all &&
 			     util_path_is_readonly_file("%s", path)))
 			s->readonly = 1;
 		if (link)

zdev/src/export.c

@@ -1,7 +1,7 @@
 /*
  * zdev - Modify and display the persistent configuration of devices
  *
- * Copyright IBM Corp. 2016, 2017
+ * Copyright IBM Corp. 2016, 2019
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -71,6 +71,8 @@ static bool is_exportable(struct setting *s, config_t config)
 
 	if (!a)
 		return true;
+	if (a->readonly)
+		return false;
 	if (a->mandatory)
 		return true;
 	if (SCOPE_ACTIVE(config)) {

zdev/src/table_attribs.c

@@ -1,7 +1,7 @@
 /*
  * zdev - Modify and display the persistent configuration of devices
  *
- * Copyright IBM Corp. 2016, 2017
+ * Copyright IBM Corp. 2016, 2019
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -186,13 +186,15 @@ static void table_attribs_show_details_one(struct table_attrib *t,
 		indent(j, "The default value is '%s'.\n", a->defval);
 	}
 
-	printf("\n");
-	indent(i, "ACCEPTED VALUES\n");
-	attrib_print_acceptable(a, j);
+	if (!a->readonly) {
+		printf("\n");
+		indent(i, "ACCEPTED VALUES\n");
+		attrib_print_acceptable(a, j);
+	}
 
 	if (!(a->multi || a->activeonly || a->unstable || a->writeonly ||
 	      a->rewrite || a->mandatory || a->newline || a->activerem ||
-	      a->nounload || a->check))
+	      a->nounload || a->check || a->readonly))
 		return;
 
 	printf("\n");
@@ -211,6 +213,8 @@ static void table_attribs_show_details_one(struct table_attrib *t,
 	}
 	if (a->writeonly)
 		indent(j, "- You cannot read this attribute\n");
+	if (a->readonly)
+		indent(j, "- You cannot write to this attribute\n");
 	if (a->rewrite) {
 		indent(j, "- Setting the same value multiple times may have "
 		       "additional effects\n");

zdev/src/zfcp_host.c

@@ -70,6 +70,27 @@ static struct attrib zfcp_host_attr_port_rescan = {
 	.accept = ACCEPT_ARRAY(ACCEPT_NUM(1)),
 };
 
+static struct attrib zfcp_host_attr_fc_security = {
+	.name = "fc_security",
+	.title = "Show FC Endpoint Security capability of FCP device",
+	.desc =
+	"This read-only attribute shows the Fibre Channel Endpoint Security\n"
+	"capabilities of the FCP device.\n"
+	"\n"
+	"Possible values are either one of the following:\n"
+	"  unknown       : The Fibre Channel Endpoint Security capabilities\n"
+	"                  of the FCP device are not known\n"
+	"  unsupported   : The FCP device does not support Fibre Channel\n"
+	"                  Endpoint Security\n"
+	"  none          : The FCP device does not report any Fibre Channel\n"
+	"                  Endpoint Security capabilities\n"
+	"\n"
+	"Or one or more comma-separated values:\n"
+	"  Authentication: The FCP device supports authentication\n"
+	"  Encryption    : The FCP device supports encryption\n",
+	.readonly = 1,
+};
+
 /*
  * zfcp host methods.
  */
@@ -248,6 +269,7 @@ struct subtype zfcp_host_subtype = {
 		&zfcp_host_attr_failed,
 		&zfcp_host_attr_port_remove,
 		&zfcp_host_attr_port_rescan,
+		&zfcp_host_attr_fc_security,
 		&internal_attr_early,
 	),
 	.unknown_dev_attribs	= 1,

zdev/src/zfcp_lun.c

@@ -33,6 +33,7 @@
 #include "zfcp_lun.h"
 
 #define DEVNAME			"zFCP LUN"
+#define FC_SECURITY_VATTR	"fc_security"
 
 /*
  * zfcp lun namespace.
@@ -415,6 +416,24 @@ static struct attrib zfcp_lun_attr_scsi_delete = {
 	.accept = ACCEPT_ARRAY(ACCEPT_NUM(1)),
 };
 
+static struct attrib zfcp_lun_attr_fc_security = {
+	.name = FC_SECURITY_VATTR,
+	.title = "Show FC Endpoint Security state of connection",
+	.desc =
+	"This read-only attribute shows the current state of Fibre Channel\n"
+	"Endpoint Security of the connection between the FCP device and the\n"
+	"FC remote port used to access the LUN:\n"
+	"  unknown       : The Fibre Channel Endpoint Security state of the\n"
+	"                  connection is not known\n"
+	"  unsupported   : The FCP device does not support Fibre Channel\n"
+	"                  Endpoint Security\n"
+	"  none          : The connection has no Fibre Channel Endpoint\n"
+	"                  Security\n"
+	"  Authentication: The connection has been authenticated\n"
+	"  Encryption    : The connection is encrypted\n",
+	.readonly = 1,
+};
+
 /*
  * zfcp lun device methods.
  */
@@ -761,10 +780,8 @@ static char *zfcp_lun_st_get_active_attrib_path(struct subtype *st,
 	char *hctl, *devpath, *path;
 	size_t len = strlen(SCSI_ATTR_PREFIX);
 
-	if (!starts_with(name, SCSI_ATTR_PREFIX) ||
-	    !(name[len] == 0 || name[len] == '/' ))
-		devpath = path_get_zfcp_lun_dev(dev->devid);
-	else {
+	if (starts_with(name, SCSI_ATTR_PREFIX) &&
+	    (name[len] == 0 || name[len] == '/')) {
 		hctl = scsi_hctl_from_zfcp_lun_devid(dev->devid);
 		if (!hctl)
 			return NULL;
@@ -772,6 +789,14 @@ static char *zfcp_lun_st_get_active_attrib_path(struct subtype *st,
 		free(hctl);
 
 		name += strlen(SCSI_ATTR_PREFIX);
+	} else if (strcmp(name, FC_SECURITY_VATTR) == 0) {
+		devpath = path_get_zfcp_port_dev(dev->devid);
+		if (!util_path_exists(devpath)) {
+			free(devpath);
+			return NULL;
+		}
+	} else {
+		devpath = path_get_zfcp_lun_dev(dev->devid);
 	}
 
 	while (*name == '/')
@@ -1101,6 +1126,7 @@ struct subtype zfcp_lun_subtype = {
 		&zfcp_lun_attr_scsi_timeout,
 		&zfcp_lun_attr_scsi_state,
 		&zfcp_lun_attr_scsi_delete,
+		&zfcp_lun_attr_fc_security,
 		&internal_attr_early,
 	),
 	.prefixes = STRING_ARRAY(SCSI_ATTR_PREFIX),

zdump/df_elf.h

@@ -15,6 +15,8 @@
 #include <elf.h>
 #include <linux/types.h>
 
+#include "lib/zt_common.h"
+
 #include "dfo.h"
 #include "zg.h"
 
@@ -80,7 +82,7 @@ struct nt_prstatus_64 {
 	u64	orig_gpr2;
 	u32	pr_fpvalid;
 	u8	pad3[4];
-} __attribute__ ((packed));
+} __packed;
 
 /*
  * fpregset ELF Note
@@ -89,7 +91,7 @@ struct nt_fpregset_64 {
 	u32	fpc;
 	u32	pad;
 	u64	fprs[16];
-} __attribute__ ((packed));
+} __packed;
 
 /*
  * prpsinfo ELF Note

zdump/df_lkcd.h

@@ -12,6 +12,8 @@
 #ifndef DF_LKCD_H
 #define DF_LKCD_H
 
+#include "lib/zt_common.h"
+
 #define DF_LKCD_MAGIC		0xa8190173618f23edULL
 #define DF_LKCD_MAGIC_ASM	0x733339302d64756dULL
 #define DF_LKCD_VERSION		0x8	/* dump version number */
@@ -53,7 +55,7 @@ struct df_lkcd_hdr {
 	u32	dump_compress;
 	u32	dump_flags;
 	u32	dump_device;
-} __attribute__((packed));
+} __packed;
 
 /*
  * s390 LKCD asm header
@@ -65,7 +67,7 @@ struct df_lkcd_hdr_asm {
 	u16	cpu_cnt;
 	u16	real_cpu_cnt;
 	u32	lc_vec[512];
-} __attribute__((packed));
+} __packed;
 
 /*
  * Page header
@@ -74,6 +76,6 @@ struct df_lkcd_pg_hdr {
 	u64	addr;	/* Address of dump page */
 	u32	size;	/* Size of dump page */
 	u32	flags;	/* flags (DF_LKCD_COMPRESSED, DF_LKCD_RAW,...) */
-} __attribute__((packed));
+} __packed;
 
 #endif /* DF_LKCD_H */

zdump/df_s390.h

@@ -12,6 +12,8 @@
 #ifndef DF_S390_H
 #define DF_S390_H
 
+#include "lib/zt_common.h"
+
 #include "dt.h"
 #include "zg.h"
 
@@ -59,7 +61,7 @@ struct df_s390_hdr {
 	u64	mvdump_zipl_time;		/* 0x208 */
 	u8	end_pad2[0x800-0x210];		/* 0x210 */
 	u32	lc_vec[DF_S390_CPU_MAX];	/* 0x800 */
-} __attribute__((packed));
+} __packed;
 
 /*
  *  End marker: Should be at the end of every valid s390 crash dump.
@@ -67,7 +69,7 @@ struct df_s390_hdr {
 struct df_s390_em {
 	char	str[8];
 	u64	tod;
-} __attribute__((packed));
+} __packed;
 
 /*
  * Segment header for s390 extended dump format
@@ -77,7 +79,7 @@ struct df_s390_dump_segm_hdr {
 	u64	len;
 	u64	stop_marker;
 	u8	reserved[0x1000 - 24];
-} __attribute__((packed));
+} __packed;
 
 /*
  * Convert DFI arch to s390 arch
@@ -118,7 +120,7 @@ struct df_s390_dumper {
 	u32	size;
 	u8	force;
 	u64	mem;
-} __attribute__ ((packed));
+} __packed;
 
 /*
  * s390 dump helpers