New release s390-tools-2.23.0

Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

AUTHORS.md

@@ -9,6 +9,7 @@ List of all individuals having contributed content to s390-tools
 - Antoinette Kaschner
 - Arnd Bergmann
 - Axel Wirbser
+- Balint Reczey
 - Benjamin Block
 - Brian C. Lane
 - Carsten Otte

CHANGELOG.md

@@ -1,5 +1,30 @@
 Release history for s390-tools (MIT version)
 --------------------------------------------
+
+* __v2.23.0 (2022-08-18)__
+
+  For Linux kernel version: 5.19
+
+  Changes of existing tools:
+  - Makefile: use common Make definition for DRACUTDIR
+  - Makefile: use common Make definition for UDEVDIR and UDEVRULESDIR
+  - cpacfstats: Add PAI and hotplug support
+  - cpumf/pai: Omit file write progress information
+  - dbginfo.sh: Get more details on lspci command
+  - dumpconf: Prevent running the service in containers
+  - libcpumf: Detect PMU named pai_ext
+  - pvattest: Improve error reporting and logging
+  - zdev: Add some --type ap examples to manpages
+  - zkey: Use default benchmarked Argon2i with LUKS2
+
+  Bug Fixes:
+  - dbginfo.sh: Fix accidental ftrace buffer shrinkage/free
+  - genprotimg: Fix BIO_reset() returncode handling
+  - libpv: Fix dependency checking
+  - pvattest: Fix dependency checking
+  - zipl: Fix segmentation fault when no parmline is provided
+
+
 * __v2.22.0 (2022-06-20)__
 
   For Linux kernel version: 5.18

README.md

@@ -306,7 +306,6 @@ build options:
 |                |                    | hsavmcore                             |
 | zlib           | `HAVE_ZLIB`        | zgetdump, dump2tar                    |
 | ncurses        | `HAVE_NCURSES`     | hyptop                                |
-| pfm            | `HAVE_PFM`         | cpacfstats                            |
 | net-snmp       | `HAVE_SNMP`        | osasnmpd                              |
 | glibc-static   | `HAVE_LIBC_STATIC` | zfcpdump                              |
 | openssl        | `HAVE_OPENSSL`     | genprotimg, zkey, libekmfweb,         |
@@ -320,6 +319,7 @@ build options:
 | libxml2        | `HAVE_LIBXML2`     | libkmipclient                         |
 | systemd        | `HAVE_SYSTEMD`     | hsavmcore                             |
 | liblockfile    | `HAVE_LOCKFILE`    | ap-check                              |
+| libudev        | `HAVE_LIBUDEV`     | cpacfstatsd                           |
 
 This table lists additional build or install options:
 
@@ -403,14 +403,13 @@ the different tools are provided:
   As of s390-tools-1.13.0, the minimum required kernel level is 2.6.38.
 
 * cpacfstats:
-  For building the cpacfstats tools you need libpfm version 4 or
-  newer installed (libpfm-devel.rpm). Tip: you may skip the cpacfstats
-  build by adding `HAVE_PFN=0` to the make invocation. To run the
-  cpacfstats daemon the kernel needs to have performance
-  events enabled (check for `CONFIG_PERF_EVENTS=y`) and you need libpfm
-  version 4 or newer installed. A new group 'cpacfstats' needs to be
-  created and all users intending to use the tool should be added to
-  this group.
+  For building the cpacfstats tools you need libudev installed
+  (systemd-devel.rpm). Tip: you may skip the cpacfstats build by
+  adding `HAVE_LIBUDEV=0` to the make invocation. To run the
+  cpacfstats daemon the kernel needs to have performance events
+  enabled (check for `CONFIG_PERF_EVENTS=y`). A new group 'cpacfstats'
+  needs to be created and all users intending to use the tool should
+  be added to this group.
 
 * zdev:
   Depending on the boot loader and initial RAM-disk mechanism used by a

chreipl-fcp-mpath/chreipl-fcp-mpath.mak

@@ -27,11 +27,7 @@ ENABLE_DOC	 = 0
 
 # https://www.gnu.org/software/make/manual/make.html#Directory-Variables
 CHREIPLZFCPMPDIR = $(USRLIBDIR)/chreipl-fcp-mpath
-UDEVDIR		 = $(USRLIBDIR)/udev
-UDEVRULESDIR	 = $(UDEVDIR)/rules.d
 UDEVRUNDIR	 = /run/udev
-DRACUTDIR	 = $(USRLIBDIR)/dracut
-DRACUTCONFDIR	 = $(DRACUTDIR)/dracut.conf.d
 DEBUGOUTDIR	 = $(UDEVRUNDIR)
 
 INSTALL_EXEC	 = $(INSTALL) -g $(GROUP) -o $(OWNER) --preserve-timestamps

common.mak

@@ -5,7 +5,7 @@ COMMON_INCLUDED = true
 # The variable "DISTRELEASE" should be overwritten in rpm spec files with:
 # "make DISTRELEASE=%{release}" and "make install DISTRELEASE=%{release}"
 VERSION            = 2
-RELEASE            = 22
+RELEASE            = 23
 PATCHLEVEL         = 0
 DISTRELEASE        = build-$(shell date +%Y%m%d)
 S390_TOOLS_RELEASE = $(VERSION).$(RELEASE).$(PATCHLEVEL)-$(DISTRELEASE)
@@ -91,7 +91,7 @@ ifneq ("${V}","1")
 else
 	echocmd=
 endif
-DEFAULT_CFLAGS = -g -rdynamic -fstack-protector-all -W -Wall -Wformat-security
+DEFAULT_CFLAGS = -g -fstack-protector-all -W -Wall -Wformat-security
 ifeq ("${W}","1")
 	DEFAULT_CFLAGS += -Wextra -Wshadow -Wundef -Wuninitialized -Wdouble-promotion -Wconversion
 endif
@@ -193,6 +193,11 @@ ZFCPDUMP_DIR    = $(TOOLS_LIBDIR)/zfcpdump
 SYSTEMDSYSTEMUNITDIR =
 USRINCLUDEDIR   = $(INSTALLDIR)/usr/include
 ZKEYKMSPLUGINDIR = $(USRLIB64DIR)/zkey
+UDEVDIR		= $(USRLIBDIR)/udev
+UDEVRULESDIR	= $(UDEVDIR)/rules.d
+DRACUTDIR	= $(USRLIBDIR)/dracut
+DRACUTCONFDIR   = $(DRACUTDIR)/dracut.conf.d
+DRACUTMODDIR	= $(DRACUTDIR)/modules.d
 
 ifeq ($(LIBDIR),$(INSTALLDIR)/lib)
 SOINSTALLDIR = $(USRLIB64DIR)

cpacfstats/Makefile

@@ -1,11 +1,28 @@
 include ../common.mak
 
+ifeq (${HAVE_LIBUDEV},0)
+
+all:
+	$(SKIP) HAVE_LIBUDEV=0
+
+install:
+	$(SKIP) HAVE_LIBUDEV=0
+
+else
+
+check_dep:
+	$(call check_dep, \
+		"cpacfstatsd", \
+		"libudev.h", \
+		"systemd-devel", \
+		"HAVE_LIBUDEV=0")
+
 ALL_CPPFLAGS += -DVERSION=$(VERSION)
 
-all:		cpacfstats cpacfstatsd
+all:		check_dep cpacfstats cpacfstatsd
 
 cpacfstatsd:	cpacfstatsd.o stats_sock.o perf_crypto.o
-		$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
+		$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -ludev -lpthread -o $@
 
 cpacfstats:	cpacfstats.o stats_sock.o
 		$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
@@ -16,6 +33,8 @@ install: 	all
 		$(INSTALL) -m 644 cpacfstatsd.8 $(DESTDIR)$(MANDIR)/man8
 		$(INSTALL) -m 644 cpacfstats.1  $(DESTDIR)$(MANDIR)/man1
 
+endif
+
 clean:
 		rm -f *.o *~ cpacfstatsd cpacfstats
 

cpacfstats/cpacfstats.1

@@ -1,6 +1,6 @@
 .\" cpacfstats.1
 .\"
-.\" Copyright IBM Corp. 2015, 2020
+.\" Copyright IBM Corp. 2015, 2022
 .\" s390-tools is free software; you can redistribute it and/or modify
 .\" it under the terms of the MIT license. See LICENSE for details.
 .\"
@@ -32,7 +32,9 @@ cpacfstats \- enable, disable and display CPACF statistical data
 .RB ]
 .RB [ \-p | \-\-print
 .I counter
+.RB [ \-n | \-\-nonzero]
 .RB ]
+.RB [ \-j | \-\-json ]
 .
 .SH DESCRIPTION
 The cpacfstats client application interacts with the cpacfstatsd daemon and
@@ -44,12 +46,347 @@ All counters are initially disabled and must be switched on to measure
 CPACF activities of the system. There is a slight performance penalty with
 CPACF counters enabled.
 
-Note: All cryptographic counters are bound to physical CPUs. If you use
-dedicated CPUs for your LPAR, you obtain only your CPACF activities. If
-your CPUs are shared with other LPARs, their cryptographic activities might
-distort the results. CPACF performance counters are available on LPARs
-only. For security reasons only members of the group \fIcpacfstats\fR are
-allowed to run the cpacfstats client application.
+CPACF activity counters come in two flavors: CPU-MF and PAI.  CPU-MF
+counters are only available on LPARs and have to be authorized.  If
+they are available, the counters
+.B des,
+.B aes,
+.B sha,
+.B rng,
+and
+.B ecc
+are made available.  These counters can individually be activated,
+reset, printed, or deactivated.  PAI counters are a lot more detailed.
+The user interface only offers the counters
+.B pai_user
+and
+.B pai_kernel
+to count CPACF usage in user-space or kernel-space.  When printing
+these counters, detailed counters are shown.  The detailed names are:
+.RS
+.IP \(bu
+KM DES,
+.IP \(bu
+KM 2key TDES,
+.IP \(bu
+KM TDES,
+.IP \(bu
+KM DES protected key,
+.IP \(bu
+KM 2key TDES protected key,
+.IP \(bu
+KM TDES protected key,
+.IP \(bu
+KM AES 128bit,
+.IP \(bu
+KM AES 192bit,
+.IP \(bu
+KM AES 256bit,
+.IP \(bu
+KM AES 128bit protected key,
+.IP \(bu
+KM AES 192bit protected key,
+.IP \(bu
+KM AES 256bit protected key,
+.IP \(bu
+KM AES-XTS 128bit,
+.IP \(bu
+KM AES-XTS 256bit,
+.IP \(bu
+KM AES-XTS 128bit protected key,
+.IP \(bu
+KM AES-XTS 256bit protected key,
+.IP \(bu
+KMC DES,
+.IP \(bu
+KMC 2key TDES,
+.IP \(bu
+KMC TDES,
+.IP \(bu
+KMC DES protected key,
+.IP \(bu
+KMC 2key TDES protected key,
+.IP \(bu
+KMC TDES protected key,
+.IP \(bu
+KMC AES 128bit,
+.IP \(bu
+KMC AES 192bit,
+.IP \(bu
+KMC AES 256bit,
+.IP \(bu
+KMC AES 128bit protected key,
+.IP \(bu
+KMC AES 192bit protected key,
+.IP \(bu
+KMC AES 256bit protected key,
+.IP \(bu
+KMC PRNG,
+.IP \(bu
+KMA AES 128bit,
+.IP \(bu
+KMA AES 192bit,
+.IP \(bu
+KMA AES 256bit,
+.IP \(bu
+KMA AES 128bit protected key,
+.IP \(bu
+KMA AES 192bit protected key,
+.IP \(bu
+KMA AES 256bit protected key,
+.IP \(bu
+KMF DES,
+.IP \(bu
+KMF 2key TDES,
+.IP \(bu
+KMF TDES,
+.IP \(bu
+KMF DES protected key,
+.IP \(bu
+KMF 2key TDES protected key,
+.IP \(bu
+KMF TDES protected key,
+.IP \(bu
+KMF AES 128bit,
+.IP \(bu
+KMF AES 192bit,
+.IP \(bu
+KMF AES 256bit,
+.IP \(bu
+KMF AES 128bit protected key,
+.IP \(bu
+KMF AES 192bit protected key,
+.IP \(bu
+KMF AES 256bit protected key,
+.IP \(bu
+KMCTR DES,
+.IP \(bu
+KMCTR 2key TDES,
+.IP \(bu
+KMCTR TDES,
+.IP \(bu
+KMCTR DES protected key,
+.IP \(bu
+KMCTR 2key TDES protected key,
+.IP \(bu
+KMCTR TDES protected key,
+.IP \(bu
+KMCTR AES 128bit,
+.IP \(bu
+KMCTR AES 192bit,
+.IP \(bu
+KMCTR AES 256bit,
+.IP \(bu
+KMCTR AES 128bit protected key,
+.IP \(bu
+KMCTR AES 192bit protected key,
+.IP \(bu
+KMCTR AES 256bit protected key,
+.IP \(bu
+KMO DES,
+.IP \(bu
+KMO 2key TDES,
+.IP \(bu
+KMO TDES,
+.IP \(bu
+KMO DES protected key,
+.IP \(bu
+KMO 2key TDES protected key,
+.IP \(bu
+KMO TDES protected key,
+.IP \(bu
+KMO AES 128bit,
+.IP \(bu
+KMO AES 192bit,
+.IP \(bu
+KMO AES 256bit,
+.IP \(bu
+KMO AES 128bit protected key,
+.IP \(bu
+KMO AES 192bit protected key,
+.IP \(bu
+KMO AES 256bit protected key,
+.IP \(bu
+KIMD SHA1,
+.IP \(bu
+KIMD SHA256,
+.IP \(bu
+KIMD SHA512,
+.IP \(bu
+KIMD SHA3-224,
+.IP \(bu
+KIMD SHA3-256,
+.IP \(bu
+KIMD SHA3-384,
+.IP \(bu
+KIMD SHA3-512,
+.IP \(bu
+KIMD SHAKE 128,
+.IP \(bu
+KIMD SHAKE 256,
+.IP \(bu
+KIMD GHASH,
+.IP \(bu
+KLMD SHA1,
+.IP \(bu
+KLMD SHA256,
+.IP \(bu
+KLMD SHA512,
+.IP \(bu
+KLMD SHA3-224,
+.IP \(bu
+KLMD SHA3-256,
+.IP \(bu
+KLMD SHA3-384,
+.IP \(bu
+KLMD SHA3-512,
+.IP \(bu
+KLMD SHAKE 128,
+.IP \(bu
+KLMD SHAKE 256,
+.IP \(bu
+KMAC DES,
+.IP \(bu
+KMAC 2key TDES,
+.IP \(bu
+KMAC TDES,
+.IP \(bu
+KMAC DES protected key,
+.IP \(bu
+KMAC 2key TDES protected key,
+.IP \(bu
+KMAC TDES protected key,
+.IP \(bu
+KMAC AES 128bit,
+.IP \(bu
+KMAC AES 192bit,
+.IP \(bu
+KMAC AES 256bit,
+.IP \(bu
+KMAC AES 128bit protected key,
+.IP \(bu
+KMAC AES 192bit protected key,
+.IP \(bu
+KMAC AES 256bit protected key,
+.IP \(bu
+PCC Last Block CMAC DES,
+.IP \(bu
+PCC Last Block CMAC 2key TDES,
+.IP \(bu
+PCC Last Block CMAC TDES,
+.IP \(bu
+PCC Last Block CMAC DES protected key,
+.IP \(bu
+PCC Last Block CMAC 2key TDES protected key,
+.IP \(bu
+PCC Last Block CMAC TDES protected key,
+.IP \(bu
+PCC Last Block CMAC AES 128bit,
+.IP \(bu
+PCC Last Block CMAC AES 192bit,
+.IP \(bu
+PCC Last Block CMAC AES 256bit,
+.IP \(bu
+PCC Last Block CMAC AES 128bit protected key,
+.IP \(bu
+PCC Last Block CMAC AES 192bit protected key,
+.IP \(bu
+PCC Last Block CMAC AES 256bit protected key,
+.IP \(bu
+PCC XTS Parameter AES 128bit,
+.IP \(bu
+PCC XTS Parameter AES 256bit,
+.IP \(bu
+PCC XTS Parameter AES 128bit protected key,
+.IP \(bu
+PCC XTS Parameter AES 256bit protected key,
+.IP \(bu
+PCC Scalar Mult P256,
+.IP \(bu
+PCC Scalar Mult P384,
+.IP \(bu
+PCC Scalar Mult P521,
+.IP \(bu
+PCC Scalar Mult Ed25519,
+.IP \(bu
+PCC Scalar Mult Ed448,
+.IP \(bu
+PCC Scalar Mult X25519,
+.IP \(bu
+PCC Scalar Mult X448,
+.IP \(bu
+PRNO SHA512 DRNG,
+.IP \(bu
+PRNO TRNG Query Ratio,
+.IP \(bu
+PRNO TRNG,
+.IP \(bu
+KDSA ECDSA Verify P256,
+.IP \(bu
+KDSA ECDSA Verify P384,
+.IP \(bu
+KDSA ECDSA Verify P521,
+.IP \(bu
+KDSA ECDSA Sign P256,
+.IP \(bu
+KDSA ECDSA Sign P384,
+.IP \(bu
+KDSA ECDSA Sign P521,
+.IP \(bu
+KDSA ECDSA Sign P256 protected key,
+.IP \(bu
+KDSA ECDSA Sign P384 protected key,
+.IP \(bu
+KDSA ECDSA Sign P521 protected key,
+.IP \(bu
+KDSA EdDSA Verify Ed25519,
+.IP \(bu
+KDSA EdDSA Verify Ed448,
+.IP \(bu
+KDSA EdDSA Sign Ed25519,
+.IP \(bu
+KDSA EdDSA Sign Ed448,
+.IP \(bu
+KDSA EdDSA Sign Ed25519 protected key,
+.IP \(bu
+KDSA EdDSA Sign Ed448 protected key,
+.IP \(bu
+PCKMO DES,
+.IP \(bu
+PCKMO 2key TDES,
+.IP \(bu
+PCMKO TDES,
+.IP \(bu
+PCKMO AES 128bit,
+.IP \(bu
+PCKMO AES 192bit,
+.IP \(bu
+PCMKO AES 256bit,
+.IP \(bu
+PCKMO ECC P256,
+.IP \(bu
+PCKMO ECC P384,
+.IP \(bu
+PCKMO ECC P521,
+.IP \(bu
+PCKMO ECC Ed25519,
+.IP \(bu
+PCKMO ECC Ed448,
+.IP \(bu
+Reserved 1, and
+.IP \(bu
+Reserved 2.
+.RE
+Note that the counters starting with PCKMO and Reserved are only
+available in the pai_kernel set.  Also note that the counters are
+designed to count successful operations.  In the case of KMA this
+means only complete GCM operations including final hashing are
+counted.
+
+Note: CPU-MF based CPACF performance counters are available on LPARs
+only. PAI counters are available on all hypervisors. For security
+reasons only members of the group \fIcpacfstats\fR are allowed to run
+the cpacfstats client application.
 
 Example usage scenario:
 .P
@@ -101,12 +438,34 @@ argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
 \fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
 performance counters are reset to 0.
 .TP
-\fB\-p\fR or \fB\-\-print\fR [counter]
+\fB\-p\fR or \fB\-\-print\fR  [\fB\-n\fR or \fB\-\-nonzero\fR] [counter]
 Display the value of one or all CPACF performance counters. The
 optional counter argument can be one of: \fBdes\fR, \fBaes\fR,
-\fBsha\fR, \fBprng\fR, \fBecc\fR, or \fBall\fR. If the counter
-argument is omitted or if there is no argument, all performance
-counters are displayed.
+\fBsha\fR, \fBprng\fR, \fBecc\fR, \fBpai_user\fR, \fBpai_kernel\fR, or
+\fBall\fR. If the counter argument is omitted or if there is no
+argument, all performance counters are displayed.  If the optional
+\fB\-n\fR or \fB\-\-nonzero\fR argument is given, then only PAI
+counters that have a non-zero value are printed.
+.TP
+\fB\-j\fR or \fB\-\-json\fR
+Display all activated counters in JSON format.  The JSON contains an
+array of counter objects.  Each object contains the property
+.B counter
+specifying either a CPU-MF counter of one of the detailed PAI counter.
+Additional properties include
+.B error
+an error number if the counter could not be read,
+.B value
+the counter value if the counter could be read,
+.B space
+for PAI counters to specify
+.B user
+or
+.B kernel
+space counter set, and
+.B counterid
+for PAI counters to specify the PAI counter number as specified in the
+Principles of Operation.
 .TP
 The default command is --print all.
 .

cpacfstats/cpacfstats.c

@@ -3,7 +3,7 @@
  *
  * cpacfstats client implementation
  *
- * Copyright IBM Corp. 2015, 2020
+ * Copyright IBM Corp. 2015, 2022
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -39,17 +39,187 @@ static const char *const usage =
 	"\t-d, --disable [counter]   Disable one or all counters\n"
 	"\t-r, --reset   [counter]   Reset one or all counter values\n"
 	"\t-p, --print   [counter]   Print one or all counter values\n"
-	"\tcounter can be: 'aes' 'des' 'rng' 'sha' 'ecc' or 'all'\n";
+	"\t-n, --nonzero             Print all PAI counters\n"
+	"\t-j, --json                Print all counter values in JSON format\n"
+	"\tcounter can be: 'aes' 'des' 'rng' 'sha' 'ecc'\n"
+	"\t                'pai_user' 'pai_kernel' or 'all'\n";
 
 static const char *const counter_str[] = {
 	[DES_FUNCTIONS]  = "des",
 	[AES_FUNCTIONS]  = "aes",
 	[SHA_FUNCTIONS]  = "sha",
 	[PRNG_FUNCTIONS] = "rng",
-	[ECC_FUNCTIONS] = "ecc",
-	[ALL_COUNTER]    = "all"
+	[ECC_FUNCTIONS]  = "ecc",
+	[ALL_COUNTER]    = "all",
+	[PAI_USER]       = "pai_user",
+	[PAI_KERNEL]     = "pai_kernel"
 };
 
+/* Strings for the pai counter details.  Note that this is 0-based
+ * while PoP is 1-based.
+ */
+static const char *const pai_str[] = {
+	[  0] = "KM DES",
+	[  1] = "KM 2key TDES",
+	[  2] = "KM TDES",
+	[  3] = "KM DES protected key",
+	[  4] = "KM 2key TDES protected key",
+	[  5] = "KM TDES protected key",
+	[  6] = "KM AES 128bit",
+	[  7] = "KM AES 192bit",
+	[  8] = "KM AES 256bit",
+	[  9] = "KM AES 128bit protected key",
+	[ 10] = "KM AES 192bit protected key",
+	[ 11] = "KM AES 256bit protected key",
+	[ 12] = "KM AES-XTS 128bit",
+	[ 13] = "KM AES-XTS 256bit",
+	[ 14] = "KM AES-XTS 128bit protected key",
+	[ 15] = "KM AES-XTS 256bit protected key",
+	[ 16] = "KMC DES",
+	[ 17] = "KMC 2key TDES",
+	[ 18] = "KMC TDES",
+	[ 19] = "KMC DES protected key",
+	[ 20] = "KMC 2key TDES protected key",
+	[ 21] = "KMC TDES protected key",
+	[ 22] = "KMC AES 128bit",
+	[ 23] = "KMC AES 192bit",
+	[ 24] = "KMC AES 256bit",
+	[ 25] = "KMC AES 128bit protected key",
+	[ 26] = "KMC AES 192bit protected key",
+	[ 27] = "KMC AES 256bit protected key",
+	[ 28] = "KMC PRNG",
+	[ 29] = "KMA AES 128bit",
+	[ 30] = "KMA AES 192bit",
+	[ 31] = "KMA AES 256bit",
+	[ 32] = "KMA AES 128bit protected key",
+	[ 33] = "KMA AES 192bit protected key",
+	[ 34] = "KMA AES 256bit protected key",
+	[ 35] = "KMF DES",
+	[ 36] = "KMF 2key TDES",
+	[ 37] = "KMF TDES",
+	[ 38] = "KMF DES protected key",
+	[ 39] = "KMF 2key TDES protected key",
+	[ 40] = "KMF TDES protected key",
+	[ 41] = "KMF AES 128bit",
+	[ 42] = "KMF AES 192bit",
+	[ 43] = "KMF AES 256bit",
+	[ 44] = "KMF AES 128bit protected key",
+	[ 45] = "KMF AES 192bit protected key",
+	[ 46] = "KMF AES 256bit protected key",
+	[ 47] = "KMCTR DES",
+	[ 48] = "KMCTR 2key TDES",
+	[ 49] = "KMCTR TDES",
+	[ 50] = "KMCTR DES protected key",
+	[ 51] = "KMCTR 2key TDES protected key",
+	[ 52] = "KMCTR TDES protected key",
+	[ 53] = "KMCTR AES 128bit",
+	[ 54] = "KMCTR AES 192bit",
+	[ 55] = "KMCTR AES 256bit",
+	[ 56] = "KMCTR AES 128bit protected key",
+	[ 57] = "KMCTR AES 192bit protected key",
+	[ 58] = "KMCTR AES 256bit protected key",
+	[ 59] = "KMO DES",
+	[ 60] = "KMO 2key TDES",
+	[ 61] = "KMO TDES",
+	[ 62] = "KMO DES protected key",
+	[ 63] = "KMO 2key TDES protected key",
+	[ 64] = "KMO TDES protected key",
+	[ 65] = "KMO AES 128bit",
+	[ 66] = "KMO AES 192bit",
+	[ 67] = "KMO AES 256bit",
+	[ 68] = "KMO AES 128bit protected key",
+	[ 69] = "KMO AES 192bit protected key",
+	[ 70] = "KMO AES 256bit protected key",
+	[ 71] = "KIMD SHA1",
+	[ 72] = "KIMD SHA256",
+	[ 73] = "KIMD SHA512",
+	[ 74] = "KIMD SHA3-224",
+	[ 75] = "KIMD SHA3-256",
+	[ 76] = "KIMD SHA3-384",
+	[ 77] = "KIMD SHA3-512",
+	[ 78] = "KIMD SHAKE 128",
+	[ 79] = "KIMD SHAKE 256",
+	[ 80] = "KIMD GHASH",
+	[ 81] = "KLMD SHA1",
+	[ 82] = "KLMD SHA256",
+	[ 83] = "KLMD SHA512",
+	[ 84] = "KLMD SHA3-224",
+	[ 85] = "KLMD SHA3-256",
+	[ 86] = "KLMD SHA3-384",
+	[ 87] = "KLMD SHA3-512",
+	[ 88] = "KLMD SHAKE 128",
+	[ 89] = "KLMD SHAKE 256",
+	[ 90] = "KMAC DES",
+	[ 91] = "KMAC 2key TDES",
+	[ 92] = "KMAC TDES",
+	[ 93] = "KMAC DES protected key",
+	[ 94] = "KMAC 2key TDES protected key",
+	[ 95] = "KMAC TDES protected key",
+	[ 96] = "KMAC AES 128bit",
+	[ 97] = "KMAC AES 192bit",
+	[ 98] = "KMAC AES 256bit",
+	[ 99] = "KMAC AES 128bit protected key",
+	[100] = "KMAC AES 192bit protected key",
+	[101] = "KMAC AES 256bit protected key",
+	[102] = "PCC Last Block CMAC DES",
+	[103] = "PCC Last Block CMAC 2key TDES",
+	[104] = "PCC Last Block CMAC TDES",
+	[105] = "PCC Last Block CMAC DES protected key",
+	[106] = "PCC Last Block CMAC 2key TDES protected key",
+	[107] = "PCC Last Block CMAC TDES protected key",
+	[108] = "PCC Last Block CMAC AES 128bit",
+	[109] = "PCC Last Block CMAC AES 192bit",
+	[110] = "PCC Last Block CMAC AES 256bit",
+	[111] = "PCC Last Block CMAC AES 128bit protected key",
+	[112] = "PCC Last Block CMAC AES 192bit protected key",
+	[113] = "PCC Last Block CMAC AES 256bit protected key",
+	[114] = "PCC XTS Parameter AES 128bit",
+	[115] = "PCC XTS Parameter AES 256bit",
+	[116] = "PCC XTS Parameter AES 128bit protected key",
+	[117] = "PCC XTS Parameter AES 256bit protected key",
+	[118] = "PCC Scalar Mult P256",
+	[119] = "PCC Scalar Mult P384",
+	[120] = "PCC Scalar Mult P521",
+	[121] = "PCC Scalar Mult Ed25519",
+	[122] = "PCC Scalar Mult Ed448",
+	[123] = "PCC Scalar Mult X25519",
+	[124] = "PCC Scalar Mult X448",
+	[125] = "PRNO SHA512 DRNG",
+	[126] = "PRNO TRNG Query Ratio",
+	[127] = "PRNO TRNG",
+	[128] = "KDSA ECDSA Verify P256",
+	[129] = "KDSA ECDSA Verify P384",
+	[130] = "KDSA ECDSA Verify P521",
+	[131] = "KDSA ECDSA Sign P256",
+	[132] = "KDSA ECDSA Sign P384",
+	[133] = "KDSA ECDSA Sign P521",
+	[134] = "KDSA ECDSA Sign P256 protected key",
+	[135] = "KDSA ECDSA Sign P384 protected key",
+	[136] = "KDSA ECDSA Sign P521 protected key",
+	[137] = "KDSA EdDSA Verify Ed25519",
+	[138] = "KDSA EdDSA Verify Ed448",
+	[139] = "KDSA EdDSA Sign Ed25519",
+	[140] = "KDSA EdDSA Sign Ed448",
+	[141] = "KDSA EdDSA Sign Ed25519 protected key",
+	[142] = "KDSA EdDSA Sign Ed448 protected key",
+	[143] = "PCKMO DES",
+	[144] = "PCKMO 2key TDES",
+	[145] = "PCMKO TDES",
+	[146] = "PCKMO AES 128bit",
+	[147] = "PCKMO AES 192bit",
+	[148] = "PCMKO AES 256bit",
+	[149] = "PCKMO ECC P256",
+	[150] = "PCKMO ECC P384",
+	[151] = "PCKMO ECC P521",
+	[152] = "PCKMO ECC Ed25519",
+	[153] = "PCKMO ECC Ed448",
+	[154] = "Reserved 1",
+	[155] = "Reserved 2"
+};
+
+
+static int paiprintnonzero;
+
 
 static int send_query(int s, enum cmd_e cmd, enum ctr_e ctr)
 {
@@ -62,7 +232,7 @@ static int send_query(int s, enum cmd_e cmd, enum ctr_e ctr)
 	m.query.m_ctr = ctr;
 	m.query.m_cmd = cmd;
 
-	return send_msg(s, &m);
+	return send_msg(s, &m, 0);
 }
 
 
@@ -71,7 +241,7 @@ static int recv_answer(int s, int *ctr, int *state, uint64_t *value)
 	struct msg m;
 	int rc;
 
-	rc = recv_msg(s, &m);
+	rc = recv_msg(s, &m, 0);
 	if (rc == 0) {
 		if (m.head.m_ver != VERSION) {
 			eprint("Received msg with wrong version %d != %d\n",
@@ -92,9 +262,139 @@ static int recv_answer(int s, int *ctr, int *state, uint64_t *value)
 }
 
 
-static void print_answer(int ctr, int state, uint64_t value)
+static void printjsonsep(void)
 {
-	if (state < 0)
+	static const char *jsonsep = "";
+
+	fputs(jsonsep, stdout);
+	jsonsep = ",";
+}
+
+
+static void json_print_virtual_counter_answer(int s, int ctr,
+					      int state, uint64_t value)
+{
+	int paictr = 0, paistate = 0, ec;
+	uint64_t i, paivalue = 0, maxnum;
+	const char *space;
+
+	switch (ctr) {
+	case HOTPLUG_DETECTED:
+		printjsonsep();
+		printf("{\"counter\":\"hotplug detected\",");
+		if (state < 0)
+			printf("\"error\":%d}", state);
+		else
+			printf("\"value\":%d}", !!value);
+		return;
+	case PAI_USER:
+		maxnum = NUM_PAI_USER;
+		space = "user";
+		break;
+	case PAI_KERNEL:
+		maxnum = NUM_PAI_KERNEL;
+		space = "kernel";
+		break;
+	default:
+		return;
+	}
+	/* Here, we have validated the PAI counter retrieved, but not
+	 * yet printed. */
+	if (state != ENABLED)
+		return;
+	if (value > maxnum) {
+		eprint("Incompatible versions detected!\n");
+		eprint("Expected %"PRIu64" counter space for %s, but got %"PRIu64"\n",
+			maxnum, space, value);
+		exit(EXIT_FAILURE);
+	}
+	for (i = 0; i < value; ++i) {
+		ec = recv_answer(s, &paictr, &paistate, &paivalue);
+		if (ec < 0 || paistate < 0) {
+			eprint("Error on receiving answer message from daemon\n");
+			/* No more data for this virtual event after error. */
+			return;
+		}
+		if (paictr > NUM_PAI_KERNEL) {
+			eprint("Pai counter number too big: %d\n", paictr);
+		} else {
+			printjsonsep();
+			printf("{\"counter\":\"%s\",\"space\":\"%s\",\"counterid\":%d,",
+				pai_str[paictr], space, paictr + 1);
+			if (paistate < 0) {
+				printf("\"error\":%d}", paistate);
+				/* Protocol does not send furter counters. */
+				return;
+			}
+			printf("\"value\":%"PRIu64"}", paivalue);
+		}
+	}
+}
+
+
+static void print_virtual_counter_answer(int s,
+					 int ctr, int state, uint64_t value)
+{
+	static const char *const states[] = {
+		[DISABLED]    = "disabled",
+		[ENABLED]     = "enabled",
+		[UNSUPPORTED] = "unsupported"
+	};
+	int paictr = 0, paistate = 0, ec;
+	uint64_t i, paivalue = 0, maxnum;
+	const char *ctrstr;
+
+	switch (ctr) {
+	case HOTPLUG_DETECTED:
+		if (state >= 0 && value > 0)
+			printf(" hotplug detected\n");
+		return;
+	case PAI_USER:
+		maxnum = NUM_PAI_USER;
+		ctrstr = "pai_user";
+		break;
+	case PAI_KERNEL:
+		maxnum = NUM_PAI_KERNEL;
+		ctrstr = "pai_kernel";
+		break;
+	default:
+		return;
+	}
+	/* Here, we have validated the PAI counter retrieved, but not
+	 * yet printed. */
+	if (state < 0 || state > UNSUPPORTED) {
+		printf(" %11s: error state %d\n", ctrstr, state);
+		/* No details follow if counter in error state. */
+		return;
+	}
+	printf(" %-11s: %s\n", ctrstr, states[state]);
+	if (state != ENABLED)
+		return;
+	if (value > maxnum) {
+		eprint("Incompatible versions detected!\n");
+		eprint("Expected %"PRIu64" counters for %s, but got %"PRIu64"\n",
+		       maxnum, ctrstr, value);
+		exit(EXIT_FAILURE);
+	}
+	for (i = 0; i < value; ++i) {
+		ec = recv_answer(s, &paictr, &paistate, &paivalue);
+		if (ec < 0 || paistate < 0) {
+			eprint("Error on receiving answer message from daemon\n");
+			/* No more data for this virtual event after error. */
+			return;
+		}
+		if (paictr > NUM_PAI_KERNEL)
+			eprint("Pai counter number too big: %d\n", paictr);
+		else if (!paiprintnonzero || paivalue > 0)
+			printf("  %-45s: %"PRIu64"\n", pai_str[paictr], paivalue);
+	}
+}
+
+static void print_answer(int s, int ctr, int state, uint64_t value)
+{
+	if (ctr > ALL_COUNTER)
+		print_virtual_counter_answer(s, ctr, state, value);
+	else if (state < 0)
 		printf(" %s counter: error state %d\n",
 		       counter_str[ctr], state);
 	else if (state == DISABLED)
@@ -106,6 +406,22 @@ static void print_answer(int ctr, int state, uint64_t value)
 }
 
 
+static void json_print_answer(int s, int ctr, int state, uint64_t value)
+{
+	if (ctr > ALL_COUNTER) {
+		json_print_virtual_counter_answer(s, ctr, state, value);
+	} else if (state < 0) {
+		printjsonsep();
+		printf("{\"counter\":\"%s\",", counter_str[ctr]);
+		printf("\"error\":%d}\n", state);
+	} else if (state == ENABLED) {
+		printjsonsep();
+		printf("{\"counter\":\"%s\",", counter_str[ctr]);
+		printf("\"value\":%"PRIu64"}", value);
+	}
+}
+		
+
 int eprint(const char *format, ...)
 {
 	char buf[1024];
@@ -128,7 +444,7 @@ int main(int argc, char *argv[])
 {
 	enum ctr_e ctr = ALL_COUNTER;
 	enum cmd_e cmd = PRINT;
-	int i, j, s, state;
+	int i, j, s, state, num, json = 0;
 	uint64_t value;
 
 	if (argc > 1) {
@@ -140,98 +456,108 @@ int main(int argc, char *argv[])
 			{ "disable", 0, NULL, 'd' },
 			{ "reset", 0, NULL, 'r' },
 			{ "print", 0, NULL, 'p' },
+			{ "nonzero", 0, NULL, 'n' },
+			{ "json", 0, NULL, 'j' },
 			{ NULL, 0, NULL, 0 } };
 		while (1) {
 			opt = getopt_long(argc, argv,
-					  "hvedrp", long_opts, &idx);
+					  "hvedrpnj", long_opts, &idx);
 			if (opt == -1)
 				break; /* no more arguments */
 			switch (opt) {
 			case 'h':
 				printf(usage, name);
-				exit(0);
-				break;
+				return 0;
 			case 'v':
 				printf("%s: Linux on System z CPACF Crypto Activity Counters Client\n"
 				       "Version %s\n%s\n",
 				       name, RELEASE_STRING, COPYRIGHT);
-				exit(0);
-				break;
+				return 0;
 			case 'e':
 				cmd = ENABLE;
+				json = 0;
 				break;
 			case 'd':
 				cmd = DISABLE;
+				json = 0;
 				break;
 			case 'r':
 				cmd = RESET;
 				break;
 			case 'p':
 				cmd = PRINT;
+				json = 0;
+				break;
+			case 'n':
+				paiprintnonzero = 1;
+				break;
+			case 'j':
+				cmd = PRINT;
+				json = 1;
 				break;
 			default:
 				eprint("Invalid argument, try -h or --help for more information\n");
-				exit(1);
-				break;
+				return EXIT_FAILURE;
 			}
 		}
 		/* there may be an optional counter argument */
 		if (optind > 0 && optind < argc) {
-			for (i = 0; i <= ALL_COUNTER; i++)
+			for (i = 0; i < NUM_COUNTER; i++)
 				if (strcmp(argv[optind], counter_str[i]) == 0)
 					break;
-			if (i > ALL_COUNTER) {
+			if (i >= NUM_COUNTER) {
 				eprint("Unknown counter '%s'\n", argv[optind]);
-				exit(1);
+				return EXIT_FAILURE;
 			}
 			ctr = (enum ctr_e) i;
 		}
 	}
+	if (json)
+		ctr = ALL_COUNTER;
 
 	/* try to open and connect socket to the cpacfstatsd daemon */
 	s = open_socket(CLIENT);
 	if (s < 0) {
 		eprint("Can't connect to daemon\n");
-		exit(1);
+		return EXIT_FAILURE;
 	}
 
 	/* send query */
 	if (send_query(s, cmd, ctr) != 0) {
 		eprint("Error on sending query message to daemon\n");
 		close(s);
-		exit(1);
+		return EXIT_FAILURE;
 	}
 
 	if (ctr == ALL_COUNTER) {
-		for (i = 0; i < ALL_COUNTER; i++) {
-			/* receive answer */
-			if (recv_answer(s, &j, &state, &value) != 0) {
-				eprint("Error on receiving answer message from daemon\n");
-				exit(1);
-			}
-			if (state < 0) {
-				eprint("Received bad status code %d from daemon\n",
-				       state);
-				close(s);
-				exit(1);
-			}
-			print_answer(j, state, value);
-		}
+		/* The -1 is for ALL_COUNTER which is not sent, +1 for
+		 * hotplug state. */
+		num = NUM_COUNTER - 1 + 1;
 	} else {
+		/* +1 for hotplug state */
+		num = 1 + 1;
+	}
+	if (json)
+		putchar('[');
+	for (i = 0; i < num; i++) {
 		/* receive answer */
 		if (recv_answer(s, &j, &state, &value) != 0) {
 			eprint("Error on receiving answer message from daemon\n");
-			close(s);
-			exit(1);
+			return EXIT_FAILURE;
 		}
 		if (state < 0) {
 			eprint("Received bad status code %d from daemon\n",
-			       state);
+				state);
 			close(s);
-			exit(1);
+			return EXIT_FAILURE;
 		}
-		print_answer(j, state, value);
+		if (json)
+			json_print_answer(s, j, state, value);
+		else
+			print_answer(s, j, state, value);
 	}
+	if (json)
+		putchar(']');
 
 	/* close connection */
 	close(s);

cpacfstats/cpacfstats.h

@@ -3,7 +3,7 @@
  *
  * common function prototypes and definitions
  *
- * Copyright IBM Corp. 2015, 2020
+ * Copyright IBM Corp. 2015, 2022
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -14,13 +14,27 @@
 
 #include "lib/zt_common.h"
 
-#define COPYRIGHT "Copyright IBM Corp. 2015, 2020"
+#define COPYRIGHT "Copyright IBM Corp. 2015, 2022"
+
+#define DEFAULT_SEND_TIMEOUT  (30 * 1000)
+#define DEFAULT_RECV_TIMEOUT  (30 * 1000)
+
+/*
+ * Number of PAI counters for user space.  This excludes PCKMO since
+ * this instruction is privileged.
+ */
+#define NUM_PAI_USER     143
+/* Number of PAI counters for kernel space.  Contains all counters. */
+#define NUM_PAI_KERNEL   156
 
 int eprint(const char *format, ...);
 
 /*
  * Counter names
- * ALL_COUNTER must always be the last member of the enum
+ * ALL_COUNTER specifies the number of physical counters.  Virtual
+ * counters might be added afterwards.  NUM_COUNTER is the last
+ * managed counter (i.e., a counter that can be activated, reset,
+ * deactivated).
  */
 enum ctr_e {
 	DES_FUNCTIONS = 0,
@@ -28,7 +42,11 @@ enum ctr_e {
 	SHA_FUNCTIONS,
 	PRNG_FUNCTIONS,
 	ECC_FUNCTIONS,
-	ALL_COUNTER
+	ALL_COUNTER,
+	PAI_USER,
+	PAI_KERNEL,
+	NUM_COUNTER,
+	HOTPLUG_DETECTED = 0xffff
 };
 
 enum type_e {
@@ -50,7 +68,7 @@ enum state_e {
 };
 
 /*
- * query send from clent to daemon
+ * query send from client to daemon
  * Consist of:
  * enum counter
  * enum command
@@ -63,7 +81,7 @@ struct msg_query {
 /*
  * answer send from daemon to client
  * Consist of:
- * enum counter
+ * enum counter or PAI counter number if following PAI_USER or PAI_KERNEL
  * status code: < 0 error, 0 disabled, > 0 enabled
  * counter value
  */
@@ -99,17 +117,20 @@ struct msg {
 } __packed;
 
 int open_socket(int mode);
-int send_msg(int sfd, struct msg *m);
-int recv_msg(int sfd, struct msg *m);
+int send_msg(int sfd, struct msg *m, int timeout);
+int recv_msg(int sfd, struct msg *m, int timeout);
 
 /* perf_crypto.c */
 
 int  perf_init(void);
+void perf_stop(void);
 void perf_close(void);
 int  perf_enable_ctr(enum ctr_e ctr);
 int  perf_disable_ctr(enum ctr_e ctr);
-int  perf_reset_ctr(enum ctr_e ctr);
+int  perf_reset_ctr(enum ctr_e ctr, uint64_t *value);
 int  perf_read_ctr(enum ctr_e ctr, uint64_t *value);
 int  perf_ecc_supported(void);
+int  perf_ctr_state(enum ctr_e ctr);
+int  perf_read_pai_ctr(unsigned int ctrnum, int user, uint64_t *value);
 
 #endif

cpacfstats/cpacfstatsd.c

@@ -3,7 +3,7 @@
  *
  * cpacfstatsd daemon implementation
  *
- * Copyright IBM Corp. 2015, 2017
+ * Copyright IBM Corp. 2015, 2022
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -28,6 +28,7 @@
 #include "lib/zt_common.h"
 #include "cpacfstats.h"
 
+static volatile int stopsig;
 
 static const char *const name = "cpacfstatsd";
 
@@ -43,15 +44,12 @@ static const char *const usage =
 
 static int daemonized;
 
-static int ctr_state[ALL_COUNTER];
-
-
 static int recv_query(int s, enum ctr_e *ctr, enum cmd_e *cmd)
 {
 	struct msg m;
 	int rc;
 
-	rc = recv_msg(s, &m);
+	rc = recv_msg(s, &m, DEFAULT_RECV_TIMEOUT);
 	if (rc == 0) {
 		if (m.head.m_ver != VERSION) {
 			eprint("Received msg with wrong version %d != %d\n",
@@ -83,38 +81,82 @@ static int send_answer(int s, int ctr, int state, uint64_t value)
 	m.answer.m_state = state;
 	m.answer.m_value = value;
 
-	return send_msg(s, &m);
+	return send_msg(s, &m, DEFAULT_SEND_TIMEOUT);
+}
+
+
+/*
+ * Print according to protocol for PAI:
+ * - first the state and the number of PAI counters that follow
+ * - if state is ENABLED:
+ *   - for each PAI counter the value with state ENABLED
+ * Note that the PAI counters are 0-based, not 1 based as in PoP!
+ * Sending ends with the first error.
+ */
+static int do_send_pai(int s, int user)
+{
+	int ctr, state, i, maxctr, rc = 0;
+	uint64_t value;
+	
+	if (user) {
+		ctr = PAI_USER;
+		maxctr = NUM_PAI_USER;
+	} else {
+		ctr = PAI_KERNEL;
+		maxctr = NUM_PAI_KERNEL;
+	}
+	state = perf_ctr_state(ctr);
+	if (state != ENABLED)
+		return rc;
+	for (i = 0; i < maxctr; ++i) {
+		rc = perf_read_pai_ctr(i, user, &value);
+		if (rc != 0) {
+			send_answer(s, i, rc, 0);
+			break;
+		}
+		send_answer(s, i, state, value);
+	}
+	return rc;
 }
 
 
 static int do_enable(int s, enum ctr_e ctr)
 {
-	uint64_t value;
+	uint64_t value = 0;
 	int i, rc = 0;
+	int state;
 
-	for (i = 0; i < ALL_COUNTER; i++) {
+	for (i = 0; i < NUM_COUNTER; i++) {
+		if (i == ALL_COUNTER)
+			continue;
 		if (i == (int) ctr || ctr == ALL_COUNTER) {
-			if (ctr_state[i] == DISABLED) {
+			state = perf_ctr_state(i);
+			if (state == DISABLED) {
 				rc = perf_enable_ctr(i);
 				if (rc != 0) {
 					send_answer(s, i, rc, 0);
 					break;
 				}
-				ctr_state[i] = ENABLED;
+				state = ENABLED;
 			}
-			if (ctr_state[i] == UNSUPPORTED) {
-				send_answer(s, i, UNSUPPORTED, 0);
-			} else {
+			if (state != UNSUPPORTED) {
 				rc = perf_read_ctr(i, &value);
 				if (rc != 0) {
 					send_answer(s, i, rc, 0);
 					break;
 				}
-				send_answer(s, i, ENABLED, value);
 			}
+			send_answer(s, i, state, value);
+			if (i == PAI_USER)
+				rc = do_send_pai(s, 1);
+			if (i == PAI_KERNEL)
+				rc = do_send_pai(s, 0);
 		}
 	}
-
+	if (rc == 0) {
+		rc = perf_read_ctr(HOTPLUG_DETECTED, &value);
+		send_answer(s, HOTPLUG_DETECTED, rc, value);
+	}
 	return rc;
 }
 
@@ -122,67 +164,90 @@ static int do_enable(int s, enum ctr_e ctr)
 static int do_disable(int s, enum ctr_e ctr)
 {
 	int i, rc = 0;
+	uint64_t value;
 
-	for (i = 0; i < ALL_COUNTER; i++) {
+	for (i = 0; i < NUM_COUNTER; i++) {
+		if (i == ALL_COUNTER)
+			continue;
 		if (i == (int) ctr || ctr == ALL_COUNTER) {
-			if (ctr_state[i] == ENABLED) {
+			if (perf_ctr_state(i) == ENABLED) {
 				rc = perf_disable_ctr(i);
 				if (rc != 0) {
 					send_answer(s, i, rc, 0);
 					break;
 				}
-				ctr_state[i] = 0;
 			}
-			send_answer(s, i, ctr_state[i], 0);
+			send_answer(s, i, perf_ctr_state(i), 0);
 		}
 	}
-
+	if (rc == 0) {
+		rc = perf_read_ctr(HOTPLUG_DETECTED, &value);
+		send_answer(s, HOTPLUG_DETECTED, rc, value);
+	}
 	return rc;
 }
 
 
 static int do_reset(int s, enum ctr_e ctr)
 {
-	int i, rc = 0;
+	int i, rc = 0, state;
+	uint64_t value;
 
-	for (i = 0; i < ALL_COUNTER; i++) {
+	for (i = 0; i < NUM_COUNTER; i++) {
+		if (i == ALL_COUNTER)
+			continue;
 		if (i == (int) ctr || ctr == ALL_COUNTER) {
-			if (ctr_state[i] == ENABLED) {
-				rc = perf_reset_ctr(i);
+			state = perf_ctr_state(i);
+			if (state == ENABLED) {
+				rc = perf_reset_ctr(i, &value);
 				if (rc != 0) {
 					send_answer(s, i, rc, 0);
 					break;
 				}
-				send_answer(s, i, ENABLED, 0);
-			} else {
-				send_answer(s, i, ctr_state[i], 0);
 			}
+			send_answer(s, i, state, value);
+			if (i == PAI_USER)
+				rc = do_send_pai(s, 1);
+			if (i == PAI_KERNEL)
+				rc = do_send_pai(s, 0);
 		}
 	}
-
+	if (rc == 0) {
+		rc = perf_read_ctr(HOTPLUG_DETECTED, &value);
+		send_answer(s, HOTPLUG_DETECTED, rc, value);
+	}
 	return rc;
 }
 
+
 static int do_print(int s, enum ctr_e ctr)
 {
-	int i, rc = 0;
-	uint64_t value;
+	int i, rc = 0, state;
+	uint64_t value = 0;
 
-	for (i = 0; i < ALL_COUNTER; i++) {
+	for (i = 0; i < NUM_COUNTER; i++) {
+		if (i == ALL_COUNTER)
+			continue;
 		if (i == (int) ctr || ctr == ALL_COUNTER) {
-			if (ctr_state[i] == ENABLED) {
+			state = perf_ctr_state(i);
+			if (state == ENABLED) {
 				rc = perf_read_ctr(i, &value);
 				if (rc != 0) {
 					send_answer(s, i, rc, 0);
 					break;
 				}
-				send_answer(s, i, ENABLED, value);
-			} else {
-				send_answer(s, i, ctr_state[i], 0);
 			}
+			send_answer(s, i, state, value);
+			if (i == PAI_USER)
+				rc = do_send_pai(s, 1);
+			if (i == PAI_KERNEL)
+				rc = do_send_pai(s, 0);
 		}
 	}
-
+	if (rc == 0) {
+		rc = perf_read_ctr(HOTPLUG_DETECTED, &value);
+		send_answer(s, HOTPLUG_DETECTED, rc, value);
+	}
 	return rc;
 }
 
@@ -324,18 +389,8 @@ static void remove_pidfile(void)
 
 void signalhandler(int sig)
 {
-	if (sig == SIGTERM)
-		eprint("Caught signal SIGTERM, terminating...\n");
-	else if (sig == SIGINT)
-		eprint("Caught signal SIGINT, terminating...\n");
-	else
-		eprint("Caught signal %d, terminating...\n", sig);
-
-	remove_sock();
-	perf_close();
-	remove_pidfile();
-
-	exit(0);
+	perf_stop();
+	stopsig = sig;
 }
 
 
@@ -381,7 +436,7 @@ int main(int argc, char *argv[])
 			switch (opt) {
 			case 'h':
 				printf(usage, name);
-				exit(0);
+				return 0;
 			case 'f':
 				foreground = 1;
 				break;
@@ -389,40 +444,37 @@ int main(int argc, char *argv[])
 				printf("%s: Linux on System z CPACF Crypto Activity Counters Daemon\n"
 				       "Version %s\n%s\n",
 				       name, RELEASE_STRING, COPYRIGHT);
-				exit(0);
+				return 0;
 			default:
 				printf("%s: Invalid argument, try -h or --help for more information\n",
 					name);
-				exit(1);
+				return EXIT_FAILURE;
 			}
 		}
 	}
 
 	if (check_pidfile() != 0) {
 		eprint("Stalled pid file or daemon allready running, terminating\n");
-		exit(1);
+		return EXIT_FAILURE;
 	}
 
 	if (!foreground) {
 		if (become_daemon() != 0) {
 			eprint("Couldn't daemonize\n");
-			exit(1);
+			return EXIT_FAILURE;
 		}
 	}
 
 	if (perf_init() != 0) {
 		eprint("Couldn't initialize perf lib\n");
-		exit(1);
+		return EXIT_FAILURE;
 	}
 	atexit(perf_close);
 
-	if (!perf_ecc_supported())
-		ctr_state[ECC_FUNCTIONS] = UNSUPPORTED;
-
 	sfd = open_socket(SERVER);
 	if (sfd < 0) {
 		eprint("Couldn't initialize server socket\n");
-		exit(1);
+		return EXIT_FAILURE;
 	}
 	atexit(remove_sock);
 
@@ -432,17 +484,19 @@ int main(int argc, char *argv[])
 	if (sigaction(SIGINT, &act, 0) != 0) {
 		eprint("Couldn't establish signal handler for SIGINT, errno=%d [%s]\n",
 		       errno, strerror(errno));
-		exit(1);
+		return EXIT_FAILURE;
 	}
 	if (sigaction(SIGTERM, &act, 0) != 0) {
 		eprint("Couldn't establish signal handler for SIGTERM, errno=%d [%s]\n",
 		       errno, strerror(errno));
-		exit(1);
+		return EXIT_FAILURE;
 	}
+	/* Ignore SIGPIPE such that we see EPIPE as return from write. */
+	signal(SIGPIPE, SIG_IGN);
 
 	eprint("Running\n");
 
-	while (1) {
+	while (!stopsig) {
 		enum ctr_e ctr;
 		enum cmd_e cmd;
 		int s;
@@ -453,7 +507,7 @@ int main(int argc, char *argv[])
 				continue;
 			eprint("Accept() failure, errno=%d [%s]\n",
 			       errno, strerror(errno));
-			exit(1);
+			return EXIT_FAILURE;
 		}
 
 		rc = recv_query(s, &ctr, &cmd);
@@ -480,5 +534,13 @@ cleanup:
 		close(s);
 	}
 
+	if (stopsig == SIGTERM)
+		eprint("Caught signal SIGTERM, terminating...\n");
+	else if (stopsig == SIGINT)
+		eprint("Caught signal SIGINT, terminating...\n");
+	else
+		eprint("Caught signal %d, terminating...\n", stopsig);
+	remove_pidfile();
+
 	return 0;
 }

cpacfstats/perf_crypto.c

@@ -3,7 +3,7 @@
  *
  * low level perf functions
  *
- * Copyright IBM Corp. 2015, 2020
+ * Copyright IBM Corp. 2015, 2022
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -16,14 +16,21 @@
 #include <inttypes.h>
 #include <limits.h>
 #include <linux/perf_event.h>
+#include <pthread.h>
+#include <poll.h>
+#include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/ioctl.h>
+#include <sys/resource.h>
 #include <unistd.h>
 
+#include <libudev.h>
+
 #include "cpacfstats.h"
+#include "../include/lib/zt_common.h"
 
 /* correlation between counter and perf counter string */
 static const struct {
@@ -38,25 +45,83 @@ static const struct {
 	{"cpum_cf", "ECC_FUNCTION_COUNT", ECC_FUNCTIONS}
 };
 
-/*
- * We need one filedescriptor per CPU per counter.
- * So perf_init builds this:
- *
- * ctr_fds - is an array of pointers to file descriptor arrays.
- * Each file descriptor array has space for number of logical CPUs + 1
- * filedescriptors (int values). The last element of each file descriptor
- * array is always 0, assuming there will never appear a filedescriptor
- * with value 0:
- *
- * ctr_fds:
- *   ctr_fds[0]             -> [file descriptor 0] [fd1] ... [fd cpus-1][0]
- *   ctr_fds[1]             -> [file descriptor 0] [fd1] ... [fd cpus-1][0]
- *   ...
- *   ctr_fds[ALL_COUNTER-1] -> [file descriptor 0] [fd1] ... [fd cpus-1][0]
- */
-static int *ctr_fds[ALL_COUNTER];
+static struct pmf_data {
+	int pmutype;
+	int eventid;
+} pmf_counter_data[ALL_COUNTER];
 
-static int ecc_supported;
+struct percpucounter {
+	int                   ctr_fds[ALL_COUNTER];
+	int                   pai_user[NUM_PAI_USER];
+	int                   pai_kernel[NUM_PAI_KERNEL];
+	unsigned int          cpunum;
+	struct percpucounter *next;
+};
+
+static struct percpucounter *root;
+pthread_mutex_t rootmux = PTHREAD_MUTEX_INITIALIZER;
+static volatile int hotplugdetected;
+static unsigned int enabledcounter;
+pthread_t hotplugthread;
+
+#define foreachcpu(PCPU) if (pthread_mutex_lock(&rootmux)) return -1; \
+	for ((PCPU) = root; (PCPU) != NULL; (PCPU) = (PCPU)->next)
+#define endforeachcpu() pthread_mutex_unlock(&rootmux)
+
+static int ctr_state[NUM_COUNTER];
+
+static volatile int stoprequested;
+
+static int paipmutype, paipmueventstart;
+
+static struct percpucounter *allocpercpucounter(unsigned int cpunum)
+{
+	struct percpucounter *ppc;
+
+	ppc = malloc(sizeof(struct percpucounter));
+	if (ppc) {
+		int i;
+
+		for (i = 0; i < ALL_COUNTER; ++i)
+			ppc->ctr_fds[i] = -1;
+		for (i = 0; i < NUM_PAI_USER; ++i)
+			ppc->pai_user[i] = -1;
+		for (i = 0; i < NUM_PAI_KERNEL; ++i)
+			ppc->pai_kernel[i] = -1;
+		ppc->cpunum = cpunum;
+		ppc->next = NULL;
+	}
+	return ppc;
+}
+
+static void freepercpucounter(struct percpucounter *pcpu)
+{
+	int i;
+
+	for (i = 0; i < ALL_COUNTER; ++i)
+		(void)close(pcpu->ctr_fds[i]);
+	for (i = 0; i < NUM_PAI_USER; ++i)
+		(void)close(pcpu->pai_user[i]);
+	for (i = 0; i < NUM_PAI_KERNEL; ++i)
+		(void)close(pcpu->pai_kernel[i]);
+	free(pcpu);
+}
+
+static struct percpucounter *findcpu(unsigned int cpunum, int unlinkflag)
+{
+	struct percpucounter **prev = &root, *walk = root;
+
+	while (walk) {
+		if (walk->cpunum == cpunum) {
+			if (unlinkflag)
+				*prev = walk->next;
+			return walk;
+		}
+		prev = &(walk->next);
+		walk = walk->next;
+	}
+	return NULL;
+}
 
 static long perf_event_open(struct perf_event_attr *hw_event, pid_t pid,
 			    int cpu, int group_fd, unsigned long flags)
@@ -85,12 +150,43 @@ static int perf_counter_supported(const char *pmu, const char *counter)
 	return !access(buf, R_OK);
 }
 
-static int perf_event_encode(struct perf_event_attr *attr,
+static int cpumf_authorized(void)
+{
+	unsigned vermin, vermax, auth;
+	int res = 0, found = 0;
+	size_t linesize = 0;
+	char *line = NULL;
+	FILE *f;
+
+	f = fopen("/proc/service_levels", "r");
+	if (f == NULL) {
+		eprint("Failed to open /proc/service_levels (%d:%s)\n",
+			errno, strerror(errno));
+		return 0;
+	}
+	while (getline(&line, &linesize, f) >= 0) {
+		if (sscanf(line,
+			   "CPU-MF: Counter facility: version=%d.%d authorization=%x",
+			   &vermin, &vermax, &auth) == 3) {
+			if (auth & 0x8)
+				res = 1;
+			else
+				eprint("CPU-MF counters not authorized.\n");
+			found = 1;
+			break;
+		}
+	}
+	if (!found)
+		eprint("CPU-MF counters not available.\n");
+	free(line);
+	fclose(f);
+	return res;
+}
+
+static int perf_event_encode(int *pmutype, int *eventid,
 			     const char *pmu, const char *event)
 {
 	FILE *f;
-	int eventid;
-	int pmutype;
 	char buf[PATH_MAX];
 
 	if (snprintf(buf, PATH_MAX, "/sys/bus/event_source/devices/%s/events/%s",
@@ -104,7 +200,7 @@ static int perf_event_encode(struct perf_event_attr *attr,
 		       errno, strerror(errno));
 		return -1;
 	}
-	if (fscanf(f, "event=0x%x\n", &eventid) != 1) {
+	if (fscanf(f, "event=0x%x\n", eventid) != 1) {
 		fclose(f);
 		eprint("Event file %s has invalid format\n", buf);
 		return -1;
@@ -121,21 +217,257 @@ static int perf_event_encode(struct perf_event_attr *attr,
 		       errno, strerror(errno));
 		return -1;
 	}
-	if (fscanf(f, "%d\n", &pmutype) != 1) {
+	if (fscanf(f, "%d\n", pmutype) != 1) {
 		fclose(f);
 		eprint("Type file %s has invalid format\n", buf);
 		return -1;
 	}
-	attr->type = pmutype;
-	attr->config = eventid;
 	return 0;
 }
 
+static int activatecpu(unsigned int cpu)
+{
+	struct perf_event_attr pfm_event;
+	struct percpucounter *ppc;
+	int fd, i, rc = 0;
+
+	ppc = allocpercpucounter(cpu);
+	if (ppc == NULL) {
+		eprint("Failed to allocate per cpu counter data");
+		return -1;
+	}
+	if (pthread_mutex_lock(&rootmux)) {
+		freepercpucounter(ppc);
+		return -1;
+	}
+	/* activate CPU-MF */
+	for (i = 0; i < ALL_COUNTER; ++i) {
+		if (ctr_state[i] == UNSUPPORTED)
+			continue;
+		memset(&pfm_event, 0, sizeof(pfm_event));
+		pfm_event.size = sizeof(pfm_event);
+		pfm_event.type = pmf_counter_data[i].pmutype;
+		pfm_event.config = pmf_counter_data[i].eventid;
+
+		/* fetch file descriptor for this perf event
+		 * the counter event should start disabled
+		 */
+		pfm_event.disabled = ctr_state[i] == DISABLED;
+		fd = perf_event_open(
+			&pfm_event,
+			-1,  /* pid -1 means all processes */
+			cpu,
+			-1,  /* group filedescriptor */
+			0);  /* flags */
+		if (fd < 0) {
+			eprint("Perf_event_open() failed with errno=%d [%s]\n",
+				errno, strerror(errno));
+			rc = -1;
+			ctr_state[i] = UNSUPPORTED;
+		} else {
+			ppc->ctr_fds[i] = fd;
+		}
+	}
+	/* activate pai_user and pai_kernel */
+	/* invariant:
+	   (ctr_state[PAI_USER] == UNSUPPORTED) ==
+	   (ctr_state[PAI_KERNEL] == UNSUPPORTED) */
+	if (ctr_state[PAI_USER] != UNSUPPORTED) {
+		for (i = 1; i <= NUM_PAI_USER; ++i) {
+			memset(&pfm_event, 0, sizeof(pfm_event));
+			pfm_event.size = sizeof(pfm_event);
+			pfm_event.type = paipmutype;
+			pfm_event.config = paipmueventstart + i;
+			pfm_event.exclude_kernel = 1;
+			pfm_event.exclude_user = 0;
+			pfm_event.disabled = ctr_state[PAI_USER] == DISABLED;
+			fd = perf_event_open(&pfm_event, -1, cpu, -1, 0);
+			if (fd < 0) {
+				eprint("Perf_event_open() failed with errno=%d [%s]\n",
+					errno, strerror(errno));
+				rc = -1;
+				ctr_state[PAI_USER] = UNSUPPORTED;
+				ctr_state[PAI_KERNEL] = UNSUPPORTED;
+				goto outevents;
+			} else {
+				ppc->pai_user[i - 1] = fd;
+			}
+			pfm_event.exclude_kernel = 0;
+			pfm_event.exclude_user = 1;
+			pfm_event.disabled = ctr_state[PAI_KERNEL] == DISABLED;
+			fd = perf_event_open(&pfm_event, -1, cpu, -1, 0);
+			if (fd < 0) {
+				eprint("Perf_event_open() failed with errno=%d [%s]\n",
+					errno, strerror(errno));
+				rc = -1;
+				ctr_state[PAI_USER] = UNSUPPORTED;
+				ctr_state[PAI_KERNEL] = UNSUPPORTED;
+				goto outevents;
+			} else {
+				ppc->pai_kernel[i - 1] = fd;
+			}
+		}
+		for (; i <= NUM_PAI_KERNEL; ++i) {
+			memset(&pfm_event, 0, sizeof(pfm_event));
+			pfm_event.size = sizeof(pfm_event);
+			pfm_event.type = paipmutype;
+			pfm_event.config = paipmueventstart + i;
+			pfm_event.exclude_kernel = 0;
+			pfm_event.exclude_user = 1;
+			pfm_event.disabled = ctr_state[PAI_KERNEL] == DISABLED;
+			fd = perf_event_open(&pfm_event, -1, cpu, -1, 0);
+			if (fd < 0) {
+				eprint("Perf_event_open() failed with errno=%d [%s]\n",
+					errno, strerror(errno));
+				rc = -1;
+				ctr_state[PAI_USER] = UNSUPPORTED;
+				ctr_state[PAI_KERNEL] = UNSUPPORTED;
+				goto outevents;
+			} else {
+				ppc->pai_kernel[i - 1] = fd;
+			}
+		}
+	}
+outevents:
+	ppc->next = root;
+	root = ppc;
+	if (enabledcounter)
+		hotplugdetected = 1;
+	pthread_mutex_unlock(&rootmux);
+	return rc;
+}
+
+static void deactivatecpu(unsigned int cpunum)
+{
+	struct percpucounter *pcpu;
+	int i;
+
+	if (pthread_mutex_lock(&rootmux))
+		return;
+	pcpu = findcpu(cpunum, 1);
+	if (pcpu != NULL) {
+		for (i = 0; i < ALL_COUNTER; ++i)
+			(void)close(pcpu->ctr_fds[i]);
+		for (i = 0; i < NUM_PAI_USER; ++i)
+			(void)close(pcpu->pai_user[i]);
+		for (i = 0; i < NUM_PAI_KERNEL; ++i)
+			(void)close(pcpu->pai_kernel[i]);
+		free(pcpu);
+		if (enabledcounter)
+			hotplugdetected = 1;
+	}
+	pthread_mutex_unlock(&rootmux);
+}
+
+static int addallcpus(void)
+{
+	unsigned int start, end;
+	int scanned, rc = 0;
+	FILE *fp;
+
+	/* comma separated list of intervals */
+	if ((fp = fopen("/sys/devices/system/cpu/online", "r")) == NULL) {
+		eprint("Failed to get online cpus (%d:%s)\n",
+			errno, strerror(errno));
+		return -1;
+	}
+		
+	while (!feof(fp)) {
+		/* scan all intervals of online cpus */
+		scanned = fscanf(fp, "%u-%u", &start, &end);
+		/* take care of singleton intervals */
+		if (scanned == 1)
+			end = start;
+		for (; start <= end; ++start) {
+			if (activatecpu(start)) {
+				rc = -1;
+				goto out;
+			}
+		}
+		/* Skip comma separator */
+		(void)fgetc(fp);
+	}
+out:
+	fclose(fp);
+	return rc;
+}
+
+static int perf_load_counter_data(void)
+{
+	int i, res = 0;
+
+	for (i = 0; i < ALL_COUNTER; ++i) {
+		if (ctr_state[i] != UNSUPPORTED)
+			res |= perf_event_encode(&pmf_counter_data[i].pmutype,
+						 &pmf_counter_data[i].eventid,
+						 pmf_counter_name[i].pmu,
+						 pmf_counter_name[i].pfm_name);
+	}
+	if (ctr_state[PAI_USER] != UNSUPPORTED)
+		res |= perf_event_encode(&paipmutype, &paipmueventstart,
+					 "pai_crypto", "CRYPTO_ALL");
+	return res;
+}
+
+static void *hotplughandler(void *UNUSED(unused))
+{
+	struct udev *hotplug;
+	struct udev_monitor *monitor;
+	struct pollfd item;
+	
+	hotplug = udev_new();
+	if (!hotplug) {
+		eprint("Failed to create hotplug device\n");
+		return NULL;
+	}
+	monitor = udev_monitor_new_from_netlink(hotplug, "udev");
+	udev_monitor_filter_add_match_subsystem_devtype(monitor, "cpu", NULL);
+	udev_monitor_enable_receiving(monitor);
+	item.fd = udev_monitor_get_fd(monitor);
+	item.events = POLLIN;
+	item.revents = 0;
+	while (!stoprequested) {
+		struct udev_device *dev;
+		const char *path, *action;
+		unsigned int cpunum;
+		int rc, on, off;
+
+		errno = 0;
+		rc = poll(&item, 1, -1);
+		if (rc == -1) {
+			if (errno == EINTR)
+				continue;
+			break;
+		}
+		dev = udev_monitor_receive_device(monitor);
+		if (dev == NULL)
+			continue;
+		action = udev_device_get_action(dev);
+		if (action == NULL)
+			continue;
+		off = strcmp(action, "offline") == 0;
+		on = strcmp(action, "online") == 0;
+		if (!on && !off)
+			continue;
+		path = udev_device_get_devpath(dev);
+		if (sscanf(path, "/devices/system/cpu/cpu%u", &cpunum) != 1)
+			continue;
+		if (on && activatecpu(cpunum))
+			eprint("Failed to attach to hotplugged CPU %u\n", cpunum);
+		if (off)
+			deactivatecpu(cpunum);
+	}
+	udev_monitor_unref(monitor);
+	udev_unref(hotplug);
+	return NULL;
+}
+
 int perf_init(void)
 {
-	int i, cpus, ctr, cpu, *fds;
-
-	memset(ctr_fds, 0, sizeof(ctr_fds));
+	int ecc_supported, i, num;
+	unsigned long maxfd;
+	struct rlimit rlim;
+	FILE *f;
 
 	/*  initialize performance monitoring library */
 	if (!perf_supported()) {
@@ -143,99 +475,105 @@ int perf_init(void)
 		return -1;
 	}
 
+	/* We currently support all cpumf counters plus two virtual
+	 * counters for PAI. */
+	num = ALL_COUNTER + 2;
 	/* Check if ECC is supported on current hardware */
 	ecc_supported = perf_counter_supported("cpum_cf", "ECC_FUNCTION_COUNT");
 
-	/* get number of logical processors */
-	cpus = sysconf(_SC_NPROCESSORS_ONLN);
-
-	/* for each counter */
-	for (ctr = 0; ctr < ALL_COUNTER; ctr++) {
-
-		/* Skip ECC counters completely if unsupported */
-		if (ctr == ECC_FUNCTIONS && !ecc_supported)
-			continue;
-
-		/*
-		 * allocate an array of ints to store for each CPU
-		 * one filedescriptor + a terminating 0
-		 */
-		fds = (int *) calloc(sizeof(int), cpus+1);
-		if (!fds) {
-			eprint("Malloc() of %d byte failed, errno=%d [%s]\n",
-			       (int)(sizeof(int) * (cpus+1)),
-			       errno, strerror(errno));
-			return -1;
-		}
-
-		ctr_fds[ctr] = fds;
-
-		/* search for the counter's corresponding pfm name */
-		for (i = ALL_COUNTER-1; i >= 0; i--)
-			if ((int) pmf_counter_name[i].ctr == ctr)
-				break;
-		if (i < 0) {
-			eprint("Pfm ctr name not found for counter %d, please adjust pmf_counter_name[] in %s\n",
-			       ctr, __FILE__);
-			return -1;
-		}
-
-		for (cpu = 0; cpu < cpus; cpu++) {
-			struct perf_event_attr pfm_event;
-			int fd;
-
-			memset(&pfm_event, 0, sizeof(pfm_event));
-			pfm_event.size = sizeof(pfm_event);
-			if (perf_event_encode(&pfm_event,
-					      pmf_counter_name[i].pmu,
-					      pmf_counter_name[i].pfm_name)) {
-				eprint("Failed to initialize counter %s for pmu %s\n",
-				       pmf_counter_name[i].pfm_name,
-				       pmf_counter_name[i].pmu);
-				return -1;
-			}
-
-			/* fetch file descriptor for this perf event
-			 * the counter event should start disabled
-			 */
-			pfm_event.disabled = 1;
-			fd = perf_event_open(
-				&pfm_event,
-				-1,  /* pid -1 means all processes */
-				cpu,
-				-1,  /* group filedescriptor */
-				0);  /* flags */
-			if (fd < 0) {
-				eprint("Perf_event_open() failed with errno=%d [%s]\n",
-				       errno, strerror(errno));
-				return -1;
-			}
-			fds[cpu] = fd;
-		}
+	if (!cpumf_authorized()) {
+		for (i = 0; i < ALL_COUNTER; ++i)
+			ctr_state[i] = UNSUPPORTED;
+		num -= ALL_COUNTER;
+	} else if (!ecc_supported) {
+		ctr_state[ECC_FUNCTIONS] = UNSUPPORTED;
+		--num;
 	}
 
-	return 0;
+	if (!perf_counter_supported("pai_crypto", "CRYPTO_ALL")) {
+		ctr_state[PAI_USER] = UNSUPPORTED;
+		ctr_state[PAI_KERNEL] = UNSUPPORTED;
+		num -= 2;
+	}
+
+	if (num == 0) {
+		eprint("No crypto counters supported!\n");
+		return -1;
+	}
+
+	if (perf_load_counter_data())
+		return -1;
+	/* We have to adjust the number of FDs possible since we might
+	 * need more than 1024 (the typical soft limit) */
+	f = fopen("/proc/sys/fs/nr_open", "r");
+	if (f == NULL) {
+		eprint("fopen failed for /proc/sys/fs/nr_open with errno=%d [%s]\n",
+			errno, strerror(errno));
+		return -1;
+	}
+	if (fscanf(f, "%lu", &maxfd) != 1) {
+		fclose(f);
+		eprint("Failed to parse /proc/sys/fs/nr_open\n");
+		return -1;
+	}
+	fclose(f);
+	rlim.rlim_cur = maxfd;
+	rlim.rlim_max = maxfd;
+	if (setrlimit(RLIMIT_NOFILE, &rlim) == -1) {
+		eprint("setrlimit failed with errno=%d [%s]\n",
+			errno, strerror(errno));
+		return -1;
+	}
+
+	if (pthread_create(&hotplugthread, NULL, hotplughandler, NULL)) {
+		eprint("Failed to start hotplug handler thread\n");
+		return -1;
+	}
+	return addallcpus();
+}
+
+
+void perf_stop(void)
+{
+	stoprequested = 1;
 }
 
 
 void perf_close(void)
 {
-	int ctr, *fds;
+	struct percpucounter *walk, *next;
 
-	for (ctr = 0; ctr < ALL_COUNTER; ctr++) {
-		for (fds = ctr_fds[ctr]; fds && *fds; fds++) {
-			close(*fds);
-			*fds = 0;
-		}
-		free(ctr_fds[ctr]);
-		ctr_fds[ctr] = NULL;
+	pthread_kill(hotplugthread, SIGINT);
+	pthread_join(hotplugthread, NULL);
+	walk = root;
+	while (walk) {
+		next = walk->next;
+		freepercpucounter(walk);
+		walk = next;
 	}
 }
 
 
+static int enable_array(int *arr, int size)
+{
+	int i, ec, rc = 0;
+
+	for (i = 0; i < size; ++i) {
+		ec = ioctl(arr[i], PERF_EVENT_IOC_ENABLE, 0);
+		if (ec < 0) {
+			eprint("Ioctl(PERF_EVENT_IOC_ENABLE) failed with errno=%d [%s]\n",
+				errno, strerror(errno));
+			rc = -1;
+		}
+	}
+	return rc;
+}
+
+
 int perf_enable_ctr(enum ctr_e ctr)
 {
-	int *fds, ec, rc = 0;
+	struct percpucounter *pcpu;
+	int ec, rc = 0;
 
 	if (ctr == ALL_COUNTER) {
 		for (ctr = 0; ctr < ALL_COUNTER; ctr++) {
@@ -243,24 +581,64 @@ int perf_enable_ctr(enum ctr_e ctr)
 			if (rc != 0)
 				return rc;
 		}
-	} else {
-		for (fds = ctr_fds[ctr]; fds && *fds; fds++) {
-			ec = ioctl(*fds, PERF_EVENT_IOC_ENABLE, 0);
+	} else if (ctr < ALL_COUNTER) {
+		foreachcpu(pcpu) {
+			ec = ioctl(pcpu->ctr_fds[ctr], PERF_EVENT_IOC_ENABLE, 0);
 			if (ec < 0) {
 				eprint("Ioctl(PERF_EVENT_IOC_ENABLE) failed with errno=%d [%s]\n",
 				       errno, strerror(errno));
 				rc = -1;
 			}
 		}
+		ctr_state[ctr] = ENABLED;
+		++enabledcounter;
+		endforeachcpu();
+	} else if (ctr == PAI_USER) {
+		foreachcpu(pcpu) {
+			ec = enable_array(pcpu->pai_user, NUM_PAI_USER);
+			if (ec < 0)
+				rc = -1;
+		}
+		ctr_state[ctr] = ENABLED;
+		++enabledcounter;
+		endforeachcpu();
+	} else if (ctr == PAI_KERNEL) {
+		foreachcpu(pcpu) {
+			ec = enable_array(pcpu->pai_kernel, NUM_PAI_KERNEL);
+			if (ec < 0)
+				rc = -1;
+		}
+		ctr_state[ctr] = ENABLED;
+		++enabledcounter;
+		endforeachcpu();
+	} else {
+		rc = -1;
 	}
 
 	return rc;
 }
 
 
+static int disable_array(int *arr, int size)
+{
+	int i, ec, rc = 0;
+
+	for (i = 0; i < size; ++i) {
+		ec = ioctl(arr[i], PERF_EVENT_IOC_DISABLE, 0);
+		if (ec < 0) {
+			eprint("Ioctl(PERF_EVENT_IOC_DISABLE) failed with errno=%d [%s]\n",
+				errno, strerror(errno));
+			rc = -1;
+		}
+	}
+	return rc;
+}
+
+
 int perf_disable_ctr(enum ctr_e ctr)
 {
-	int *fds, ec, rc = 0;
+	struct percpucounter *pcpu;
+	int ec, rc = 0;
 
 	if (ctr == ALL_COUNTER) {
 		for (ctr = 0; ctr < ALL_COUNTER; ctr++) {
@@ -268,70 +646,183 @@ int perf_disable_ctr(enum ctr_e ctr)
 			if (rc != 0)
 				return rc;
 		}
-	} else {
-		for (fds = ctr_fds[ctr]; fds && *fds; fds++) {
-			ec = ioctl(*fds, PERF_EVENT_IOC_DISABLE, 0);
+	} else if (ctr < ALL_COUNTER) {
+		foreachcpu(pcpu) {
+			ec = ioctl(pcpu->ctr_fds[ctr], PERF_EVENT_IOC_DISABLE, 0);
 			if (ec < 0) {
 				eprint("Ioctl(PERF_EVENT_IOC_DISABLE) failed with errno=%d [%s]\n",
 				       errno, strerror(errno));
 				rc = -1;
 			}
 		}
+		ctr_state[ctr] = DISABLED;
+		--enabledcounter;
+		if (enabledcounter == 0)
+			hotplugdetected = 0;
+		endforeachcpu();
+	} else if (ctr == PAI_USER) {
+		foreachcpu(pcpu) {
+			ec = disable_array(pcpu->pai_user, NUM_PAI_USER);
+			if (ec < 0)
+				rc = -1;
+		}
+		ctr_state[ctr] = DISABLED;
+		--enabledcounter;
+		if (enabledcounter == 0)
+			hotplugdetected = 0;
+		endforeachcpu();
+	} else if (ctr == PAI_KERNEL) {
+		foreachcpu(pcpu) {
+			ec = disable_array(pcpu->pai_kernel, NUM_PAI_KERNEL);
+			if (ec < 0)
+				rc = -1;
+		}
+		ctr_state[ctr] = DISABLED;
+		--enabledcounter;
+		if (enabledcounter == 0)
+			hotplugdetected = 0;
+		endforeachcpu();
+	} else {
+		rc = -1;
 	}
 
 	return rc;
 }
 
 
-int perf_reset_ctr(enum ctr_e ctr)
+static int reset_array(int *arr, int size)
 {
-	int *fds, ec, rc = 0;
+	int ec, rc = 0, i;
+
+	for (i = 0; i < size; ++i) {
+		ec = ioctl(arr[i], PERF_EVENT_IOC_RESET, 0);
+		if (ec < 0) {
+			eprint("Ioctl(PERF_EVENT_IOC_RESET) failed with errno=%d [%s]\n",
+				errno, strerror(errno));
+			rc = -1;
+		}
+	}
+	return rc;
+}
+
+
+int perf_reset_ctr(enum ctr_e ctr, uint64_t *value)
+{
+	struct percpucounter *pcpu;
+	int ec, rc = 0;
 
 	if (ctr == ALL_COUNTER) {
 		for (ctr = 0; ctr < ALL_COUNTER; ctr++) {
-			rc = perf_reset_ctr(ctr);
+			rc = perf_reset_ctr(ctr, value);
 			if (rc != 0)
 				return rc;
 		}
-	} else {
-		for (fds = ctr_fds[ctr]; fds && *fds; fds++) {
-			ec = ioctl(*fds, PERF_EVENT_IOC_RESET, 0);
+	} else if (ctr < ALL_COUNTER) {
+		foreachcpu(pcpu) {
+			ec = ioctl(pcpu->ctr_fds[ctr], PERF_EVENT_IOC_RESET, 0);
 			if (ec < 0) {
 				eprint("Ioctl(PERF_EVENT_IOC_RESET) failed with errno=%d [%s]\n",
 				       errno, strerror(errno));
 				rc = -1;
 			}
 		}
+		endforeachcpu();
+	} else if (ctr == PAI_USER) {
+		foreachcpu(pcpu) {
+			ec = reset_array(pcpu->pai_user, NUM_PAI_USER);
+			if (ec < 0)
+				rc = -1;
+		}
+		endforeachcpu();
+	} else if (ctr == PAI_KERNEL) {
+		foreachcpu(pcpu) {
+			ec = reset_array(pcpu->pai_kernel, NUM_PAI_KERNEL);
+			if (ec < 0)
+				rc = -1;
+		}
+		endforeachcpu();
+	} else {
+		rc = -1;
 	}
-
+	if (rc == 0)
+		rc = perf_read_ctr(ctr, value);
 	return rc;
 }
 
 
 int perf_read_ctr(enum ctr_e ctr, uint64_t *value)
 {
-	int *fds, ec, rc = -1;
+	struct percpucounter *pcpu;
+	int ec, rc = 0;
 	uint64_t val;
 
 	if (!value)
 		return -1;
+	if (ctr == HOTPLUG_DETECTED) {
+		*value = hotplugdetected;
+		return 0;
+	}
+	if (ctr == PAI_USER) {
+		*value = NUM_PAI_USER;
+		return 0;
+	}
+	if (ctr == PAI_KERNEL) {
+		*value = NUM_PAI_KERNEL;
+		return 0;
+	}
+	if (ctr >= ALL_COUNTER)
+		return -1;
 	*value = 0;
 
-	for (fds = ctr_fds[ctr]; fds && *fds; fds++) {
-		ec = read(*fds, &val, sizeof(val));
+	foreachcpu(pcpu) {
+		ec = read(pcpu->ctr_fds[ctr], &val, sizeof(val));
 		if (ec != sizeof(val)) {
 			eprint("Read() on perf file descriptor failed with errno=%d [%s]\n",
 			       errno, strerror(errno));
+			rc = -1;
 		} else {
 			*value += val;
-			rc = 0;
 		}
 	}
+	endforeachcpu();
 
 	return rc;
 }
 
 int  perf_ecc_supported(void)
 {
-	return ecc_supported;
+	return ctr_state[ECC_FUNCTIONS] != UNSUPPORTED;
+}
+
+int perf_ctr_state(enum ctr_e ctr) {
+	if (ctr < NUM_COUNTER)
+		return ctr_state[ctr];
+	return UNSUPPORTED;
+}
+
+
+int perf_read_pai_ctr(unsigned int ctrnum, int user, uint64_t *value)
+{
+	struct percpucounter *pcpu;
+	unsigned int maxctr;
+	int *arr, ec, rc = 0;
+	uint64_t val;
+
+	*value = 0;
+	maxctr = user ? NUM_PAI_USER : NUM_PAI_KERNEL;
+	if (ctrnum >= maxctr)
+		return -1;
+	foreachcpu(pcpu) {
+		arr = user ? pcpu->pai_user : pcpu->pai_kernel;
+		ec = read(arr[ctrnum], &val, sizeof(val));
+		if (ec != sizeof(val)) {
+			eprint("Read() on perf file descriptor failed with errno=%d [%s]\n",
+			       errno, strerror(errno));
+			rc = -1;
+		} else {
+			*value += val;
+		}
+	}
+	endforeachcpu();
+	return rc;
 }

cpacfstats/stats_sock.c

@@ -3,7 +3,7 @@
  *
  * basic socket and receive/send functions
  *
- * Copyright IBM Corp. 2015, 2017
+ * Copyright IBM Corp. 2015, 2022
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -13,6 +13,7 @@
 #include <endian.h>
 #include <errno.h>
 #include <grp.h>
+#include <poll.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <sys/socket.h>
@@ -148,7 +149,51 @@ static int __read(int fd, void *buf, int buflen)
 }
 
 
-int send_msg(int sfd, struct msg *m)
+static int __timedwrite(int fd, const void *buf, int buflen, int timeout)
+{
+	struct pollfd pfd = { .fd = fd, .events = POLLOUT };
+	int i = 0, n;
+
+	while (poll(&pfd, 1, timeout) == 1) {
+		n = write(fd, buf + i, buflen - i);
+		if (n < 0) {
+			if (errno == EINTR)
+				continue;
+			else
+				return n;
+		} else if (n == 0) {
+			return i;
+		}
+		i += n;
+		if (buflen == i)
+			return i;
+	}
+	return -1;
+}
+
+static int __timedread(int fd, void *buf, int buflen, int timeout)
+{
+	struct pollfd pfd = { .fd = fd, .events = POLLIN };
+	int i = 0, n;
+
+	while (poll(&pfd, 1, timeout) == 1) {
+		n = read(fd, buf + i, buflen - i);
+		if (n < 0) {
+			if (errno == EINTR)
+				continue;
+			else
+				return n;
+		} else if (n == 0) {
+			return i;
+		}
+		i += n;
+		if (buflen == i)
+			return i;
+	}
+	return -1;
+}
+
+int send_msg(int sfd, struct msg *m, int timeout)
 {
 	int n, len;
 
@@ -166,7 +211,7 @@ int send_msg(int sfd, struct msg *m)
 		return -1;
 	}
 
-	n = __write(sfd, m, len);
+	n = timeout ? __timedwrite(sfd, m, len, timeout) : __write(sfd, m, len);
 	if (n != len) {
 		eprint("Write() error: write()=%d expected %d, errno=%d [%s]\n",
 		       n, len, errno, strerror(errno));
@@ -176,12 +221,12 @@ int send_msg(int sfd, struct msg *m)
 	return 0;
 }
 
-int recv_msg(int sfd, struct msg *m)
+int recv_msg(int sfd, struct msg *m, int timeout)
 {
 	int n, len;
 
 	len = sizeof(m->head);
-	n = __read(sfd, m, len);
+	n = timeout ? __timedread(sfd, m, len, timeout) : __read(sfd, m, len);
 	if (n != len) {
 		eprint("Recv() error: read()=%d expected %d, errno=%d [%s]\n",
 		       n, len, errno, strerror(errno));
@@ -200,7 +245,8 @@ int recv_msg(int sfd, struct msg *m)
 		return -1;
 	}
 
-	n = __read(sfd, ((char *)m) + sizeof(m->head), len);
+	n = timeout ? __timedread(sfd, ((char *)m) + sizeof(m->head), len, timeout) :
+		__read(sfd, ((char *)m) + sizeof(m->head), len);
 	if (n != len) {
 		eprint("Recv() error: recv()=%d expected %d, errno=%d [%s]\n",
 		       n, len, errno, strerror(errno));

cpumf/lscpumf.c

@@ -26,6 +26,7 @@
 #include "lib/util_arch.h"
 #include "lib/util_base.h"
 #include "lib/util_opt.h"
+#include "lib/util_path.h"
 #include "lib/util_prg.h"
 
 #include "lib/libcpumf.h"
@@ -3318,17 +3319,18 @@ static void show_info(struct cpumf_info *p, int details)
  * counter was renamed from CCERROR to CCFINISH in linux version 5.8.
  * Check for existence of file /sys/devices/cpum_cf/events/DLFT_CCERROR.
  */
-#define	CCERROR		"/sys/devices/cpum_cf/events/DFLT_CCERROR"
 static void read_ccerror(struct counters *cp, size_t cp_cnt)
 {
+	char *ctrname, *path;
 	struct stat sbuf;
-	char *ctrname;
 	size_t i = 0;
 
-	if (!stat(CCERROR, &sbuf))
+	path = util_path_sysfs("devices/cpum_cf/events/DFLT_CCERROR");
+	if (!stat(path, &sbuf))
 		ctrname = "DFLT_CCERROR";
 	else
 		ctrname = "DFLT_CCFINISH";
+	free(path);
 	/* Find DFLT_CC{FINISH,ERROR} in table and set name */
 	for (struct counters *p = cp; i < cp_cnt; ++i, ++p)
 		if (p->ctrnum == 265) {

cpumf/pai.c

@@ -32,6 +32,7 @@
 #include <linux/perf_event.h>
 
 #include "lib/util_base.h"
+#include "lib/util_file.h"
 #include "lib/util_libc.h"
 #include "lib/util_list.h"
 #include "lib/util_opt.h"
@@ -56,6 +57,7 @@ static cpu_set_t cpu_online_mask;
 static int verbose, humantime;
 static struct util_list list_pai_event;
 static struct util_list list_pmu_event;
+static bool summary;
 
 /* System call to perf_event_open(2) */
 static long perf_event_open(struct perf_event_attr *hw_event, pid_t pid,
@@ -114,7 +116,7 @@ static void ev_alloc(int enr, int cpu, int flags)
 			warnx("NNPA does not support kernel/user space selector");
 			flags &= ~as;
 		}
-		event->attr.type = libcpumf_pmutype(S390_SYSFS_PAI_NNPA);
+		event->attr.type = libcpumf_pmutype(S390_SYSFS_PAI_EXT);
 		break;
 	}
 	event->attr.sample_type = PERF_SAMPLE_TID | PERF_SAMPLE_CPU |
@@ -263,9 +265,11 @@ static int savemap(int fd, void *data, struct data_pos *dp)
 	int wrapped;
 
 	d_head_old = d_head;
-	printf("Data head:%#llx tail:%#llx offset:%#llx size:%#llx\n",
-	       dp->data_head, dp->data_tail, dp->data_offset,
-	       dp->data_size);
+	if (verbose) {
+		printf("Data head:%#llx tail:%#llx offset:%#llx size:%#llx\n",
+		       dp->data_head, dp->data_tail, dp->data_offset,
+		       dp->data_size);
+	}
 	if (!diff)
 		return 0;
 	wrapped = d_head / dp->data_size != d_prev / dp->data_size;
@@ -280,13 +284,16 @@ static int savemap(int fd, void *data, struct data_pos *dp)
 		int part2 = dp->data_size - d_prev;
 
 		diff -= part2;
-		printf("Write %d bytes [%ld,%lld)\n", part2, d_prev,
-		       dp->data_size);
+		if (verbose) {
+			printf("Write %d bytes [%ld,%lld)\n", part2, d_prev,
+			       dp->data_size);
+		}
 		if (write(fd, data + d_prev, part2) == -1)
 			err(EXIT_FAILURE, "write error for event file");
 		d_prev = 0;		/* Start at position zero */
 	}
-	printf("Write %d bytes [%ld,%ld)\n", diff, d_prev, d_head);
+	if (verbose)
+		printf("Write %d bytes [%ld,%ld)\n", diff, d_prev, d_head);
 	if (write(fd, data + d_prev, diff) == -1)
 		err(EXIT_FAILURE, "write error for event file");
 
@@ -299,7 +306,10 @@ static void readmap(int fd)
 	struct pai_event *p = perffd_2_event(fd);
 	struct perf_event_mmap_page *area;
 
-	printf("Ring buffer for fd %d %s(%d)\n", fd, p->file_name, p->file_fd);
+	if (verbose) {
+		printf("Ring buffer for fd %d %s(%d)\n", fd, p->file_name,
+		       p->file_fd);
+	}
 	area = p->map_addr;
 	savemap(p->file_fd, p->map_addr + area->data_offset,
 		(struct data_pos *)&area->data_head);
@@ -383,7 +393,10 @@ static int evtraw_show(__u64 evtnum, unsigned char *p)
 		offset += sizeof(ctr);
 		value = *(__u64 *)(p + offset);
 		offset += sizeof(value);
-		printf("%c%hd:%#llx", offset > 14 ? ',' : ' ', ctr, value);
+		if (!summary) {
+			printf("%c%hd:%#llx", offset > 14 ? ',' : ' ', ctr,
+			       value);
+		}
 		lookup_event(evtnum, ctr, value);
 		if (offset + sizeof(ctr) + sizeof(value) > bytes)
 			break;
@@ -412,6 +425,12 @@ static const char *evt_selector(struct perf_event_attr *pa)
 
 static void evt_show(__u64 evtnum, const char *evtsel, struct pai_event_out *ev)
 {
+	if (summary) {
+		if (ev->type == PERF_RECORD_SAMPLE)
+			evtraw_show(evtnum, ev->raw);
+		return;
+	}
+
 	timestamp(ev->time);
 	printf("%d ", ev->cpu);
 
@@ -633,30 +652,13 @@ bypass:
 	return 0;
 }
 
-/* Read perf_event_open() config value for event. */
-static int read_event(char *dirname, char *filename)
-{
-	int config, rc = 0;
-	char *pathname;
-	FILE *fp;
-
-	util_asprintf(&pathname, "%s/%s", dirname, filename);
-	fp = fopen(pathname, "r");
-	if (fp) {
-		rc = fscanf(fp, "event=%x", &config);
-		fclose(fp);
-	}
-	free(pathname);
-	return rc == 1 ? config : -1;
-}
-
 /* Scan event directory and fill event list. */
 static int scan_events(struct pmu_events *p)
 {
+	char *evtname, *evtdir, *path;
 	struct dirent **de_vec;
 	struct event_name *ep;
-	char *evtdir, *path;
-	int  count, rc;
+	int evtnr, count, rc;
 
 	path = util_path_sysfs("devices");
 	rc = util_asprintf(&evtdir, "%s/%s/events", path, p->name);
@@ -677,8 +679,10 @@ static int scan_events(struct pmu_events *p)
 		if (de_vec[i]->d_type == DT_DIR)
 			continue;
 		ep->name = util_strdup(de_vec[i]->d_name);
-		rc = read_event(evtdir, de_vec[i]->d_name);
-		if (rc == -1 || !ep->name) {
+		util_asprintf(&evtname, "%s/%s", evtdir, de_vec[i]->d_name);
+		rc = util_file_read_va(evtname, "event=%x", &evtnr);
+		free(evtname);
+		if (rc != 1) {
 			for (ep = p->lst, rc = 0; rc < p->lstlen; ++rc, ++ep)
 				free(ep->name);
 			free(p->lst);
@@ -686,7 +690,7 @@ static int scan_events(struct pmu_events *p)
 			rc = -1;
 			goto out;
 		}
-		ep->config = rc;
+		ep->config = evtnr;
 		if (p->base > ep->config)
 			p->base = ep->config;
 		++p->lstlen;
@@ -1005,7 +1009,7 @@ static unsigned long check_mapsize(unsigned long n)
 
 int main(int argc, char **argv)
 {
-	bool crypto_record = false, report = false, summary = false;
+	bool crypto_record = false, report = false;
 	bool nnpa_record = false;
 	unsigned long loop_count = 1;
 	int ch, group = 0;

dasdfmt/dasdfmt.c

@@ -1107,8 +1107,8 @@ static void dasdfmt_write_labels(volume_label_t *vlabel,
 	} else {
 		vlabel->ldl_version = 0xf2; /* EBCDIC '2' */
 		vlabel->formatted_blocks = cylinders * heads * geo.sectors;
-		rc = write(fd, &vlabel->vollbl, (sizeof(*vlabel)
-						 - sizeof(vlabel->volkey)));
+		rc = write(fd, (void *)vlabel + sizeof(vlabel->volkey),
+			   (sizeof(*vlabel) - sizeof(vlabel->volkey)));
 	}
 
 	if (((rc != sizeof(*vlabel) - sizeof(vlabel->formatted_blocks)) &&

dasdview/dasdview.c

@@ -29,6 +29,7 @@
 #include "lib/dasd_sys.h"
 #include "lib/libzds.h"
 #include "lib/util_base.h"
+#include "lib/util_libc.h"
 #include "lib/util_opt.h"
 #include "lib/util_prg.h"
 #include "lib/util_sys.h"
@@ -1788,10 +1789,8 @@ dasdview_print_format1(unsigned int size, unsigned char *dumpstr)
 	for (i = 0; i < size; i++) {
 		if ((i / 16) * 16 == i) {
 			printf("\n|  ");
-			strncpy(asc, (char *)dumpstr + i, 16);
-			strncpy(ebc, (char *)dumpstr + i, 16);
-			asc[16] = '\0';
-			ebc[16] = '\0';
+			util_strlcpy(asc, (char *)dumpstr + i, 16);
+			util_strlcpy(ebc, (char *)dumpstr + i, 16);
 		}
 		printf("%02X", dumpstr[i]);
 		if (((i + 1) / 4)  * 4  == i + 1)
@@ -1822,8 +1821,8 @@ dasdview_print_format2(unsigned int size, unsigned char *dumpstr,
 			       begin + (unsigned long long)i,
 			       begin + (unsigned long long)i);
 
-			strncpy(asc, (char *)dumpstr + i, 8);
-			strncpy(ebc, (char *)dumpstr + i, 8);
+			util_strlcpy(asc, (char *)dumpstr + i, 8);
+			util_strlcpy(ebc, (char *)dumpstr + i, 8);
 		}
 		printf("%02X", dumpstr[i]);
 		if (((i + 1) / 4) * 4 == i + 1)

genprotimg/man/genprotimg.1

@@ -62,7 +62,8 @@ host.
 Specifies the certificate that is used to establish a chain of trust
 for the verification of the host-key documents. Specify this option
 twice to specify the IBM Z signing key and the intermediate CA
-certificate (signed by the root CA). Required.
+certificate (signed by the root CA).
+Required. Ignored if \fB--no-verify\fP is specified.
 .TP
 \fB\-o\fR, \fB\-\-output\fR=\fI\,OUTPUT_FILE\/\fR
 Specifies the output file. Required.
@@ -91,8 +92,9 @@ the system wide root CAs installed on the system is used. Use
 this only if you trust the specified certificate. Optional.
 .TP
 \fB\-\-no-verify\fR
-Do not require the host-key documents to be valid. For testing
-purposes, do not use for a production image. Optional.
+Does not require the host-key documents to be valid.
+Do not use for a production image unless you verified
+the host-key document before. Optional.
 .TP
 \fB\-\-comm\-key\fR=\fI\,FILE\/\fR
 Specifies the encryption key you want to use for the PV guest dump. Use a

genprotimg/src/pv/pv_args.c

@@ -280,7 +280,8 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 		  .arg_data = &args->host_keys,
 		  .description =
 			_("FILE specifies a host-key document. At least\n" INDENT
-			  "one is required."),
+			  "one is required Specify this option multiple times\n" INDENT
+			  "to enable the image to run on more than one host."),
 		  .arg_description = _("FILE") },
 		{ .long_name = "cert",
 		  .short_name = 'C',

genprotimg/src/utils/crypto.c

@@ -447,7 +447,7 @@ static X509_CRL *load_crl_from_bio(BIO *bio)
 		return g_steal_pointer(&crl);
 	ERR_clear_error();
 	rc = BIO_reset(bio);
-	if (rc != 1 || (rc != 0 && BIO_method_type(bio) == BIO_TYPE_FILE))
+	if (rc != 1 && !(rc == 0 && BIO_method_type(bio) == BIO_TYPE_FILE))
 		return NULL;
 
 	/* maybe the CRL is stored in DER format */
@@ -533,7 +533,7 @@ X509 *load_cert_from_file(const char *path, GError **err)
 		return g_steal_pointer(&cert);
 	ERR_clear_error();
 	rc = BIO_reset(bio);
-	if (rc != 1 || (rc != 0 && BIO_method_type(bio) == BIO_TYPE_FILE)) {
+	if (rc != 1 && !(rc == 0 && BIO_method_type(bio) == BIO_TYPE_FILE)) {
 		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_READ_CERTIFICATE,
 			    _("unable to load certificate: '%s'"), path);
 		return NULL;

include/lib/libcpumf.h

@@ -17,7 +17,8 @@
 #define S390_CPUS_ONLINE	"/sys/devices/system/cpu/online"
 #define S390_CPUMSF_BUFFERSZ	"/sys/module/kernel/parameters/cpum_sfb_size"
 #define S390_SYSFS_PAI_CRYPTO	"/sys/devices/pai_crypto/"
-#define S390_SYSFS_PAI_NNPA	"/sys/devices/pai_nnpa/"
+#define S390_SYSFS_PAI_EXT	"/sys/devices/pai_ext/"
+#define S390_SYSFS_PAI_NNPA	S390_SYSFS_PAI_EXT "events/NNPA_ALL"
 
 /**
  * Read out the PMU type from a given file.
@@ -146,6 +147,14 @@ bool libcpumf_sfb_info(unsigned long *min, unsigned long *max);
  */
 bool libcpumf_have_pai_crypto(void);
 
+/**
+ * Return true if PAI_EXTENSION Facility is supported.
+ *
+ * @retval       true     PAI_EXTENSION counter Facility is available
+ * @retval       false    PAI_EXTENSION counter Facility is not available
+ */
+bool libcpumf_have_pai_ext(void);
+
 /**
  * Return true if PAI_NNPA counter Facility is supported. This PMU facility
  * supports the Neural Network Processing Assist (NNPA) counter set.

include/lib/zt_common.h

@@ -21,11 +21,13 @@
  * Usage example:
  *  #define IMAGE_ENTRY _AC(0x10000, UL)
  */
+#ifndef _AC
 #ifdef __ASSEMBLER__
 #define _AC(X, TYPE)	X
 #else
 #define _AC(X, TYPE)	X##TYPE
 #endif
+#endif
 
 
 #ifndef __ASSEMBLER__

iucvterm/include/iucvterm/functions.h

@@ -62,7 +62,7 @@ extern ssize_t __write(int, const void*, size_t);
 extern int strmatch(const char *, const char *);
 extern int is_regex_valid(const char *);
 extern int is_client_allowed(const char *, const struct iucvterm_cfg *);
-extern void userid_cpy(char [8], const char [8]);
+extern void userid_cpy(char [9], const char [8]);
 
 extern void iucv_msg_error(const char *, uint32_t);
 extern void program_error(const char *, const char *);

libcpumf/libcpumf_example.c

@@ -85,5 +85,6 @@ int main(void)
 	}
 
 	printf("PAI NNPA support %d\n", libcpumf_have_pai_nnpa());
+	printf("PAI EXTENSION support %d\n", libcpumf_have_pai_ext());
 	return EXIT_SUCCESS;
 }

libcpumf/libcpumf_support.c

@@ -147,6 +147,13 @@ bool libcpumf_have_pai_crypto(void)
 	return (stat(S390_SYSFS_PAI_CRYPTO, &statbuf) == -1) ? false : true;
 }
 
+bool libcpumf_have_pai_ext(void)
+{
+	struct stat statbuf;
+
+	return (stat(S390_SYSFS_PAI_EXT, &statbuf) == -1) ? false : true;
+}
+
 bool libcpumf_have_pai_nnpa(void)
 {
 	struct stat statbuf;

libpv/Makefile

@@ -51,7 +51,7 @@ endif
 sources := $(wildcard *.c)
 objects := $(patsubst %.c,%.o,$(sources))
 
-all: $(BUILD_TARGETS) .check_dep-$(LIB)
+all: $(BUILD_TARGETS)
 
 $(LIB): $(objects)
 $(LIB): ALL_CFLAGS += -fPIC
@@ -74,7 +74,7 @@ skip-$(LIB):
 .detect-openssl.dep.c:
 	echo "#include <openssl/evp.h>" > $@
 	echo "#if OPENSSL_VERSION_NUMBER < 0x10101000L" >> $@
-	echo "  #error openssl version 1.1.0 is required" >> $@
+	echo "  #error openssl version 1.1.1 is required" >> $@
 	echo "#endif" >> $@
 	echo "static void __attribute__((unused)) test(void) {" >> $@
 	echo "    EVP_MD_CTX *ctx = EVP_MD_CTX_new();" >> $@
@@ -90,7 +90,7 @@ skip-$(LIB):
 	$(call check_dep, \
 		"$(LIB)", \
 		$^, \
-		"openssl-devel / libssl-dev version >= 1.1.0", \
+		"openssl-devel / libssl-dev version >= 1.1.1", \
 		"HAVE_OPENSSL=0", \
 		"-I.")
 	$(call check_dep, \

libpv/cert.c

@@ -492,7 +492,9 @@ static X509_CRL *load_crl_by_dist_point(DIST_POINT *crldp, GError **error)
 X509_CRL *pv_load_first_crl_by_cert(X509 *cert, GError **error)
 {
 	g_autoptr(STACK_OF_DIST_POINT) crldps = NULL;
+	g_autoptr(GError) last_error = NULL;
 	g_autoptr(X509_CRL) ret = NULL;
+	int dist_points_cnt;
 
 	g_assert(cert);
 
@@ -503,19 +505,24 @@ X509_CRL *pv_load_first_crl_by_cert(X509 *cert, GError **error)
 		return NULL;
 	}
 
-	for (int i = 0; i < sk_DIST_POINT_num(crldps); i++) {
+	dist_points_cnt = sk_DIST_POINT_num(crldps);
+	for (int i = 0; i < dist_points_cnt; i++) {
 		DIST_POINT *crldp = sk_DIST_POINT_value(crldps, i);
-
 		g_assert(crldp);
 
-		/* ignore error */
-		ret = load_crl_by_dist_point(crldp, NULL);
+		g_clear_error(&last_error);
+		ret = load_crl_by_dist_point(crldp, &last_error);
 		if (ret)
 			return g_steal_pointer(&ret);
 	}
 
-	g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_FAILED_DOWNLOAD_CRL,
-		    _("failed to download CRL"));
+	/* relabel error */
+	if (last_error)
+		g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_FAILED_DOWNLOAD_CRL,
+		     "%s", last_error->message);
+	else
+		g_set_error(error, PV_CERT_ERROR, PV_CERT_ERROR_FAILED_DOWNLOAD_CRL,
+		     _("failed to download CRL"));
 	return NULL;
 }
 

libpv/crypto.c

@@ -41,7 +41,7 @@ int pv_BIO_reset(BIO *b)
 {
 	int rc = BIO_reset(b);
 
-	if (rc != 1 && (BIO_method_type(b) == BIO_TYPE_FILE && rc != 0))
+	if (rc != 1 && !(BIO_method_type(b) == BIO_TYPE_FILE && rc == 0))
 		return -1;
 	return 1;
 }

libutil/util_panic.c

@@ -22,7 +22,7 @@
 /*
  * Obtain a backtrace and print it to stderr
  *
- * To get symbols, compile the code with "-rdynamic".
+ * To get symbols, link the code with "-rdynamic".
  */
 static void print_backtrace(void)
 {

libvmdump/register_content.h

@@ -50,6 +50,7 @@ public:
 	RegisterSet64 getRegisterSet(int cpu);
 	void addRegisterSet(const RegisterSet64&);
 	inline int getNumCpus(void) const { return nrCpus; }
+	RegisterContent64& operator=(const RegisterContent64&) = default;
 
 	RegisterSet64 regSets[MAX_CPUS];
 private:
@@ -64,6 +65,7 @@ public:
 	RegisterSet32 getRegisterSet(int cpu);
 	void addRegisterSet(const RegisterSet32&);
 	inline int getNumCpus(void) const { return nrCpus; }
+	RegisterContent32& operator=(const RegisterContent32&) = default;
 
 	RegisterSet32 regSets[MAX_CPUS];
 private:

mon_tools/mon_procd.c

@@ -248,7 +248,7 @@ static void count_users(void)
 	proc_sum.users = 0;
 	setutent();
 	while ((temp = getutent())) {
-		if ((temp->ut_type == USER_PROCESS) && (temp->ut_name))
+		if (temp->ut_type == USER_PROCESS)
 			proc_sum.users++;
 	}
 	endutent();
@@ -859,8 +859,6 @@ static void read_tasks(void)
 	}
 
 	while ((entry = readdir(proc_dir))) {
-		if (!entry->d_name)
-			break;
 		if (!isdigit(entry->d_name[0]) || !atoi(entry->d_name))
 			continue;
 		memset(&task, 0, sizeof(struct task_t));

pvattest/man/pvattest-create.1

@@ -9,16 +9,22 @@
 \fBpvattest [OPTION?] create [OPTIONS] \fP- create an attestation measurement request
 \fB
 .SH DESCRIPTION
-Prepare attestation measurement requests for an IBM Secure Execution guest. Only prepare attestation requests in a trusted environment, such as your workstation. The 'pvattest create' command creates a randomly generated key to protect the attestation request. This key is only valid for this specific request.In order to avoid compromising the attestation, do not publish the protection key and delete it after verification. Every 'create' command generates a new, random protection key.
+Prepare attestation measurement requests for an IBM Secure Execution guest.
+Only prepare attestation requests in a trusted environment, such as your workstation.
+The 'pvattest create' command creates a randomly generated key to protect the attestation request.
+This key is only valid for this specific request. In order to avoid compromising the attestation,
+do not publish the protection key and delete it after verification.
+Every 'create' command generates a new, random protection key.
 .SH OPTIONS
 .TP
 .B
 \fB-h\fP, \fB--help\fP
-Show help options
+Prints usage information, then exits.
 .TP
 .B
 \fB-k\fP, \fB--host-key-document\fP=\fBFILE\fP
-Specify one or more host key documents.
+Specify one or more host key documents. At least one is required.
+Specify this option multiple times to enable the image to run on more than one host.
 .TP
 .B
 \fB-C\fP, \fB--cert\fP=\fBFILE\fP
@@ -26,11 +32,14 @@ Specifies  the  certificate that is used to establish a chain of trust for the v
 .TP
 .B
 \fB--crl\fP=\fBFILE\fP
-Specify \fBFILE\fP to be a certificate revocation list (optional).
+Specifies the revocation list that is used to check whether a certificate of the chain of trust is
+revoked. Specify this option multiple times to use multiple CRLs (optional).
 .TP
 .B
 \fB--root-ca\fP=\fBFILE\fP
-Use \fBFILE\fP as the trusted root CA instead the root CAs that are installed on the system (optional).
+Specifies the root CA certificate for the verification. If omitted,
+the system wide root CAs installed on the system are used. Use
+this only if you trust the specified certificate. Optional.
 .TP
 .B
 \fB-o\fP, \fB--output\fP=\fBFILE\fP
@@ -42,15 +51,16 @@ Save the protection key as GCM-AES256 key in \fBFILE\fP Do not publish this key,
 .TP
 .B
 \fB--no-verify\fP
-Disable the host-key-document verification. Does not require the host-key documents to be valid. For testing purposes, do not use for a production image. (Optional)
+Disable the host-key document verification. Does not require the host-key documents to be valid. Do
+not use for a production request unless you verified the host-key document before (optional).
 .TP
 .B
 \fB--offline\fP
-Don't download CRLs (optional).
+Specifies offline mode, in which no attempt is made to download CRLs. (optional).
 .TP
 .B
 \fB-V\fP, \fB--verbose\fP
-Provide more detailed output (optional)
+Provide more detailed output (optional).
 .SH EXAMPLE
 Create an attestation request with the protection key 'arp.key', write the request to 'arcb.bin', and verify the host-key document using the CA-signed key 'DigiCertCA.crt' and the intermediate key 'IbmSigningKey.crt'.
 .PP

pvattest/man/pvattest-perform.1

@@ -9,7 +9,10 @@
 \fBpvattest [OPTION?] perform [OPTIONS] \fP- execute an attestation measurement request
 \fB
 .SH DESCRIPTION
-Run a measurement of this system using '/dev/uv'. Works only if this device is available and the attestation Ultravisor facility is present. The input must be an attestation request created with 'pvattest create'. Output will contain the original request, the attestation measurement result, the configuration UID, and if requested in the request Additional Data.
+Run a measurement of this system using '/dev/uv'. Works only if this device is
+available and the attestation Ultravisor facility is present.
+The input must be an attestation request created with 'pvattest create'.
+Output will contain the original request and the response from the Ultravisor.
 .RE
 .PP
 

pvattest/src/Makefile

@@ -4,12 +4,11 @@ BIN_PROGRAM = pvattest
 PKGDATADIR ?= "$(DESTDIR)$(TOOLS_DATADIR)/$(BIN_PROGRAM)"
 
 SRC_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
-ROOT_DIR = $(rootdir)
-PVATTESTDIR := $(ROOT_DIR)/pvattest
-INCLUDE_PATHS = "$(SRC_DIR)" "$(ROOT_DIR)/include"
+PVATTESTDIR := $(rootdir)/pvattest
+INCLUDE_PATHS = "$(SRC_DIR)" "$(rootdir)/include"
 INCLUDE_PARMS = $(addprefix -I,$(INCLUDE_PATHS))
 
-LIBPV_DIR = $(ROOT_DIR)/libpv
+LIBPV_DIR = $(rootdir)/libpv
 LIBPV = $(LIBPV_DIR)/libpv.a
 
 WARNINGS := -Wall -Wextra -Wshadow \
@@ -73,7 +72,7 @@ endif
 endif
 endif
 
-all: $(BUILD_TARGETS) .check-dep-$(BIN_PROGRAM)
+all: $(BUILD_TARGETS)
 
 install: $(INSTALL_TARGETS)
 
@@ -97,7 +96,7 @@ $($(BIN_PROGRAM)_OBJS): .check-dep-$(BIN_PROGRAM)
 .detect-openssl.dep.c:
 	echo "#include <openssl/evp.h>" > $@
 	echo "#if OPENSSL_VERSION_NUMBER < 0x10101000L" >> $@
-	echo "  #error openssl version 1.1.0 is required" >> $@
+	echo "  #error openssl version 1.1.1 is required" >> $@
 	echo "#endif" >> $@
 	echo "static void __attribute__((unused)) test(void) {" >> $@
 	echo "    EVP_MD_CTX *ctx = EVP_MD_CTX_new();" >> $@
@@ -112,8 +111,8 @@ $($(BIN_PROGRAM)_OBJS): .check-dep-$(BIN_PROGRAM)
 		"HAVE_GLIB2=0")
 	$(call check_dep, \
 		"$(BIN_PROGRAM)", \
-		"openssl/evp.h", \
-		"openssl-devel / libssl-dev version >= 1.1.0", \
+		$^, \
+		"openssl-devel / libssl-dev version >= 1.1.1", \
 		"HAVE_OPENSSL=0", \
 		"-I.")
 	$(call check_dep, \

pvattest/src/argparse.c

@@ -156,76 +156,75 @@ static gboolean hex_str_toull(const char *nptr, uint64_t *dst, GError **error)
 
 /************************* SHARED OPTIONS *************************************/
 /* NOTE REQUIRED */
-#define _entry_host_key_document(__arg_data, __indent)                                            \
-	{                                                                                         \
-		.long_name = "host-key-document", .short_name = 'k', .flags = G_OPTION_FLAG_NONE, \
-		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,                       \
-		.description = "Specify one or more host key documents.\n",                       \
-		.arg_description = "FILE",                                                        \
+#define _entry_host_key_document(__arg_data, __indent)                                             \
+	{                                                                                          \
+		.long_name = "host-key-document", .short_name = 'k', .flags = G_OPTION_FLAG_NONE,  \
+		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,                        \
+		.description =                                                                     \
+			"FILE specifies a host-key document. At least one is required.\n" __indent \
+			"Specify this option multiple times to enable the request for\n" __indent  \
+			"more than one host.\n",                                                   \
+		.arg_description = "FILE",                                                         \
 	}
 
 /* NOTE REQUIRED */
-#define _entry_certs(__arg_data, __indent)                                                            \
-	{                                                                                             \
-		.long_name = "cert", .short_name = 'C', .flags = G_OPTION_FLAG_NONE,                  \
-		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,                           \
-		.description =                                                                        \
-			"Specifies  the  certificate that is used to establish a chain\n" __indent    \
-			"of trust for the verification of the host-key documents. Specify\n" __indent \
-			"this option twice to specify the IBM Z signing key and the\n" __indent       \
-			"intermediate CA certificate (signed by the root CA). Required.\n" __indent   \
-			"Ignored when --no-verify is specified.\n",                                   \
-		.arg_description = "FILE",                                                            \
+#define _entry_certs(__arg_data, __indent)                                                  \
+	{                                                                                   \
+		.long_name = "cert", .short_name = 'C', .flags = G_OPTION_FLAG_NONE,        \
+		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,                 \
+		.description = "FILE contains a certificate that is used to\n" __indent     \
+			       "establish a chain of trust for the verification\n" __indent \
+			       "of the host-key documents. The IBM Z signing\n" __indent    \
+			       "key and intermediate CA certificate (signed\n" __indent     \
+			       "by the root CA) are required.\n",                           \
+		.arg_description = "FILE",                                                  \
 	}
 
 /* NOTE REQUIRED */
-#define _entry_crls(__arg_data, __indent)                                                    \
-	{                                                                                    \
-		.long_name = "crl", .short_name = 0, .flags = G_OPTION_FLAG_NONE,            \
-		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,                  \
-		.description = "Specify FILE to be a certificate revocation list\n" __indent \
-			       "(optional).",                                                \
-		.arg_description = "FILE",                                                   \
+#define _entry_crls(__arg_data, __indent)                                                   \
+	{                                                                                   \
+		.long_name = "crl", .short_name = 0, .flags = G_OPTION_FLAG_NONE,           \
+		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,                 \
+		.description = "FILE contains a certificate revocation list (optional).\n", \
+		.arg_description = "FILE",                                                  \
 	}
 
 /* NOTE REQUIRED */
-#define _entry_root_ca(__arg_data, __indent)                                            \
-	{                                                                               \
-		.long_name = "root-ca", .short_name = 0, .flags = G_OPTION_FLAG_NONE,   \
-		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,             \
-		.description = "Use FILE as the trusted root CA instead the\n" __indent \
-			       "root CAs that are installed on the system (optional).", \
-		.arg_description = "FILE",                                              \
+#define _entry_root_ca(__arg_data, __indent)                                              \
+	{                                                                                 \
+		.long_name = "root-ca", .short_name = 0, .flags = G_OPTION_FLAG_NONE,     \
+		.arg = G_OPTION_ARG_FILENAME_ARRAY, .arg_data = __arg_data,               \
+		.description = "Use FILE as the trusted root CA instead the\n" __indent   \
+			       "root CAs that are installed on the system (optional).\n", \
+		.arg_description = "FILE",                                                \
 	}
 
 /* NOTE REQUIRED */
-#define _entry_guest_hdr(__arg_data, __indent)                                               \
-	{                                                                                    \
-		.long_name = "hdr", .short_name = 0, .flags = G_OPTION_FLAG_NONE,            \
-		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                        \
-		.description =                                                               \
-			"Specify the header of the guest image. Exactly one is required.\n", \
-		.arg_description = "FILE",                                                   \
+#define _entry_guest_hdr(__arg_data, __indent)                                            \
+	{                                                                                 \
+		.long_name = "hdr", .short_name = 0, .flags = G_OPTION_FLAG_NONE,         \
+		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                     \
+		.description = "FILE specifies the header of the guest image.\n" __indent \
+			       "Exactly one is required.\n",                              \
+		.arg_description = "FILE",                                                \
 	}
 
 /* NOTE REQUIRED */
-#define _entry_input(__arg_data, __additional_text, __indent)                         \
-	{                                                                             \
-		.long_name = "input", .short_name = 'i', .flags = G_OPTION_FLAG_NONE, \
-		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                 \
-		.description = "FILE specifies the " __additional_text "\n" __indent  \
-			       " as input.\n",                                        \
-		.arg_description = "FILE",                                            \
+#define _entry_input(__arg_data, __additional_text, __indent)                          \
+	{                                                                              \
+		.long_name = "input", .short_name = 'i', .flags = G_OPTION_FLAG_NONE,  \
+		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                  \
+		.description = "FILE specifies the " __additional_text " as input.\n", \
+		.arg_description = "FILE",                                             \
 	}
 
 /* NOTE REQUIRED */
-#define _entry_output(__arg_data, __additional_text, __indent)                                  \
-	{                                                                                       \
-		.long_name = "output", .short_name = 'o', .flags = G_OPTION_FLAG_NONE,          \
-		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                           \
-		.description = "FILE specifies the output for the\n" __indent __additional_text \
-			       ".\n",                                                           \
-		.arg_description = "FILE",                                                      \
+#define _entry_output(__arg_data, __additional_text, __indent)                              \
+	{                                                                                   \
+		.long_name = "output", .short_name = 'o', .flags = G_OPTION_FLAG_NONE,      \
+		.arg = G_OPTION_ARG_FILENAME, .arg_data = __arg_data,                       \
+		.description = "FILE specifies the output for the " __additional_text "\n", \
+		.arg_description = "FILE",                                                  \
 	}
 
 /* NOTE REQUIRED */
@@ -254,7 +253,7 @@ static gboolean hex_str_toull(const char *nptr, uint64_t *dst, GError **error)
 	{                                                                                \
 		.long_name = "x-phkh-img", .short_name = 0, .flags = G_OPTION_FLAG_NONE, \
 		.arg = G_OPTION_ARG_NONE, .arg_data = __arg_data,                        \
-		.description = "add the public host key hash of the\n" __indent          \
+		.description = "Add the public host key hash of the\n" __indent          \
 			       "image header used to decrypt\n" __indent                 \
 			       "the secure guest to the measurement. (optional)\n"       \
 	}
@@ -263,34 +262,31 @@ static gboolean hex_str_toull(const char *nptr, uint64_t *dst, GError **error)
 	{                                                                                 \
 		.long_name = "x-phkh-att", .short_name = 0, .flags = G_OPTION_FLAG_NONE,  \
 		.arg = G_OPTION_ARG_NONE, .arg_data = __arg_data,                         \
-		.description = "add the public host key hash of the\n" __indent           \
+		.description = "Add the public host key hash of the\n" __indent           \
 			       "attestation header used to decrypt\n" __indent            \
 			       "the attestation request to the measurement. (optional)\n" \
 	}
 
-#define _entry_no_verify(__arg_data, __indent)                                                \
-	{                                                                                     \
-		.long_name = "no-verify", .short_name = 0, .flags = G_OPTION_FLAG_NONE,       \
-		.arg = G_OPTION_ARG_NONE, .arg_data = __arg_data,                             \
-		.description =                                                                \
-			"Disable the host-key-document verification.\n" __indent              \
-			"Does not require the host-key documents to be valid.\n" __indent     \
-			"For testing purposes, do not use for a production image.\n" __indent \
-			"(optional)\n",                                                       \
+#define _entry_no_verify(__arg_data, __indent)                                          \
+	{                                                                               \
+		.long_name = "no-verify", .short_name = 0, .flags = G_OPTION_FLAG_NONE, \
+		.arg = G_OPTION_ARG_NONE, .arg_data = __arg_data,                       \
+		.description = "Disable the host-key document verification.\n" __indent \
+			       "(optional)\n",                                          \
 	}
 
 #define _entry_offline_maps_to_online(__arg_data, __indent)                              \
 	{                                                                                \
 		.long_name = "offline", .short_name = 0, .flags = G_OPTION_FLAG_REVERSE, \
 		.arg = G_OPTION_ARG_NONE, .arg_data = __arg_data,                        \
-		.description = "Don't download CRLs (optional).\n",                      \
+		.description = "Don't download CRLs. (optional)\n",                      \
 	}
 
 #define _entry_verbose(__indent)                                                          \
 	{                                                                                 \
 		.long_name = "verbose", .short_name = 'V', .flags = G_OPTION_FLAG_NO_ARG, \
 		.arg = G_OPTION_ARG_CALLBACK, .arg_data = &increase_log_lvl,              \
-		.description = "Provide more detailed output (optional)\n",               \
+		.description = "Provide more detailed output. (optional)\n",              \
 		.arg_description = NULL,                                                  \
 	}
 

pvattest/src/exchange_format.c

@@ -455,8 +455,8 @@ static void print_entry(const char *name, GBytes *data, const gboolean print_dat
 	fprintf(stream, _("%s (%#lx bytes)"), name, g_bytes_get_size(data));
 	if (print_data) {
 		fprintf(stream, ":\n");
-		printf_hexdump(g_bytes_get_data(data, NULL), g_bytes_get_size(data), 16, "      ",
-			       stream);
+		pvattest_hexdump(g_bytes_get_data(data, NULL), g_bytes_get_size(data), 16, "      ",
+				 stream);
 	}
 	fprintf(stream, "\n");
 }

pvattest/src/log.c

@@ -131,26 +131,35 @@ void pvattest_log_plain_logger(const char *log_domain G_GNUC_UNUSED, GLogLevelFl
 	_log_logger(level, message, log_level, FALSE, "");
 }
 
-void hexdump(const void *data, size_t size, size_t len, const char *prefix, GLogLevelFlags log_lvl)
+void pvattest_log_bytes(const void *data, size_t size, size_t width, const char *prefix,
+			gboolean beautify, GLogLevelFlags log_lvl)
 {
 	const uint8_t *data_b = data;
 
 	pv_wrapped_g_assert(data);
 
-	g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, log_lvl, "%s0x0000  ", prefix);
+	if (beautify)
+		g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, "%s0x0000  ", prefix);
+	else
+		g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, "%s", prefix);
 	for (size_t i = 0; i < size; i++) {
-		g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, log_lvl, "%02x", data_b[i]);
-		if (i % 2 == 1)
-			g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, log_lvl, " ");
+		g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, "%02x", data_b[i]);
+		if (i % 2 == 1 && beautify)
+			g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, " ");
 		if (i == size - 1)
 			break;
-		if (i % len == len - 1)
-			g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, log_lvl, "\n%s0x%04lx  ", prefix, i + 1);
+		if (i % width == width - 1) {
+			if (beautify)
+				g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, "\n%s0x%04lx  ", prefix,
+				      i + 1);
+			else
+				g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, "\n%s", prefix);
+		}
 	}
-	g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, log_lvl, "\n");
+	g_log(PVATTEST_BYTES_LOG_DOMAIN, log_lvl, "\n");
 }
 
-void printf_hexdump(const void *data, size_t size, size_t len, const char *prefix, FILE *stream)
+void pvattest_hexdump(const void *data, size_t size, size_t width, const char *prefix, FILE *stream)
 {
 	const uint8_t *data_b = data;
 
@@ -164,7 +173,7 @@ void printf_hexdump(const void *data, size_t size, size_t len, const char *prefi
 			fprintf(stream, " ");
 		if (i == size - 1)
 			break;
-		if (i % len == len - 1)
+		if (i % width == width - 1)
 			fprintf(stream, "\n%s0x%04lx  ", prefix, i + 1);
 	}
 	fprintf(stream, "\n");

pvattest/src/log.h

@@ -23,7 +23,7 @@
 #define PVATTEST_LOG_LVL_DEFAULT PVATTEST_LOG_LVL_WARNING
 #define PVATTEST_LOG_LVL_MAX PVATTEST_LOG_LVL_DEBUG
 
-#define PVATTEST_HEXDUMP_LOG_DOMAIN "pvattest_hdump"
+#define PVATTEST_BYTES_LOG_DOMAIN "pvattest_bytes"
 
 void pvattest_log_increase_log_lvl(int *log_lvl);
 void pvattest_log_error(const char *format, ...);
@@ -45,22 +45,22 @@ void pvattest_log_default_logger(const char *log_domain, GLogLevelFlags level, c
  */
 void pvattest_log_plain_logger(const char *log_domain, GLogLevelFlags level, const char *message,
 			       void *user_data);
-#define dhexdump(v, s)                                                            \
-	{                                                                         \
-		pvattest_log_debug("%s (%li byte):", #v, s);                      \
-		hexdump(v, s, 16L, "    ", PVATTEST_LOG_LVL_DEBUG);               \
-		g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, PVATTEST_LOG_LVL_DEBUG, "\n"); \
-	}
-#define gbhexdump(v)                                                                 \
+#define dhexdump(v, s)                                                               \
 	{                                                                            \
-		pvattest_log_debug("%s:(%li byte):", #v, g_bytes_get_size(v));       \
-		hexdump(g_bytes_get_data(v, NULL), g_bytes_get_size(v), 16L, "    ", \
-			PVATTEST_LOG_LVL_DEBUG);                                     \
-		g_log(PVATTEST_HEXDUMP_LOG_DOMAIN, PVATTEST_LOG_LVL_DEBUG, "\n");    \
+		pvattest_log_debug("%s (%li byte):", #v, s);                         \
+		pvattest_log_bytes(v, s, 16L, "    ", TRUE, PVATTEST_LOG_LVL_DEBUG); \
+		g_log(PVATTEST_BYTES_LOG_DOMAIN, PVATTEST_LOG_LVL_DEBUG, "\n");      \
 	}
-void hexdump(const void *data, size_t size, size_t len, const char *prefix, GLogLevelFlags log_lvl)
-	PV_NONNULL(1);
-void printf_hexdump(const void *data, size_t size, size_t len, const char *prefix, FILE *stream)
+#define gbhexdump(v)                                                                            \
+	{                                                                                       \
+		pvattest_log_debug("%s:(%li byte):", #v, g_bytes_get_size(v));                  \
+		pvattest_log_bytes(g_bytes_get_data(v, NULL), g_bytes_get_size(v), 16L, "    ", \
+				   TRUE, PVATTEST_LOG_LVL_DEBUG);                               \
+		g_log(PVATTEST_BYTES_LOG_DOMAIN, PVATTEST_LOG_LVL_DEBUG, "\n");                 \
+	}
+void pvattest_log_bytes(const void *data, size_t size, size_t width, const char *prefix,
+			gboolean beautify, GLogLevelFlags log_lvl) PV_NONNULL(1);
+void pvattest_hexdump(const void *data, size_t size, size_t width, const char *prefix, FILE *stream)
 	PV_NONNULL(1, 5);
 void pvattest_log_GError(const char *info, GError *error) PV_NONNULL(1);
 

pvattest/src/pvattest.c

@@ -322,8 +322,17 @@ static int do_verify(pvattest_verify_config_t *verify_config)
 		return PVATTEST_EXIT_MEASURE_NOT_VERIFIED;
 	}
 
-	pvattest_log_debug(_("Measurement verified."));
+	pvattest_log_info(_("Attestation measurement verified"));
+	pvattest_log_info(_("Config UID:"));
+	pvattest_log_bytes(g_bytes_get_data(config_uid, NULL), g_bytes_get_size(config_uid), 16L,
+			   "", FALSE, PVATTEST_LOG_LVL_INFO);
 
+	if (additional_data) {
+		pvattest_log_info(_("\nAdditional Data:"));
+		pvattest_log_bytes(g_bytes_get_data(additional_data, NULL),
+				   g_bytes_get_size(additional_data), 16L, "", FALSE,
+				   PVATTEST_LOG_LVL_INFO);
+	}
 	return EXIT_SUCCESS;
 
 err_exit:
@@ -355,7 +364,7 @@ int main(int argc, char *argv[])
 	 * message)to filter messages based on the log level specified by the
 	 * user.
 	 */
-	g_log_set_handler(PVATTEST_HEXDUMP_LOG_DOMAIN,
+	g_log_set_handler(PVATTEST_BYTES_LOG_DOMAIN,
 			  G_LOG_LEVEL_MASK | G_LOG_FLAG_FATAL | G_LOG_FLAG_RECURSION,
 			  &pvattest_log_plain_logger, &appl_log_lvl);
 

pvattest/src/uvio.c

@@ -156,6 +156,8 @@ int uvio_open(const char *uv_path, GError **error)
 const char *uvio_uv_rc_to_str(const int rc)
 {
 	switch (rc) {
+	case 0x02:
+		return _("Invalid UV command");
 	case 0x106:
 		return _("Unsupported attestation request version");
 	case 0x108:

pvattest/tools/pvattest-info

@@ -0,0 +1,88 @@
+#!/bin/bash
+#
+# pvattest-info - get additional information from an attestation measurement
+#
+# Sample:
+# ./pvattest-info attestresp.bin
+#
+# Copyright IBM Corp. 2022
+#
+# s390-tools is free software; you can redistribute it and/or modify
+# it under the terms of the MIT license. See LICENSE for details.
+
+set -o pipefail
+set -o nounset
+set -e
+
+usage() {
+	cat <<-EOF
+		Usage: $(basename "$0") FILE
+
+		Prints config UID and additional data if available.
+	EOF
+}
+
+function check_is_pvattest_binary() {
+	local input="$1"
+	local size
+	local version
+
+	size=$(wc -c <"$input")
+	if [ "$size" -lt 64 ]; then
+		echo "ERROR: Input file is too small." >&2
+		exit 1
+	fi
+
+	xxd -l 16 "${input}" | grep -q pvattest ||
+		{ echo "ERROR: ${input} does not contain a pvattest binary output." >&2 && exit 1; }
+
+	size=$(xxd -s 12 -l 4 "${input}" | awk 'NR==1 {print "0x" $2 $3}')
+	if [ $((size)) -lt 64 ]; then
+		echo "ERROR: ${input} does not contain a pvattest binary output." >&2
+		exit 1
+	fi
+
+	version=$(xxd -s 8 -l 4 "$input")
+	echo "$version" | grep -q "0000 0100" ||
+		{ echo -n "WARNING: unknown hdr version " >&2  &&
+		echo "$version" | awk '{print "0x" $2 $3}'>&2 ; }
+}
+
+function print_entry() {
+	local file_off="$1"
+	local text="$2"
+	local input="$3"
+	local size
+	local off
+
+	size=$(xxd -s $((file_off)) -l 4 "${input}" | awk 'NR==1 {print "0x" $2 $3}')
+	off=$(xxd -s $((file_off + 4)) -l 4 "${input}" | awk 'NR==1 {print "0x" $2 $3}')
+
+	if [[ $size != "0x00000000" ]] || [[ $off != "0x00000000" ]]; then
+		echo "${text}:"
+		xxd -s $((off)) -l $((size)) -p "${input}"
+	fi
+}
+
+function require_command() {
+	local cmd="$1"
+
+	command -v "$cmd" >/dev/null 2>&1 || { echo >&2 "ERROR: $cmd required but not installed."; exit 1;  }
+}
+
+require_command xxd
+require_command awk
+require_command wc
+
+if [ $# -eq 0 ]; then
+	echo "ERROR: Input not set. Use '$(basename "$0") [FILE]' to specify the Input file" >&2
+	exit 1
+fi
+
+input="$1"
+
+[ -e "$input" ] || { echo "ERROR: File '$1' not found" >&2 && exit 1; }
+check_is_pvattest_binary "$input"
+
+print_entry 0x38 "Config UID" "$input"
+print_entry 0x28 "Additional Data" "$input"

scripts/dbginfo.sh

@@ -450,7 +450,7 @@ CMDS="${CMDS}\
   :lszdev\
   :find /dev -print0 | sort -z | xargs -0 -n 10 ls -ld\
   :lspci -t\
-  :lspci -vv\
+  :lspci -vvv\
   :lstape\
   :smc_dbg\
   "
@@ -786,6 +786,7 @@ collect_sysfs() {
 		    -x '*/tracing/trace_pipe*' \
 		    -x '*/page_idle/bitmap*' \
 		    -x '*/tracing/per_cpu/*' \
+		    -x '*/tracing/free_buffer' \
 		    --ignore-failed-read -J 1 -T 5 2>>${OUTPUT_FILE_SYSFS}.err
 		rc=$?
 	else
@@ -812,6 +813,7 @@ collect_sysfs() {
 		    -a -not \( -path '*tracing*' -a -name "trace_pipe*" \) \
 		    -a -not \( -path '*page_idle*' -a -name 'bitmap*' \) \
 		    -a -not -path '*tracing/per_cpu*' \
+		    -a -not -path '*/tracing/free_buffer' \
 		    2>/dev/null | while IFS= read -r file_name; do
 			echo " ${file_name}"
 			if ! dd if="${file_name}" status=noxfer iflag=nonblock \

systemd/dumpconf.service.in

@@ -9,6 +9,7 @@
 
 [Unit]
 Description=Configure dump on panic for System z
+ConditionVirtualization=!container
 After=network.target
 
 [Service]

zdev/dracut/Makefile

@@ -1,7 +1,6 @@
 # Common definitions
 include ../../common.mak
 
-MODDIR := /usr/lib/dracut/modules.d/
 ZDEVDIR := 95zdev
 
 # HAVE_DRACUT
@@ -16,9 +15,9 @@ ZDEVDIR := 95zdev
 #
 ifeq ($(HAVE_DRACUT),1)
 install:
-	$(INSTALL) -m 755 -d $(DESTDIR)$(MODDIR)
-	$(INSTALL) -m 755 -d $(DESTDIR)$(MODDIR)/$(ZDEVDIR)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(DRACUTMODDIR)/
+	$(INSTALL) -m 755 -d $(DESTDIR)$(DRACUTMODDIR)/$(ZDEVDIR)
 	$(INSTALL) -m 755 $(ZDEVDIR)/module-setup.sh \
 		$(ZDEVDIR)/parse-zdev.sh \
-		$(DESTDIR)$(MODDIR)/$(ZDEVDIR)/
+		$(DESTDIR)$(DRACUTMODDIR)/$(ZDEVDIR)/
 endif

zdev/man/chzdev.8

@@ -690,6 +690,29 @@ Answer all confirmation questions with 'yes'.
 .RE
 .PP
 .
+If you intend to assign a cryptographic (AP) adapter or domain to a KVM
+guest you must first release its usage by the zcrypt driver in the host
+operating system using chzdev commands similar to the following examples:
+.
+.PP
+.B Remove AP adapters 1 and 20 through 22 from host usage:
+.RS 4
+.CL chzdev \-\-type ap apmask=-1,-20-22
+.RE
+.PP
+.
+.B Return AP domains 5 and 8 through 10 to host usage:
+.RS 4
+.CL chzdev \-\-type ap aqmask=+5,+8-10
+.RE
+.PP
+.
+.B Specify the list of AP adapters and domains available for host usage:
+.RS 4
+.CL chzdev \-\-type ap apmask=0-120,129-255 aqmask=0-200,220-255
+.RE
+.PP
+.
 .
 .SH "EXIT CODES"
 .TP

zdev/man/lszdev.8

@@ -429,6 +429,12 @@ Print additional run-time information.
 .RE
 .PP
 .
+.B Display cryptographic (AP) adapter and domain assignments:
+.RS 4
+.CL lszdev \-\-type ap
+.RE
+.PP
+.
 .SH "EXIT CODES"
 lszdev returns a subset of the exit codes returned by the chzdev tool. See
 .MP chzdev 8

zdev/udev/Makefile

@@ -1,9 +1,8 @@
 # Common definitions
 include ../../common.mak
 
-UDEVDIR := /usr/lib/udev/rules.d/
 RULES := 81-dpm.rules
 
 install:
-	$(INSTALL) -m 755 -d $(DESTDIR)$(UDEVDIR)
-	$(INSTALL) -m 644 $(RULES) $(DESTDIR)$(UDEVDIR)/
+	$(INSTALL) -m 755 -d $(DESTDIR)$(UDEVRULESDIR)
+	$(INSTALL) -m 644 $(RULES) $(DESTDIR)$(UDEVRULESDIR)/

ziomon/Makefile

@@ -1,8 +1,8 @@
 include ../common.mak
 
 ALL_CPPFLAGS += -DNDEBUG
-ALL_CFLAGS   += -Wundef -Wstrict-prototypes -Wno-trigraphs
-ALL_CXXFLAGS += -Wundef -Wno-trigraphs
+ALL_CFLAGS   += -Wundef -Wstrict-prototypes -Wno-trigraphs -Wno-address-of-packed-member
+ALL_CXXFLAGS += -Wundef -Wno-trigraphs -Wno-address-of-packed-member
 
 TARGETS = ziomon_util ziomon_mgr ziomon_zfcpdd ziorep_utilization ziorep_traffic
 all: $(TARGETS)

zipl/boot/tape0.S

@@ -249,7 +249,8 @@ iplstart:
 	clc   0(3,%r4),.L_eof			# if it is EOFx
 	bz    .Lagain1				# skip dateset trailer
 
-	lt    %r3,MAX_COMMAND_LINE_SIZE-PARMAREA+4(%r12)
+	l     %r3,MAX_COMMAND_LINE_SIZE-PARMAREA+4(%r12)
+	ltr   %r3,%r3
 	jnz   0f
 	lhi   %r3,LEGACY_COMMAND_LINE_SIZE
 0:	cr    %r2,%r3				# truncate if line too long

zipl/dracut/Makefile

@@ -1,7 +1,6 @@
 
 include ../../common.mak
 
-MODULESDIR := /usr/lib/dracut/modules.d/
 NGDUMPDIR := 99ngdump
 
 # HAVE_DRACUT
@@ -17,14 +16,14 @@ ifeq ($(HAVE_DRACUT),1)
 install:
 	$(INSTALL) -m 755 zipl_helper.prepare-ngdump \
 		$(DESTDIR)$(TOOLS_LIBDIR)
-	$(INSTALL) -m 755 -d $(DESTDIR)$(MODULESDIR)
-	$(INSTALL) -m 755 -d $(DESTDIR)$(MODULESDIR)/$(NGDUMPDIR)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(DRACUTMODDIR)/
+	$(INSTALL) -m 755 -d $(DESTDIR)$(DRACUTMODDIR)/$(NGDUMPDIR)
 	$(INSTALL) -m 755 $(NGDUMPDIR)/module-setup.sh \
-		$(DESTDIR)$(MODULESDIR)/$(NGDUMPDIR)/
+		$(DESTDIR)$(DRACUTMODDIR)/$(NGDUMPDIR)/
 	$(INSTALL) -m 644 $(NGDUMPDIR)/ngdump.service \
-		$(DESTDIR)$(MODULESDIR)/$(NGDUMPDIR)/
+		$(DESTDIR)$(DRACUTMODDIR)/$(NGDUMPDIR)/
 	$(INSTALL) -m 755 $(NGDUMPDIR)/ngdump.sh \
-		$(DESTDIR)$(MODULESDIR)/$(NGDUMPDIR)/
+		$(DESTDIR)$(DRACUTMODDIR)/$(NGDUMPDIR)/
 	$(INSTALL) -m 755 $(NGDUMPDIR)/ngdump-reipl.sh \
-		$(DESTDIR)$(MODULESDIR)/$(NGDUMPDIR)/
+		$(DESTDIR)$(DRACUTMODDIR)/$(NGDUMPDIR)/
 endif

zipl/src/job.c

@@ -790,7 +790,7 @@ check_common_ipl_data(struct job_common_ipl_data *common, const char *section,
 		if (!max_parm_size)
 			max_parm_size = LEGACY_MAXIMUM_PARMLINE_SIZE;
 
-		len = strlen(common->parmline);
+		len = common->parmline ? strlen(common->parmline) : 0;
 		if (len > max_parm_size) {
 			error_text("The length of the parameters line "
 				   "(%d bytes) exceeds the allowed maximum "

zkey/keystore.c

@@ -4312,15 +4312,17 @@ static int _keystore_process_cryptsetup(struct keystore *keystore,
 			}
 		} else {
 			/*
-			 * Use PBKDF2 as key derivation function for LUKS2
-			 * volumes. LUKS2 uses Argon2i as default, but this
-			 * might cause out-of-memory errors when multiple LUKS2
-			 * volumes are opened automatically via /etc/crypttab
+			 * Use Argon2i as key derivation function for LUKS2
+			 * volumes, but with options for low memory and time requirements.
+			 * Using the default Argon2i options might cause out-of-memory
+			 * errors when multiple LUKS2 volumes are opened automatically
+			 * via /etc/crypttab
 			 */
 			util_asprintf(&cmd,
 				      "cryptsetup luksFormat %s%s--type luks2 "
 				      "--master-key-file '%s' --key-size %lu "
-				      "--cipher %s --pbkdf pbkdf2 %s%s%s",
+				      "--cipher %s --pbkdf argon2i --pbkdf-memory 32 "
+				      "--pbkdf-force-iterations 4 %s%s%s",
 				      info->batch_mode ? "-q " : "",
 				      keystore->verbose ? "-v " : "",
 				      key_file_name, key_file_size * 8,

zkey/zkey.1

@@ -734,13 +734,12 @@ type, this is the default. If specified for the plain volume type, then no
 command is generated.
 .P
 For LUKS2 volumes, the generated \fBcryptsetup luksFormat\fP contains
-option \fB\-\-pbkdf pbkdf2\fP to set \fBPBKDF2\fP as password based key
-derivation function. LUKS2 volumes typically default to \fBArgon2i\fP as
-password based key derivation function, but this might cause out-of-memory
-errors when multiple encrypted volumes are unlocked automatically at boot
-through /etc/crypttab. Because PAES uses secure AES keys as volume keys, the
-security of the key derivation function used to encrypt the volume key in the
-LUKS key slots is of less relevance. 
+options \fB-\-pbkdf argon2i \-\-pbkdf\-memory 32 \-\-pbkdf\-force\-iterations 4
+\fP for low memory and time requirements. Using the default \fBArgon2i\fP
+options might cause out-of-memory errors when multiple encrypted volumes are
+unlocked automatically at boot through /etc/crypttab. Because PAES uses secure
+AES keys as volume keys, the security of the key derivation function used to encrypt
+the volume key in the LUKS key slots is of less relevance.
 .P
 For LUKS2 volumes, a passphrase is required. You are prompted for the
 passphrase when running the generated commands, unless option