New release s390-tools-2.30.0

Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

.codespell.ignore

@@ -0,0 +1,5 @@
+parm
+parms
+crate
+ser
+deriver

.codespellrc

@@ -1,5 +1,4 @@
 [codespell]
-ignore-words-list = parm,parms
+ignore-words = .codespell.ignore
-skip = ''
 count = ''
 quiet-level = 3

.editorconfig

@@ -8,6 +8,12 @@ insert_final_newline = true
 charset = utf-8
 indent_style = tab
 tab_width = 8
+trim_trailing_whitespace = true
+
+[*.rs]
+indent_style = space
+indent_size = 4
+tab_width = 4
 
 [*.sh]
 shell_variant = bash  # used by `shfmt`
@@ -19,3 +25,9 @@ indent_size = 2
 [*.py]
 indent_style = space
 indent_size = 4
+
+[{Makefile,*.mak}]
+indent_style = tab
+
+[{COMMIT_EDITMSG,EDIT_DESCRIPTION}]
+max_line_length = 72

.gitignore

@@ -9,6 +9,13 @@
 tags
 TAGS
 
+# compile_commands.json
+# (https://clang.llvm.org/docs/JSONCompilationDatabase.html)
+compile_commands.json
+
+# clangd cache (https://clangd.llvm.org/design/indexing#backgroundindex)
+.cache/
+
 # Ignore coverage data
 *.gcda
 *.gcno
@@ -16,6 +23,8 @@ TAGS
 #
 # Ignore generated executables and other generated files
 #
+**/.detect-openssl.dep.c
+*.debug
 ap_tools/ap-check
 cmsfs-fuse/cmsfs-fuse
 cpacfstats/cpacfstats
@@ -23,6 +32,7 @@ cpacfstats/cpacfstatsd
 cpumf/chcpumf
 cpumf/lscpumf
 cpumf/lshwc
+cpumf/lspai
 cpumf/pai
 cpuplugd/cpuplugd
 dasdfmt/dasdfmt
@@ -47,8 +57,8 @@ iucvterm/src/iucvconn
 iucvterm/src/iucvtty
 iucvterm/src/ttyrun
 iucvterm/test/test_afiucv
-libap/check-dep-lock
 libap/check-dep-json
+libap/check-dep-lock
 libekmfweb/check-dep-libekmfweb
 libekmfweb/detect-openssl-version.dep
 libekmfweb/libekmfweb.so
@@ -78,7 +88,6 @@ systemd/ttyrun-getty@.service
 tape390/tape390_crypt
 tape390/tape390_display
 tunedasd/src/tunedasd
-vmconvert/vmconvert
 vmcp/vmcp
 vmur/vmur
 zconf/chp/chchp
@@ -94,6 +103,7 @@ zdev/src/chzdev
 zdev/src/chzdev_usage.c
 zdev/src/lszdev
 zdev/src/lszdev_usage.c
+zdev/src/zdev_id
 zdsfs/zdsfs
 zdump/.check_dep_fuse
 zdump/.check_dep_zgetdump
@@ -110,9 +120,9 @@ ziomon/ziorep_traffic
 ziomon/ziorep_utilization
 zipl/boot/*.bin
 zipl/boot/*.exec
+zipl/boot/.loaders
 zipl/boot/data.h
 zipl/src/chreipl_helper.device-mapper
-zdev/src/zdev_id
 zipl/src/zipl
 zipl/src/zipl-editenv
 zipl/src/zipl_helper.device-mapper
@@ -126,4 +136,3 @@ zkey/kmip/zkey-kmip.so
 zkey/zkey
 zkey/zkey-cryptsetup
 zpcictl/zpcictl
-**/.detect-openssl.dep.c

.rustfmt.toml

@@ -0,0 +1,12 @@
+edition = "2021"
+newline_style = "Unix"
+
+# Unstable options that help catching some mistakes in formatting and that we may want to enable
+# when they become stable.
+#
+# They are kept here since they are useful to run from time to time.
+#format_code_in_doc_comments = true
+#reorder_impl_items = true
+#comment_width = 100
+#wrap_comments = true
+#normalize_comments = true

.shellcheckrc

@@ -0,0 +1,5 @@
+# Search in the current script's directory by default (since 0.7.0)
+source-path=SCRIPTDIR
+
+# Allow external-sources (since 0.8.0)
+external-sources=true

AUTHORS.md

@@ -27,6 +27,7 @@ List of all individuals having contributed content to s390-tools
 - Eberhard Pasch
 - Eduard Shishkin
 - Einar Lueck
+- Eric Farman
 - Eric Sandeen
 - Erwin Vicari
 - Eugene Crosser
@@ -56,6 +57,7 @@ List of all individuals having contributed content to s390-tools
 - Horst Hummel
 - Ingo Franzki
 - Ingo Tuchscherer
+- Jakub Čajka
 - Jan Glauber
 - Jan Höppner
 - Jan Willeke
@@ -90,6 +92,7 @@ List of all individuals having contributed content to s390-tools
 - Mikhail Zaslonko
 - Nikita Dubrovskii
 - Niklas Schnelle
+- Nikolay Gueorguiev
 - Peter Oberparleiter
 - Peter Tiedemann
 - Philipp Kern
@@ -123,6 +126,7 @@ List of all individuals having contributed content to s390-tools
 - Thomas Richter
 - Thomas Spatzier
 - Thomas Weber
+- Thorsten Winkler
 - Tuan Hoang
 - Ursula Braun
 - Utz Bacher

CHANGELOG.md

@@ -1,6 +1,128 @@
 Release history for s390-tools (MIT version)
 --------------------------------------------
 
+* __v2.30.0 (2023-12-01)__
+
+  For Linux kernel version: 6.6
+
+  Add new tools / libraries:
+  - lspai: Tool to display PAI counter sets
+  - s390-tools: Provide a ShellCheck configuration
+
+  Changes of existing tools / libraries:
+  - cpumf/pai: Add command line option for realtime scheduling
+  - dbginfo.sh: enhance ethtool collection for ROCE
+  - libutil/util_lockfile: add routine to return owning pid of file lock
+  - lszcrypt: Improve lszcrypt output on SE guests
+  - rust: Use a single workspace for all rust tools
+  - zdev: limit the derivation of ZDEV_SITE_ID
+  - zdump/df_s390: Update 'zgetdump -i' output with zlib info
+  - zdump/dfi_s390: Support reading compressed s390_ext dumps
+  - zipl/boot: Integrate zlib compression to single volume DASD dumper
+  - zipl/boot: compile the bootloaders only if HOST_ARCH is s390x
+  - zipl: Add --no-compress option to zipl command
+  - zkey: Also check for deconfigured and check-stopped cards
+
+  Bug Fixes:
+  - ap_tools/ap-check: handle get-attributes between pre and post event
+  - libutil: fix util_file_read_*() using wrong format specifiers
+  - rust/pv: fix Invalid write of size 1
+
+* __v2.29.0 (2023-08-04)__
+
+  For Linux kernel version: 6.5
+
+  General:
+  - s390-tools now supports tools written in Rust.
+  - Add `compdb` Makefile target to create 'compile_commands.json' to LSP
+    backends in IDEs and editors
+
+  Add new tools / libraries:
+  - rust/pv: Library for pv tools written in rust
+  - rust/pvsecret: Tool to manage UV-secrets
+
+  Changes of existing tools:
+  - dbginfo.sh: Global IFS variable
+  - genprotimg: Add support for add-secret requests
+  - genprotimg: Build debuginfo files for bootloader
+  - hyptop: Add real SMT utilization field
+  - hyptop: Allow users to set speedup factor
+  - pvattest: Add yaml-output for verify command
+  - zipl: Build debuginfo files for bootloader
+
+  Bug Fixes:
+  - dump2tar: Fix truncated paths
+  - zdev/dracut: fix kdump build to integrate with site support
+
+* __v2.28.0 (2023-07-11)__
+
+  For Linux kernel version: 6.4
+
+  Changes of existing tools:
+  - chzcrypt: Support for SE AP pass-through support
+  - genprotimg: Add support for non-s390x architectures
+  - lszcrypt: Support for SE AP pass-through support
+  - zdev: Add support for autoquiesce related sysfs attributes
+
+  Bug Fixes:
+  - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs
+  - ap_tools/ap-check: Hold ap config file lock over get attributes
+  - s390-tools: Fix build for ppc64le
+  - zdev: Add missing label in the udev-rules
+  - zdev: Add proper value input for the ZDEV_SITE_ID key
+  - zdev: Use rename-file to avoid any symlinks created
+  - zipl/dump: fix ngdump dracut helper script
+
+* __v2.27.0 (2023-05-30)__
+
+  For Linux kernel version: 6.3
+
+  Changes of existing tools:
+   - s390-tools cross-compile and non-s390x support:
+      - `pkg-config` is now mandatory for the build process
+      - Add `PKG_CONFIG` Makefile variable to select pkg-config program;
+        default `pkg-config` or `$(CROSS_COMPILE)pkg-config` if
+        `CROSS_COMPILE` is set
+      - Rename Makefile variable `ARCH` to `HOST_ARCH`. `HOST_ARCH` is the
+        architecture that will run the produced (executable) objects
+      - Add the Makefile variable `BUILD_ARCH`. `BUILD_ARCH` is the
+        architecture of the build system. For each Makefile variable like
+        `CC`, `LINK`, `CPP`, ... there is a suffixed version of it - e.g.
+        `CC_FOR_BUILD`. This is useful for cross compiling, and this naming
+        convention is very similar to the Meson convention (see
+        https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine).
+      - Limit build targets for non-s390x architectures (pvattest)
+  - dasdfmt: Fall back to full format if space release fails
+  - dbginfo.sh: Add nstat for network and SNMP stats
+  - dbginfo.sh: Rework crypto data collection
+  - hyptop: Show thread util by default
+  - zipl: Add support for list-directed IPL dump from ECKD DASD
+
+  Bug Fixes:
+  - lszcrypt: Fix argument parsing
+  - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment
+  - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev
+  - pvextract-hdr: Fix parsing issues on little-endian systems
+
+* __v2.26.0 (2023-02-14)__
+
+  For Linux kernel version: 6.2
+
+  Remove tools / libraries:
+  - Remove vmconvert and libvmdump in favor of vmdump file support in zdump
+
+  Changes of existing tools:
+  - ipl_tools: Add support for list-directed IPL from ECKD DASD
+  - lszcrypt: Display hardware filtering support capability
+  - vmur: Remove option -c for dump file conversion (See zdump changes)
+  - zdev: Add zfcp ber_stop parameter handling
+  - zdump: Add vmdump dfi for vmdump format to elf format
+  - zkey: Support EP11 host library version
+
+  Bug Fixes:
+  - zipl: Move dump parmline processing and verification
+  - zipl/genprotimg: Various build improvements
+
 * __v2.25.0 (2022-12-08)__
 
   For Linux kernel version: 6.1

Makefile

@@ -1,5 +1,3 @@
-ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
-
 # Include common definitions
 include common.mak
 
@@ -8,15 +6,22 @@ include common.mak
 # LIBS: Libraries that can have a dependency to base libraries
 # TOOLS: Tools that can have a dependency to base libraries or libraries
 #
+ifeq ($(HOST_ARCH),s390x)
 BASELIB_DIRS = libutil libseckey
-LIB_DIRS = libvtoc libzds libdasd libvmdump libccw libvmcp libekmfweb \
+LIB_DIRS = libvtoc libzds libdasd libccw libvmcp libekmfweb \
 	   libkmipclient libcpumf libap libpv
 TOOL_DIRS = zipl zdump fdasd dasdfmt dasdview tunedasd \
 	   tape390 osasnmpd qetharp ip_watcher qethconf scripts zconf \
-	   vmconvert vmcp man mon_tools dasdinfo vmur cpuplugd ipl_tools \
+	   vmcp man mon_tools dasdinfo vmur cpuplugd ipl_tools \
 	   ziomon iucvterm hyptop cmsfs-fuse qethqoat zfcpdump zdsfs cpumf \
 	   systemd hmcdrvfs cpacfstats zdev dump2tar zkey netboot etc zpcictl \
-	   genprotimg lsstp hsci hsavmcore chreipl-fcp-mpath ap_tools pvattest
+	   genprotimg lsstp hsci hsavmcore chreipl-fcp-mpath ap_tools pvattest \
+	   rust
+else
+BASELIB_DIRS =
+LIB_DIRS = libpv
+TOOL_DIRS = genprotimg pvattest rust
+endif
 
 SUB_DIRS = $(BASELIB_DIRS) $(LIB_DIRS) $(TOOL_DIRS)
 
@@ -49,15 +54,15 @@ endif
 
 $(TOOL_DIRS): $(LIB_DIRS)
 	$(foreach goal,$(MAKECMDGOALS), \
-		$(MAKE) -C $@ TOPDIR=$(TOPDIR) ARCH=$(ARCH) $(goal) ;)
+		$(MAKE) -C $@ TOPDIR=$(TOPDIR) HOST_ARCH=$(HOST_ARCH) $(goal) ;)
 .PHONY: $(TOOL_DIRS)
 
 $(LIB_DIRS): $(BASELIB_DIRS)
 	$(foreach goal,$(MAKECMDGOALS), \
-		$(MAKE) -C $@ TOPDIR=$(TOPDIR) ARCH=$(ARCH) $(goal) ;)
+		$(MAKE) -C $@ TOPDIR=$(TOPDIR) HOST_ARCH=$(HOST_ARCH) $(goal) ;)
 .PHONY: $(LIB_DIRS)
 
 $(BASELIB_DIRS):
 	$(foreach goal,$(MAKECMDGOALS), \
-		$(MAKE) -C $@ TOPDIR=$(TOPDIR) ARCH=$(ARCH) $(goal) ;)
+		$(MAKE) -C $@ TOPDIR=$(TOPDIR) HOST_ARCH=$(HOST_ARCH) $(goal) ;)
 .PHONY: $(BASELIB_DIRS)

README.md

@@ -15,6 +15,11 @@ The package also contains the following files:
 Package contents
 ----------------
 
+ * rust:
+   all s390-tools that are written in rust and require external crates.
+   Disable the compilation of all tools in `rust/` using HAVE_CARGO=0
+   See the `rust/README.md` for Details
+
  * dasdfmt:
    Low-level format ECKD DASDs with the classical Linux disk layout or the new
    z/OS compatible disk layout.
@@ -98,11 +103,6 @@ Package contents
  * tunedasd:
    Adjust tunable parameters on DASD devices.
 
- * vmconvert:
-   Convert system dumps created by the z/VM VMDUMP command into dumps with
-   LKCD format. These LKCD dumps can then be analyzed with the dump analysis
-   tool lcrash.
-
  * vmcp:
    Send commands from Linux as a z/VM guest to the z/VM control program (CP).
    Call vmcp with the CP command as an argument. The response of z/VM is
@@ -310,13 +310,14 @@ build options:
 | net-snmp       | `HAVE_SNMP`        | osasnmpd                              |
 | glibc-static   | `HAVE_LIBC_STATIC` | zfcpdump                              |
 | openssl        | `HAVE_OPENSSL`     | genprotimg, zkey, libekmfweb,         |
-|                |                    | libkmipclient, pvattest, zgetdump     |
+|                |                    | libkmipclient, pvattest, zgetdump,    |
+|                |                    | rust/pvsecret,                        |
 | cryptsetup     | `HAVE_CRYPTSETUP2` | zkey-cryptsetup                       |
 | json-c         | `HAVE_JSONC`       | zkey-cryptsetup, libekmfweb,          |
 |                |                    | libkmipclient                         |
 | glib2          | `HAVE_GLIB2`       | genprotimg, pvattest, zgetdump        |
 | libcurl        | `HAVE_LIBCURL`     | genprotimg, libekmfweb, libkmipclient,|
-|                |                    | pvattest                              |
+|                |                    | pvattest, rust/pvsecret,              |
 | libxml2        | `HAVE_LIBXML2`     | libkmipclient                         |
 | systemd        | `HAVE_SYSTEMD`     | hsavmcore                             |
 | libudev        | `HAVE_LIBUDEV`     | cpacfstatsd                           |
@@ -329,9 +330,10 @@ This table lists additional build or install options:
 |                  |                              | zipl                     |
 | initramfs-tools  | `HAVE_INITRAMFS`             | zdev, zipl               |
 |                  | `ZDEV_ALWAYS_UPDATE_INITRD`  | zdev                     |
+| rust             | `HAVE_CARGO`                 | rust/*                   |
 
-The s390-tools build process uses "pkg-config" if available and hard-coded
+The s390-tools build process uses "pkg-config" and therefore it must be
-compiler and linker options otherwise.
+available.
 
 Build and runtime requirements for specific tools
 -------------------------------------------------
@@ -339,6 +341,14 @@ Build and runtime requirements for specific tools
 In the following more details on the build an runtime requirements of
 the different tools are provided:
 
+* rust/pvsecret:
+  For building pvsecret you need OpenSSL version 1.1.1 or newer
+  installed (openssl-devel.rpm). Also required is cargo and libcurl.
+  Tip: you may skip the pvsecret build by adding
+  `HAVE_OPENSSL=0`, `HAVE_LIBCURL=0`, or `HAVE_CARGO=0`.
+
+  The runtime requirements are: openssl-libs (>= 1.1.1).
+
 * dbginfo.sh:
   The tar package is required to archive collected data.
 
@@ -376,6 +386,24 @@ the different tools are provided:
   - Packages: blktrace, multipath-tools, sg3-utils
   - Tools: rsync, tar, lsscsi
 
+* zipl
+  For CCW-type DASD dump, zlib compression can be used to compress the dump
+  data before writing it to the DASD partition. It can benefit from
+  s390 on-chip compression accelerator (DFLTCC) and provide a faster dumping
+  process, hence lower system downtime.
+  The zlib version integrated with zipl (zipl/boot/zlib) is based on the Linux
+  kernel zlib (kernel version 6.3) which represents zlib version 1.1.3 with a
+  limited number of functions and a number of updates on top including s390
+  hardware compression (DFLTCC) support. Also, all memory allocations are
+  performed in advance, which aligns with zipl requirements.
+  The CCW-type standalone dumper is built as a single binary and must be
+  loaded to stage2 during boot. Hence, all required zlib functions must be
+  integrated into it, and its size is restricted. To limit the size, only
+  deflate-related parts are integrated (no decompression is required during
+  dumping).
+  Removing the inflate modules and function prototypes are the only major
+  modifications made to the kernel version of zlib.
+
 * zgetdump
   For building zgetdump you need OpenSSL version 1.1.0 or newer
   installed (openssl-devel.rpm). Also required is glib2

ap_tools/Makefile

@@ -26,9 +26,9 @@ ap-check: ap-check.o $(libs)
 install: all
 	@if [ ! -d $(DESTDIR)$(MDEVCTL_CALLOUTS) ]; then \
 		mkdir -p $(DESTDIR)$(MDEVCTL_CALLOUTS); \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(MDEVCTL_DIR); \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(MDEVCTL_DIR); \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(MDEVCTL_SCRIPTS); \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(MDEVCTL_SCRIPTS); \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(MDEVCTL_CALLOUTS); \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(MDEVCTL_CALLOUTS); \
 		chmod 755 $(DESTDIR)$(MDEVCTL_DIR); \
 		chmod 755 $(DESTDIR)$(MDEVCTL_SCRIPTS); \
 		chmod 755 $(DESTDIR)$(MDEVCTL_CALLOUTS); \
@@ -37,9 +37,9 @@ install: all
 		$(DESTDIR)$(MDEVCTL_CALLOUTS)
 	@if [ ! -d $(DESTDIR)$(MDEVCTL_DEP_CALLOUTS) ]; then \
 		mkdir -p $(DESTDIR)$(MDEVCTL_DEP_CALLOUTS); \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(MDEVCTL_DEP_DIR); \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(MDEVCTL_DEP_DIR); \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(MDEVCTL_DEP_SCRIPTS); \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(MDEVCTL_DEP_SCRIPTS); \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(MDEVCTL_DEP_CALLOUTS); \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(MDEVCTL_DEP_CALLOUTS); \
 		chmod 755 $(DESTDIR)$(MDEVCTL_DEP_DIR); \
 		chmod 755 $(DESTDIR)$(MDEVCTL_DEP_SCRIPTS); \
 		chmod 755 $(DESTDIR)$(MDEVCTL_DEP_CALLOUTS); \

ap_tools/ap-check.c

@@ -434,14 +434,23 @@ static int check_other_mdev_sysfs_cb(const char *path, const char *filename,
 	    strcasecmp(filename, cbdata->uuid) == 0)
 		return 0;
 
-	dev2 = vfio_ap_device_new();
+	/*
+	 * Read the 'matrix' attribute to get the list of queues for the active
+	 * device.  If the sysfs attribute is unreadable, assume the device is
+	 * being destroyed and skip it.
+	 */
 	matrix_path = path_get_vfio_ap_attr(filename, "matrix");
 	f = fopen(matrix_path, "r");
+	free(matrix_path);
+	if (!f)
+		return 0;
+
+	dev2 = vfio_ap_device_new();
+
 	while (fgets(buf, sizeof(buf), f))
 		vfio_ap_parse_matrix(dev2, buf);
 	vfio_ap_sort_matrix_results(dev2);
 	fclose(f);
-	free(matrix_path);
 
 	/* Look for conflicts between target device and this device */
 	rc = find_apqn_conflicts(filename, dev->adapters, dev->domains,
@@ -787,21 +796,61 @@ static int ap_check_handle_get_attributes(struct ap_check_anchor *anc)
 	char buf[80];
 	char *path;
 	FILE *f;
+	int rc;
 
+	/*
+	 * For the get-attributes callout, we are typically called without the
+	 * callout lock held.  However, there is a particular scenario (define
+	 * of an active mdev) where we may or may not be called with the lock
+	 * already held on behalf of mdevctl, depending on the mdevctl version.
+	 * Let's test for lock ownership first and, if already owned by the
+	 * parent (mdevctl) proceed rather than waiting on the file lock.
+	 */
+	rc = ap_try_lock_callout();
+	switch (rc) {
+	case 0:
+		/* Lock acquired */
+		anc->cleanup_lock = true;
+		break;
+	case 1:
+		/* Lock held by parent -- trust the lock will remain held */
+		break;
+	default:
+		/* Lock not acquired or held by parent -- do a normal obtain */
+		rc = ap_get_lock_callout();
+		if (rc) {
+			fprintf(stderr,
+				"Failed to acquire configuration lock %d\n",
+				rc);
+			return -1;
+		}
+		anc->cleanup_lock = true;
+	}
+
+	/*
+	 * Read the 'matrix' and 'control_domains' attributes to get the
+	 * current attributes of the active device.  If either of these sysfs
+	 * attributes is unreadable, assume the device is being destroyed
+	 * and return nothing.
+	 */
 	path = path_get_vfio_ap_attr(anc->uuid, "matrix");
 	f = fopen(path, "r");
+	free(path);
+	if (!f)
+		return 0;
 	while (fgets(buf, sizeof(buf), f))
 		vfio_ap_parse_matrix(dev, buf);
 	vfio_ap_sort_matrix_results(dev);
 	fclose(f);
-	free(path);
 
 	path = path_get_vfio_ap_attr(anc->uuid, "control_domains");
 	f = fopen(path, "r");
+	free(path);
+	if (!f)
+		return 0;
 	while (fgets(buf, sizeof(buf), f))
 		vfio_ap_parse_control(dev, buf);
 	fclose(f);
-	free(path);
 
 	printf("[{");
 

chreipl-fcp-mpath/Makefile

@@ -17,7 +17,6 @@
 #   GNU awk:
 #     - gawk
 
-override SHELL		:= /bin/bash
 override .SHELLFLAGS	:= -O globstar -O nullglob -O extglob -c
 
 # Include common s390-tools definitions

chreipl-fcp-mpath/chreipl-fcp-mpath.mak

@@ -74,7 +74,7 @@ ALL_PANDOCFLAGS	 = --preserve-tabs --tab-stop=8 --strip-comments	\
 		   -M date="$(shell date +'%Y-%m-%d')"			\
 		   $(PANDOCFLAGS)
 
-$(eval $(call cmd_define, PANDOC,"  PANDOC  ",pandoc))
+$(eval $(call cmd_define_and_export, PANDOC,"  PANDOC  ",pandoc))
 
 %.html : ALL_PANDOCFLAGS += -t html
 %.html : %.md

cmsfs-fuse/Makefile

@@ -22,13 +22,8 @@ check_dep:
 
 all: check_dep cmsfs-fuse
 
-ifneq ($(shell sh -c 'command -v pkg-config'),)
+FUSE_CFLAGS = $(shell $(PKG_CONFIG) --silence-errors --cflags fuse3)
-FUSE_CFLAGS = $(shell pkg-config --silence-errors --cflags fuse3)
+FUSE_LDLIBS = $(shell $(PKG_CONFIG) --silence-errors --libs fuse3)
-FUSE_LDLIBS = $(shell pkg-config --silence-errors --libs fuse3)
-else
-FUSE_CFLAGS = -D_FILE_OFFSET_BITS=64 -I/usr/include/fuse3
-FUSE_LDLIBS = -lfuse3
-endif
 ALL_CFLAGS += -DHAVE_SETXATTR $(FUSE_CFLAGS)
 LDLIBS += $(FUSE_LDLIBS) -lm
 

common.mak

@@ -1,25 +1,51 @@
-ifndef $(COMMON_INCLUDED)
+COMMON_INCLUDED ?= false
-COMMON_INCLUDED = true
+V ?= 0
+W ?= 0
+G ?= 0
+C ?= 0
+D ?= 0
+ASAN ?= 0
+ENABLE_WERROR ?= 0
+OPT_FLAGS ?=
+MAKECMDGOALS ?=
+CARGO ?= cargo
+CARGOFLAGS ?=
+
+ifeq ($(COMMON_INCLUDED),false)
+COMMON_INCLUDED := true
+
+override SHELL := /bin/bash
+
+# 'BUILD_ARCH' is the architecture of the machine where the build takes place
+BUILD_ARCH := $(shell uname -m | sed -e 's/i.86/i386/' -e 's/sun4u/sparc64/' -e 's/arm.*/arm/' -e 's/sa110/arm/')
+# 'HOST_ARCH' is the architecture of the machine that will run the compiled output
+HOST_ARCH ?= $(BUILD_ARCH)
+
+# The `*clean` targets are mutually exclusive to all other targets
+ifneq ($(filter %clean,$(MAKECMDGOALS)),)
+  ifneq ($(MAKECMDGOALS),$(filter %clean,$(MAKECMDGOALS)))
+    $(error The *clean targets are mutually exclusive to all other targets)
+  endif
+endif
 
 # Global definitions
 # The variable "DISTRELEASE" should be overwritten in rpm spec files with:
 # "make DISTRELEASE=%{release}" and "make install DISTRELEASE=%{release}"
 VERSION            = 2
-RELEASE            = 25
+RELEASE            = 30
 PATCHLEVEL         = 0
 DISTRELEASE        = build-$(shell date +%Y%m%d)
 S390_TOOLS_RELEASE = $(VERSION).$(RELEASE).$(PATCHLEVEL)-$(DISTRELEASE)
 export S390_TOOLS_RELEASE
 
-reldir = $(subst $(shell cd -P $(dir $(filter %common.mak,$(MAKEFILE_LIST))); \
+reldir = $(subst $(realpath $(dir $(filter %common.mak,$(MAKEFILE_LIST))))/,,$(CURDIR))
-	 pwd)/,,$(CURDIR))
 rootdir= $(dir $(filter %common.mak,$(MAKEFILE_LIST)))
 export S390_TEST_LIB_PATH=$(rootdir)/s390-tools-testsuite/lib
 
 #
-# For cross compiles specify CROSS_COMPILE= on the commandline:
+# For cross compiles specify HOST_ARCH= and CROSS_COMPILE= on the commandline:
 #
-# $ make CROSS_COMPILE="s390x-5.1.0-"
+# $ make HOST_ARCH=s390x CROSS_COMPILE="s390x-linux-gnu-"
 #
 
 CROSS_COMPILE   =
@@ -29,8 +55,10 @@ CROSS_COMPILE   =
 #
 #  $ make CC=gcc-4.8
 #
-# The "cmd_define" macro wraps the command definition so that the commands
+# The "cmd_define_and_export" macro wraps the command definition so that
-# can be user supplied and are still pretty-printed for the build process.
+# the commands can be user supplied and are still pretty-printed for the
+# build process. In addition, the command variable gets exported so it
+# can be used by sub-makes.
 #
 # The macro is called with the following parameters:
 #
@@ -40,13 +68,14 @@ CROSS_COMPILE   =
 #
 # The Example below...
 #
-#  $(eval $(call cmd_define,     CC,"  CC      ",$(CROSS_COMPILE)gcc))
+#  $(eval $(call cmd_define_and_export,     CC,"  CC      ",$(CROSS_COMPILE)gcc))
 #
 # ... produces the following code:
 #
 #  CC              = $(CROSS_COMPILE)gcc
 #  CC_SILENT      := $(CC)
 #  override CC     = $(call echocmd,"  CC      ",/$@)$(CC_SILENT)
+#  export CC
 #
 # The "strip" make function is used for the first parameter to allow blanks,
 # which improves readability.
@@ -58,23 +87,51 @@ define cmd_define
 	override $(strip $(1))	 = $$(call echocmd,$(2),/$$@)$$($(strip $(1))_SILENT)
 endef
 
-$(eval $(call cmd_define,     AS,"  AS      ",$(CROSS_COMPILE)as))
+define cmd_define_and_export
-$(eval $(call cmd_define,     CC,"  CC      ",$(CROSS_COMPILE)gcc))
+	$(call cmd_define,$(1),$(2),$(3))
-$(eval $(call cmd_define,   LINK,"  LINK    ",$(CC)))
+	export $(strip $(1))
-$(eval $(call cmd_define, HOSTCC,"  HOSTCC  ",gcc))
+endef
-$(eval $(call cmd_define,    CXX,"  CXX     ",$(CROSS_COMPILE)g++))
+
-$(eval $(call cmd_define, LINKXX,"  LINKXX  ",$(CXX)))
+define define_toolchain_variables
-$(eval $(call cmd_define,    CPP,"  CPP     ",$(CROSS_COMPILE)gcc -E))
+	$(call cmd_define_and_export,     AS$(1),"  AS$(1)          ",$(2)as)
-$(eval $(call cmd_define,     AR,"  AR      ",$(CROSS_COMPILE)ar))
+	$(call cmd_define_and_export,     CC$(1),"  CC$(1)          ",$(2)gcc)
-$(eval $(call cmd_define,     NM,"  NM      ",$(CROSS_COMPILE)nm))
+	$(call cmd_define_and_export,   LINK$(1),"  LINK$(1)        ",$$(CC$(1)))
-$(eval $(call cmd_define,  STRIP,"  STRIP   ",$(CROSS_COMPILE)strip))
+	$(call cmd_define_and_export,    CXX$(1),"  CXX$(1)         ",$(2)g++)
-$(eval $(call cmd_define,OBJCOPY,"  OBJCOPY ",$(CROSS_COMPILE)objcopy))
+	$(call cmd_define_and_export, LINKXX$(1),"  LINKXX$(1)      ",$$(CXX$(1)))
-$(eval $(call cmd_define,OBJDUMP,"  OBJDUMP ",$(CROSS_COMPILE)objdump))
+	$(call cmd_define_and_export,    CPP$(1),"  CPP$(1)         ",$(2)gcc -E)
-$(eval $(call cmd_define,RUNTEST,"  RUNTEST ",$(S390_TEST_LIB_PATH)/s390_runtest))
+	$(call cmd_define_and_export,     AR$(1),"  AR$(1)          ",$(2)ar)
-$(eval $(call cmd_define,    CAT,"  CAT     ",cat))
+	$(call cmd_define_and_export,     NM$(1),"  NM$(1)          ",$(2)nm)
-$(eval $(call cmd_define,    SED,"  SED     ",sed))
+	$(call cmd_define_and_export,  STRIP$(1),"  STRIP$(1)       ",$(2)strip)
-$(eval $(call cmd_define,   GZIP,"  GZIP    ",gzip))
+	$(call cmd_define_and_export,OBJCOPY$(1),"  OBJCOPY$(1)     ",$(2)objcopy)
-$(eval $(call cmd_define,     MV,"  MV      ",mv))
+	$(call cmd_define_and_export,OBJDUMP$(1),"  OBJDUMP$(1)     ",$(2)objdump)
+	PKG_CONFIG$(1) = pkg-config
+	export PKG_CONFIG$(1)
+endef
+
+# If the host architecture is not the same as the build architecture
+# 'CROSS_COMPILE=...' is always required (except for the '*clean' targets).
+ifneq ($(HOST_ARCH),$(BUILD_ARCH))
+  ifeq ($(CROSS_COMPILE),)
+    # `make clean` and similar must always work!
+    ifeq ($(filter %clean,$(MAKECMDGOALS)),)
+      $(error Please specify CROSS_COMPILE=... and try it again!)
+    endif
+  endif
+endif
+
+$(eval $(call define_toolchain_variables,_FOR_BUILD,))
+$(eval $(call define_toolchain_variables,,$(CROSS_COMPILE)))
+
+
+$(eval $(call cmd_define,    RUNTEST,"  RUNTEST     ",$(S390_TEST_LIB_PATH)/s390_runtest))
+$(eval $(call cmd_define,        CAT,"  CAT         ",cat))
+$(eval $(call cmd_define,        SED,"  SED         ",sed))
+$(eval $(call cmd_define,       GZIP,"  GZIP        ",gzip))
+$(eval $(call cmd_define,         MV,"  MV          ",mv))
+$(eval $(call cmd_define,      PERLC,"  PERLC       ",perl -c))
+$(eval $(call cmd_define,CARGO_BUILD,"  CARGO BUILD ",$(CARGO) build))
+$(eval $(call cmd_define,CARGO_TEST, "  CARGO TEST  ",$(CARGO) test))
+$(eval $(call cmd_define,CARGO_CLEAN,"  CARGO CLEAN ",$(CARGO) clean))
 
 CHECK           = sparse
 CHECK_SILENT   := $(CHECK)
@@ -84,8 +141,10 @@ SKIP            = echo           "  SKIP    $(call reldir) due to"
 
 INSTALL         = install
 CP              = cp
+ALL_CARGOFLAGS := $(CARGOFLAGS)
 ifneq ("${V}","1")
 	MAKEFLAGS += --quiet
+	ALL_CARGOFLAGS += --quiet
 	echocmd=echo $1$(call reldir)$2;
 	RUNTEST += > /dev/null 2>&1
 else
@@ -101,6 +160,10 @@ else
 	DEFAULT_CFLAGS += -O3
 endif
 
+ifeq ("${ENABLE_WERROR}", "1")
+	DEFAULT_CFLAGS += -Werror
+endif
+
 DEFAULT_CPPFLAGS = -D_GNU_SOURCE
 DEFAULT_LDFLAGS = -rdynamic
 
@@ -109,6 +172,11 @@ ifeq ("${ASAN}","1")
 	DEFAULT_LDFLAGS += -fsanitize=address
 endif
 
+DEFAULT_PERLCFLAGS =
+ifeq ("${W}","1")
+	DEFAULT_PERLCFLAGS += -w
+endif
+
 #
 # Check for header prerequisite
 #
@@ -145,6 +213,20 @@ then \
 	exit 1; \
 fi
 
+#
+# Test for linker option
+#
+# $1: Linker option
+#
+# Returns the linker option if available and nothing otherwise
+#
+define test_linker_flag
+$(shell printf ".globl _start\n_start:\nnop\n" | \
+        ( $(LINK) "-Wl,$1" -o /dev/null -nostdlib -x assembler -) >/dev/null 2>&1 && printf -- '-Wl,%s' "$1")
+endef
+
+NO_WARN_RWX_SEGMENTS_LDFLAGS := $(call test_linker_flag,"--no-warn-rwx-segments")
+
 #
 # Support alternate install root
 #
@@ -221,10 +303,10 @@ ZFCPDUMP_INITRD	= zfcpdump-initrd
 ZFCPDUMP_FLAVOR	= zfcpdump
 export ZFCPDUMP_DIR ZFCPDUMP_IMAGE ZFCPDUMP_INITRD ZFCPDUMP_FLAVOR
 
-CFLAGS		?= $(DEFAULT_CFLAGS) $(OPT_FLAGS)
+CFLAGS		 ?= $(DEFAULT_CFLAGS) $(OPT_FLAGS)
-HOSTCFLAGS	?= $(DEFAULT_CFLAGS) $(OPT_FLAGS)
+CFLAGS_FOR_BUILD ?= $(DEFAULT_CFLAGS) $(OPT_FLAGS)
-CPPFLAGS	?= $(DEFAULT_CPPFLAGS)
+CPPFLAGS	 ?= $(DEFAULT_CPPFLAGS)
-LDFLAGS		?= $(DEFAULT_LDFLAGS)
+LDFLAGS		 ?= $(DEFAULT_LDFLAGS)
 
 ALL_CFLAGS	= -DS390_TOOLS_RELEASE=$(S390_TOOLS_RELEASE) \
 			-DS390_TOOLS_LIBDIR=$(TOOLS_LIBDIR) \
@@ -242,6 +324,8 @@ ALL_CXXFLAGS	= -DS390_TOOLS_RELEASE=$(S390_TOOLS_RELEASE) \
 ALL_CPPFLAGS	= -I $(rootdir)include $(CPPFLAGS)
 ALL_LDFLAGS	= $(LDFLAGS)
 
+ALL_PERLCFLAGS	= $(DEFAULT_PERLCFLAGS)
+
 # make G=1
 # Compile tools so that gcov can be used to collect code coverage data.
 # See the gcov man page for details.
@@ -250,7 +334,7 @@ ALL_CFLAGS := $(filter-out -O%,$(ALL_CFLAGS)) --coverage
 ALL_CXXFLAGS := $(filter-out -O%,$(ALL_CXXFLAGS)) --coverage
 ALL_LDFLAGS += --coverage
 endif
-export AS LD CC CPP AR NM STRIP OBJCOPY OBJDUMP INSTALL CFLAGS CXXFLAGS \
+export INSTALL CFLAGS CXXFLAGS \
        LDFLAGS CPPFLAGS ALL_CFLAGS ALL_CXXFLAGS ALL_LDFLAGS ALL_CPPFLAGS
 
 ifneq ($(shell $(CC_SILENT) -dumpspecs 2>/dev/null | grep -e '[^f]no-pie'),)
@@ -261,7 +345,7 @@ else
 	NO_PIE_LDFLAGS :=
 endif
 
-# Overwrite implicite makefile rules for having nice compile output
+# Overwrite implicit makefile rules for having nice compile output
 %.o: %.c
 ifeq ("${C}","1")
 	$(CHECKTOOL) $(ALL_CPPFLAGS) $(ALL_CFLAGS) -c $< -o $@
@@ -286,20 +370,48 @@ help:
 	@echo '  all      Build all tools (default target)'
 	@echo '  install  Install tools'
 	@echo '  clean    Delete all generated files'
+	@echo '  compdb   Generate compile_commands.json for clangd'
 	@echo ''
 	@echo 'OPTIONS'
-	@echo '  D=1      Build with debugging option "-Og"'
+	@echo '  D=1      	 Build with debugging option "-Og"'
-	@echo '  C=1      Build with check tool defined with "CHECK=" (default=sparse)'
+	@echo '  C=1      	 Build with check tool defined with "CHECK=" (default=sparse)'
-	@echo '  G=1      Build with gcov to collect code coverage data'
+	@echo '  G=1      	 Build with gcov to collect code coverage data'
-	@echo '  V=1      Generate verbose build output'
+	@echo '  V=1      	 Generate verbose build output'
-	@echo '  W=1      Build with higher warning level'
+	@echo '  W=1		 Build with higher warning level'
-	@echo '  ASAN=1   Build with address sanitizer'
+	@echo '  ASAN=1   	 Build with address sanitizer'
+	@echo '  ENABLE_WERROR=1 Build with -Werror'
 	@echo ''
 	@echo 'EXAMPLES'
 	@echo '  # make clean all D=1 W=1 -j'
 	@echo '  # make C=1 CHECK=smatch'
 .PHONY: help
 
+
+# 'compile_commands.json' generation
+#
+# Create the compilation database 'compile_commands.json'. See
+# https://clang.llvm.org/docs/JSONCompilationDatabase.html for details.
+#
+.PHONY: compdb
+compdb:
+	$(MAKE) clean
+ifneq ($(shell command -v compiledb),)
+	compiledb $(MAKE)
+else ifneq ($(shell command -v bear),)
+  ifeq ($(shell bear --help|grep -- '-- ...'),)
+	bear $(MAKE)
+  else
+	bear -- $(MAKE)
+  endif
+else
+	$(error Please install either 'compiledb' or 'bear')
+endif
+
+# Prints the s390-tools release string
+version:
+	$(info $(S390_TOOLS_RELEASE))
+.PHONY: version
+
 # Automatic dependency generation
 #
 # Create ".o.d" dependency files with the -MM compile option for all ".c" and
@@ -364,10 +476,6 @@ $(rootdir)/libzds/libzds.a: $(rootdir)/libzds
 	$(MAKE) -C $(rootdir)/libzds/ libzds.a
 .PHONY: $(rootdir)/libzds
 
-$(rootdir)/libvmdump/libvmdump.a: $(rootdir)/libvmdump
-	$(MAKE) -C $(rootdir)/libvmdump/ libvmdump.a
-.PHONY: $(rootdir)/libvmdump
-
 $(rootdir)/libvmcp/libvmcp.a: $(rootdir)/libvmcp
 	$(MAKE) -C $(rootdir)/libvmcp/ libvmcp.a
 .PHONY: $(rootdir)/libvmcp
@@ -396,8 +504,8 @@ $(rootdir)/libpv/libpv.a: $(rootdir)/libpv
 	$(MAKE) -C $(rootdir)/libpv libpv.a
 .PHONY: $(rootdir)/libpv
 
-$(rootdir)/zipl/boot/data.o:
+$(rootdir)/zipl/boot/.loaders:
-	$(MAKE) -C $(rootdir)/zipl/boot/ data.o
+	$(MAKE) -C $(rootdir)/zipl/boot/ .loaders
 
 install_dirs:
 	for dir in $(INSTDIRS); do \
@@ -414,7 +522,7 @@ install_echo:
 install: install_echo install_dirs
 
 clean_echo:
-	$(call echocmd,"  CLEAN   ")
+	$(call echocmd,"  CLEAN       ")
 clean_gcov:
 	rm -f -- *.gcda *.gcno *.gcov
 clean_dep:
@@ -422,4 +530,3 @@ clean_dep:
 
 clean: clean_echo clean_gcov clean_dep
 endif
-

cpacfstats/cpacfstats.c

@@ -323,7 +323,7 @@ static void json_print_virtual_counter_answer(int s, int ctr,
 				pai_str[paictr], space, paictr + 1);
 			if (paistate < 0) {
 				printf("\"error\":%d}", paistate);
-				/* Protocol does not send furter counters. */
+				/* Protocol does not send further counters. */
 				return;
 			}
 			printf("\"value\":%"PRIu64"}", paivalue);

cpacfstats/cpacfstatsd.8

@@ -45,9 +45,8 @@ counter set authorization control" checkbox.
 - The daemon requires root privileges to interact with the performance
 ioctls of the kernel.
 
-CPU hotplug is not recognized by the daemon. When adding or removing a CPU,
+CPU hotplug is recognized by the daemon. When adding or removing a CPU,
-restart the daemon to ensure correct summing of the per-CPU performance
+the daemon ensures correct summing of the per-CPU performance counters.
-counters.
 
 The starting daemon first checks for any stale pid file
 \%/run/cpacfstatsd.pid. If this file exists, and the process ID in the

cpacfstats/cpacfstatsd.c

@@ -252,20 +252,26 @@ static int do_print(int s, enum ctr_e ctr)
 }
 
 
-static int become_daemon(void)
+static int become_daemon(int *startup_pipe)
 {
+	int child_initialized = 0, fd;
+	int pipefds[2];
 	FILE *f;
-	int fd;
 
 	/* syslog */
 	openlog("cpacfstatsd", 0, LOG_DAEMON);
 
+	if (pipe(pipefds) != 0) {
+		eprint("pipe() failed, errno=%d [%s]\n", errno, strerror(errno));
+		return -1;
+	}
+
 	/*
 	 * fork and terminate parent
 	 * Reasons:
 	 * - opens new command line prompt
 	 * - the child process is guaranteed not to be the process group leader
-	 *   nessecarry for setsid.
+	 *   necessary for setsid.
 	 */
 
 	switch (fork()) {
@@ -276,9 +282,23 @@ static int become_daemon(void)
 	case 0:   /* child */
 		break;
 	default:  /* parent */
+		(void)close(pipefds[1]);
+		if (read(pipefds[0], &child_initialized, sizeof(child_initialized)) !=
+		    sizeof(child_initialized)) {
+			eprint("Couldn't read from PIPE, errno=%d [%s]\n", errno, strerror(errno));
+			(void)close(pipefds[0]);
+			_exit(EXIT_FAILURE);
+		}
+		(void)close(pipefds[0]);
+		if (!child_initialized)
+			_exit(EXIT_FAILURE);
 		_exit(0);
 	}
 
+	/* Executed within the child context only */
+	(void)close(pipefds[0]);
+	*startup_pipe = pipefds[1];
+
 	if (chdir("/") != 0) {
 		eprint("Chdir('/') failed, errno=%d [%s]\n",
 		       errno, strerror(errno));
@@ -418,7 +438,7 @@ int eprint(const char *format, ...)
 
 int main(int argc, char *argv[])
 {
-	int rc, sfd, foreground = 0;
+	int rc, sfd, foreground = 0, startup_pipe = -1, initialized = 0;
 	struct sigaction act;
 
 	if (argc > 1) {
@@ -454,27 +474,27 @@ int main(int argc, char *argv[])
 	}
 
 	if (check_pidfile() != 0) {
-		eprint("Stalled pid file or daemon allready running, terminating\n");
+		eprint("Stalled pid file or daemon already running, terminating\n");
 		return EXIT_FAILURE;
 	}
 
 	if (!foreground) {
-		if (become_daemon() != 0) {
+		if (become_daemon(&startup_pipe) != 0) {
 			eprint("Couldn't daemonize\n");
-			return EXIT_FAILURE;
+			goto error;
 		}
 	}
 
 	if (perf_init() != 0) {
 		eprint("Couldn't initialize perf lib\n");
-		return EXIT_FAILURE;
+		goto error;
 	}
 	atexit(perf_close);
 
 	sfd = open_socket(SERVER);
 	if (sfd < 0) {
 		eprint("Couldn't initialize server socket\n");
-		return EXIT_FAILURE;
+		goto error;
 	}
 	atexit(remove_sock);
 
@@ -484,17 +504,27 @@ int main(int argc, char *argv[])
 	if (sigaction(SIGINT, &act, 0) != 0) {
 		eprint("Couldn't establish signal handler for SIGINT, errno=%d [%s]\n",
 		       errno, strerror(errno));
-		return EXIT_FAILURE;
+		goto error;
 	}
 	if (sigaction(SIGTERM, &act, 0) != 0) {
 		eprint("Couldn't establish signal handler for SIGTERM, errno=%d [%s]\n",
 		       errno, strerror(errno));
-		return EXIT_FAILURE;
+		goto error;
 	}
 	/* Ignore SIGPIPE such that we see EPIPE as return from write. */
 	signal(SIGPIPE, SIG_IGN);
 
 	eprint("Running\n");
+	initialized = 1;
+	/* `startup_pipe` has been initialized, so we know we are
+	 * running in daemon mode. Let's write to the pipe so that the
+	 * parent knows that the initialization is complete.
+	 */
+	if (startup_pipe != -1 &&
+	    write(startup_pipe, &initialized, sizeof(initialized)) != sizeof(initialized))
+		goto error;
+	(void)close(startup_pipe);
+	startup_pipe = -1;
 
 	while (!stopsig) {
 		enum ctr_e ctr;
@@ -507,13 +537,14 @@ int main(int argc, char *argv[])
 				continue;
 			eprint("Accept() failure, errno=%d [%s]\n",
 			       errno, strerror(errno));
-			return EXIT_FAILURE;
+			goto error;
 		}
 
 		rc = recv_query(s, &ctr, &cmd);
 		if (rc != 0) {
 			eprint("Recv_query() failed, ignoring\n");
-			goto cleanup;
+			close(s);
+			continue;
 		}
 
 		if (cmd == ENABLE)
@@ -527,11 +558,9 @@ int main(int argc, char *argv[])
 		else {
 			eprint("Received unknown command %d, ignoring\n",
 			       (int) cmd);
-			goto cleanup;
+			close(s);
+			continue;
 		}
-
-cleanup:
-		close(s);
 	}
 
 	if (stopsig == SIGTERM)
@@ -543,4 +572,14 @@ cleanup:
 	remove_pidfile();
 
 	return 0;
+
+error:
+	if (startup_pipe != -1) {
+		/* Notify the parent process that there was an error */
+		if (write(startup_pipe, &initialized, sizeof(initialized)) != sizeof(initialized))
+			eprint("Couldn't write to PIPE, errno=%d [%s]\n", errno, strerror(errno));
+		(void)close(startup_pipe);
+	}
+
+	return EXIT_FAILURE;
 }

cpacfstats/perf_crypto.c

@@ -496,10 +496,8 @@ int perf_init(void)
 		num -= 2;
 	}
 
-	if (num == 0) {
+	if (num == 0)
 		eprint("No crypto counters supported!\n");
-		return -1;
-	}
 
 	if (perf_load_counter_data())
 		return -1;

cpumf/Makefile

@@ -1,7 +1,7 @@
 include ../common.mak
 
-BIN_FILES = lscpumf chcpumf lshwc pai
+BIN_FILES = lscpumf chcpumf lshwc pai lspai
-MAN_FILES = lscpumf.8 chcpumf.8 lshwc.8 pai.8
+MAN_FILES = lscpumf.8 chcpumf.8 lshwc.8 pai.8 lspai.8
 
 all: $(BIN_FILES)
 
@@ -11,6 +11,7 @@ lscpumf: lscpumf.o $(libs)
 chcpumf: chcpumf.o $(libs)
 lshwc: lshwc.o $(libs)
 pai: pai.o $(libs)
+lspai: lspai.o $(libs)
 
 install: all install-man
 	$(INSTALL) -d -m 755 $(DESTDIR)$(BINDIR) $(DESTDIR)$(MANDIR)/man8

cpumf/lshwc.c

@@ -276,9 +276,7 @@ static bool check_setpossible(void)
 	if (!get_cpus(CPUS_KERNELMAX, cpubuf, sizeof(cpubuf)))
 		return false;
 	max_possible_cpus = getnumber(cpubuf, '\0') + 1;
-	check = calloc(max_possible_cpus, sizeof(*check));
+	check = util_zalloc(max_possible_cpus * sizeof(*check));
-	if (!check)
-		err(EXIT_FAILURE, "Maximum CPUs %u", max_possible_cpus);
 	if (!get_cpus(CPUS_POSSIBLE, cpubuf, sizeof(cpubuf))) {
 		free(check);
 		return false;
@@ -533,13 +531,8 @@ static int do_read(int ioctlfd)
 	struct s390_hwctr_read *read;
 	int rc;
 
-	if (!ioctlbuffer) {
+	if (!ioctlbuffer)
-		ioctlbuffer = malloc(ioctlbuffer_len);
+		ioctlbuffer = util_malloc(ioctlbuffer_len);
-		if (!ioctlbuffer) {
-			warn("ioctl S390_HWCTR_START");
-			return -ENOMEM;
-		}
-	}
 	read = (struct s390_hwctr_read *)ioctlbuffer;
 	rc = ioctl(ioctlfd, S390_HWCTR_READ, read);
 	if (!rc)

cpumf/lspai.c

@@ -0,0 +1,352 @@
+/* Copyright IBM Corp. 2023
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+/* List available Processor Assist Instrumentation (PAI) counters.  */
+
+#include <ctype.h>
+#include <dirent.h>
+#include <err.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "lib/util_opt.h"
+#include "lib/util_prg.h"
+#include "lib/util_base.h"
+#include "lib/util_path.h"
+#include "lib/util_scandir.h"
+#include "lib/util_libc.h"
+#include "lib/util_file.h"
+#include "lib/util_list.h"
+#include "lib/libcpumf.h"
+
+static struct util_opt opt_vec[] = {
+	UTIL_OPT_SECTION("OPTIONS"),
+	{
+		.option = { "numeric", no_argument, NULL, 'n' },
+		.desc = "Sort PAI counters by counter number"
+	},
+	{
+		.option = { "type", required_argument, NULL, 't' },
+		.argument = "TYPE",
+		.desc = "Type of PAI counters to show: crypto, nnpa"
+	},
+	UTIL_OPT_HELP,
+	UTIL_OPT_VERSION,
+	UTIL_OPT_END
+};
+
+static const struct util_prg prg = {
+	.desc = "List Processor Assist Information counter sets",
+	.copyright_vec = {
+		{
+			.owner = "IBM Corp.",
+			.pub_first = 2023,
+			.pub_last = 2023,
+		},
+		UTIL_PRG_COPYRIGHT_END
+	}
+};
+
+static bool numsort;		/* If true sort counter numerically */
+
+#define PAI_PATH	"/bus/event_source/devices/%s"
+
+enum pai_types {		/* Bit mask for supported PAI counters */
+	pai_type_crypto = 0,	/* PAI Crypto Counters */
+	pai_type_nnpa = 1,	/* PAI NNPA Counters */
+	pai_type_max = 2,	/* PAI maximum value, must be last */
+};
+
+static int pai_types_show;
+
+struct pai_ctrname {		/* List of defined counters */
+	char *name;		/* Counter name */
+	unsigned long nr;	/* Counter number */
+};
+
+struct pai_node {		/* Head for PAI counter sets */
+	struct util_list_node node;	/* Successor in PAI counter set list */
+	enum pai_types type;	/* PAI type */
+	int pmu;		/* Assigned PMU type number */
+	const char *name;	/* Counter set name */
+	char *name_uc;		/* Counter set name upper case */
+	const char *sysfs_name;	/* Counter set name in /sysfs tree */
+	const char *filter_name;	/* Counter set name for scandir filter */
+	struct pai_ctrname *ctrlist;	/* List of counter names & numbers */
+	size_t ctrsize;		/* Total size in bytes of ctrlist */
+	int ctridx;		/* Index of last entry used in ctrlist */
+	unsigned long base;	/* Base number for counter set */
+};
+
+static struct util_list pai_list;
+
+/* Return base of counter set, this is the first counter of this set. */
+static unsigned long pai_type_base(enum pai_types t)
+{
+	switch (t) {
+	case pai_type_crypto:
+		return 0x1000;
+	case pai_type_nnpa:
+		return 0x1800;
+	case pai_type_max:
+		break;
+	}
+	return 0;
+}
+
+/* Test PAI counter name from command line option. */
+static const char *pai_type_name(enum pai_types t)
+{
+	switch (t) {
+	case pai_type_crypto:
+		return "crypto";
+	case pai_type_nnpa:
+		return "nnpa";
+	case pai_type_max:
+		break;
+	}
+	return "unknown";
+}
+
+/* Convert PAI counter type to sysfs directory name. Only validated
+ * input at this time.
+ */
+static const char *pai_type_sysfs(enum pai_types t)
+{
+	if (t == pai_type_crypto)
+		return "pai_crypto";
+	return "pai_ext";
+}
+
+/* Convert PAI counter type to sysfs directory name filter for scandir(). */
+static const char *pai_type_filter(enum pai_types t)
+{
+	if (t == pai_type_nnpa)
+		return "^NNPA";
+	return "[^.]";		/* Matches anything but . and .. in sysfs */
+}
+
+/* Sort PAI counter names by assigned counter number. */
+static int pai_ctrcmp(const void *p1, const void *p2)
+{
+	struct pai_ctrname *l = (struct pai_ctrname *)p1;
+	struct pai_ctrname *r = (struct pai_ctrname *)p2;
+
+	return l->nr > r->nr ? 1 : -1;
+}
+
+/* Convert string to upper case. */
+static char *str2uc(const char *s)
+{
+	char *uc = util_strdup(s), *old_uc = uc;
+
+	for (; *uc; ++uc)
+		*uc = toupper(*uc);
+	return old_uc;
+}
+
+/* Read counter names and assigned event number from sysfs file tree.
+ * Exit when sysfs directory can not be scanned.
+ */
+static void read_counternames(struct pai_node *node)
+{
+	int i, more = 0, ctr = 0, count = 0;
+	struct dirent **namelist = NULL;
+	char *path, *ctrpath;
+
+	/* Read counter names and assigned event number. */
+	path = util_path_sysfs(PAI_PATH "/events", node->sysfs_name);
+	count = util_scandir(&namelist, alphasort, path, node->filter_name);
+	if (count <= 0)
+		errx(EXIT_FAILURE, "Cannot open %s", path);
+
+	node->ctrsize = count * sizeof(*node->ctrlist);
+	node->ctrlist = util_malloc(node->ctrsize);
+	for (i = 0; i < count && ctr >= 0; i++) {
+		util_asprintf(&ctrpath, "%s/%s", path, namelist[i]->d_name);
+		if (util_file_read_va(ctrpath, "event=%x", &ctr) == 1) {
+			node->ctrlist[node->ctridx].name = util_strdup(namelist[i]->d_name);
+			node->ctrlist[node->ctridx++].nr = ctr;
+			more++;
+		} else {
+			warnx("Cannot parse %s", ctrpath);
+		}
+		free(ctrpath);
+	}
+	util_scandir_free(namelist, count);
+	free(path);
+
+	if (numsort && more > 1)
+		qsort(node->ctrlist, more, sizeof(*node->ctrlist), pai_ctrcmp);
+}
+
+static void show_painode(void)
+{
+	struct pai_node *node;
+	int indent = 0;
+	int offset = 0;
+
+	util_list_iterate(&pai_list, node) {
+		for (int i = 0; i < node->ctridx; ++i)
+			indent = MAX((size_t)indent, strlen(node->ctrlist[i].name));
+	}
+
+	printf("RAW %*s NAME %*s DESCRIPTION\n", 3, "", indent - 5, "");
+	util_list_iterate(&pai_list, node) {
+		for (int i = 0; i < node->ctridx; ++i) {
+			printf("%d:%ld %s", node->pmu,
+			       node->ctrlist[i].nr, node->ctrlist[i].name);
+
+			offset = indent - strlen(node->ctrlist[i].name) + 1;
+			printf("%*s", offset, "");
+
+			printf("Counter %ld / PAI %s counter set\n",
+			       node->ctrlist[i].nr - node->base, node->name_uc);
+		}
+	}
+}
+
+/* Release all memory allocated at make_painode(). */
+static void free_painode(void)
+{
+	struct pai_node *next, *node;
+
+	util_list_iterate_safe(&pai_list, node, next) {
+		free(node->name_uc);
+		for (int i = 0; i < node->ctridx; ++i)
+			free(node->ctrlist[i].name);
+		free(node->ctrlist);
+		free(node);
+	}
+}
+
+static void make_painode(enum pai_types t)
+{
+	struct pai_node *node = util_zalloc(sizeof(*node));
+	char *path;
+
+	node->type = t;
+	node->sysfs_name = pai_type_sysfs(t);
+	node->name = pai_type_name(t);
+	node->name_uc = str2uc(node->name);
+	node->filter_name = pai_type_filter(t);
+	node->base = pai_type_base(t);
+
+	/* Read PMU type number. */
+	path = util_path_sysfs(PAI_PATH, node->sysfs_name);
+	node->pmu = libcpumf_pmutype(path);
+	if (node->pmu < 0)
+		errx(EXIT_FAILURE, "Cannot open %s", path);
+	free(path);
+
+	read_counternames(node);
+
+	util_list_add_tail(&pai_list, node);
+}
+
+static int painode_cmp(void *a, void *b, void *UNUSED(data))
+{
+	struct pai_node *n1 = (struct pai_node *)a;
+	struct pai_node *n2 = (struct pai_node *)b;
+
+	return n1->pmu < n2->pmu ? -1 : 1;
+}
+
+static void sort_painode(void)
+{
+	util_list_sort(&pai_list, painode_cmp, NULL);
+}
+
+/* Check for hardware support and return false if not available. */
+static bool have_support(enum pai_types t)
+{
+	const char *sysfn = pai_type_sysfs(t);
+	char *path = util_path_sysfs(PAI_PATH, sysfn);
+	bool rc = true;
+
+	if (!util_path_is_dir(path)) {
+		warnx("No support for PAI %s facility", pai_type_name(t));
+		rc = false;
+	}
+	free(path);
+	return rc;
+}
+
+/*
+ * Check the argument for option -t. It must be a valid PAI counter set.
+ * Exit when an invalid PAI counter set name has been specified.
+ */
+static void check_type_name(const char *type)
+{
+	bool no_match = true;
+	enum pai_types i;
+	const char *fn;
+
+	for (i = pai_type_crypto; i < pai_type_max; ++i) {
+		fn = pai_type_name(i);
+		if (!strcasecmp(fn, type)) {
+			pai_types_show |= (1 << i);
+			no_match = false;
+		}
+	}
+	if (no_match)
+		errx(EXIT_FAILURE, "Invalid argument for -t %s", type);
+}
+
+int main(int argc, char **argv)
+{
+	int ch;
+
+	util_list_init(&pai_list, struct pai_node, node);
+	util_prg_init(&prg);
+	util_opt_init(opt_vec, NULL);
+
+	while ((ch = util_opt_getopt_long(argc, argv)) != -1) {
+		switch (ch) {
+		default:
+			util_opt_print_parse_error(ch, argv);
+			return EXIT_FAILURE;
+		case 'h':
+			util_prg_print_help();
+			util_opt_print_help();
+			return EXIT_SUCCESS;
+		case 'v':
+			util_prg_print_version();
+			return EXIT_SUCCESS;
+		case 'n':
+			numsort = true;
+			break;
+		case 't':
+			check_type_name(optarg);
+			break;
+		}
+	}
+
+	/* Nothing specified, show all PAI counters */
+	if (!pai_types_show)
+		pai_types_show = (1 << pai_type_crypto) | (1 << pai_type_nnpa);
+
+	/* Check for hardware support */
+	for (enum pai_types i = pai_type_crypto; i < pai_type_max; ++i) {
+		if ((pai_types_show & (1 << i))) {
+			if (!have_support(i))
+				pai_types_show &= ~(1 << i);
+			else
+				make_painode(i);
+		}
+	}
+	sort_painode();
+	show_painode();
+	free_painode();
+	return ch;
+}

cpumf/man/lshwc.8

@@ -88,12 +88,6 @@ Include the MT_Diagnostic counter set.
 Include the problem counter set.
 .IP a
 Include all known counter sets (default).
-.SH "Concurrency with perf tool"
-The \*c tool and the linux
-.B perf
-tool use the same hardware and cannot be used concurrently.
-Both tools print an error message and abort when they
-detect this situation.
 .SH "EXAMPLES"
 The first example enables the basic and problem counter sets on CPU 0 and 1.
 Two read operations are performed and a summary line is printed for each

cpumf/man/lspai.8

@@ -0,0 +1,80 @@
+.\" lspai.8
+.\"
+.\"
+.\" Copyright IBM Corp. 2021
+.\" s390-tools is free software; you can redistribute it and/or modify
+.\" it under the terms of the MIT license. See LICENSE for details.
+.\" ----------------------------------------------------------------------
+.ds c \fBlspai\fP
+.
+.TH \*c "8" "August 2023" "s390-tools" "CPU-MF management programs"
+.
+.SH NAME
+\*c \- list Processor Activity Instrumentation (PAI) counters
+.
+.SH SYNOPSIS
+\*c
+.RB [ \-n ]
+.RB [ \-t
+.IR "\ TYPE" ]
+.br
+\*c
+.BR \-h | \-\-help
+.br
+\*c
+.BR \-v | \-\-version
+.
+.
+.SH DESCRIPTION
+\*c displays the Processor Activity Instrumentation (PAI) counters
+for Linux on IBM Z.
+The output is a human-readable list of available PAI counter
+names and numbers.
+.SH OPTIONS
+.TP
+.BR \-h ", " \-\-help
+Displays help information, then exits.
+.
+.TP
+.BR \-v ", " \-\-version
+Displays version information, then exits.
+.
+.TP
+.BR \-t ", " \-\-type "\ TYPE"
+Specifies the PAI counter set to list.
+Valid counter set values are
+.I crypto
+and
+.IR nnpa .
+By default, the command lists all available PAI counter sets.
+NNPA refers to the Neural Network Processing Assist facility counter set.
+Crypto refers to the Cryptografic Processing Assist facility counter set.
+.
+.TP
+.BR \-n ", " \-\-numeric
+Shows the PAI counter sets sorted by counter number.
+Default sort order is PAI counter name.
+.
+.SH "EXAMPLE"
+The \*c invocation lists all PAI Neural Network Processing Assist Facility
+(NNPA) counters in numeric order:
+.nf
+# lspai -t nnpa -n
+RAW     NAME			DESCRIPTION
+13:6144 NNPA_ALL		Counter 0 / PAI NNPA counter set
+13:6145 NNPA_ADD		Counter 1 / PAI NNPA counter set
+13:6146 NNPA_SUB		Counter 2 / PAI NNPA counter set
+13:6147 NNPA_MUL		Counter 3 / PAI NNPA counter set
+\&...
+.fi
+The first column shows the raw event number suitable for
+.IR perf "(8)"
+raw event specification.
+The second column shows the PAI NNPA counter name,
+suitable for
+.IR perf "(8)"
+event specification by name.
+The third gives a short explanation, if available.
+.SH "SEE ALSO"
+.BR pai (8)
+.BR lscpumf (8)

cpumf/man/pai.8

@@ -18,6 +18,8 @@
 .IR size ]
 .RB [ \-i | \-\-interval
 .IR ms ]
+.RB [ \-R | \-\-realtime
+.IR prio ]
 .BR  \-c | \-\-crypto [ \fIcpulist ][: \fIdata\fR "] [" \fIloops\fP ]
 .br
 \*c
@@ -25,6 +27,8 @@
 .IR size ]
 .RB [ \-i | \-\-interval
 .IR ms ]
+.RB [ \-R | \-\-realtime
+.IR prio ]
 .BR  \-n | \-\-nnpa [ \fIcpulist ][: \fIdata\fR "] [" \fIloops\fP ]
 .br
 \*c
@@ -191,6 +195,14 @@ The ring buffer is created with the
 .IR mmap (2)
 system call.
 .
+.TP
+.BR \-R ", " \-\-realtime "\ prio"
+Collect data using the RT SCHED_FIFO priority specified by
+.BR prio .
+Valid values are integers in the range 1 (low) to 99 (high).
+Use this option when gathering data from multiple CPUs
+to prevent data loss.
+.
 .SH ARGUMENT
 The command line options determine how command line
 arguments are interpreted.

cpumf/pai.c

@@ -944,6 +944,11 @@ static struct util_opt opt_vec[] = {
 		.option = { "report", no_argument, NULL, 'r' },
 		.desc = "Report file contents"
 	},
+	{
+		.option = { "realtime", required_argument, NULL, 'R' },
+		.argument = "PRIO",
+		.desc = "Collect data with this RT SCHED_FIFO priority"
+	},
 	{
 		.option = { "interval", required_argument, NULL, 'i' },
 		.argument = "NUMBER",
@@ -1007,6 +1012,19 @@ static unsigned long check_mapsize(unsigned long n)
 	return cnt == 1 ? n : 0;
 }
 
+static void setprio(const char *prio)
+{
+	struct sched_param param;
+	char *endstr;
+
+	memset(&param, 0, sizeof(param));
+	param.sched_priority = strtoul(prio, &endstr, 0);
+	if (*endstr)
+		errno = EINVAL;
+	if (*endstr || sched_setscheduler(0, SCHED_FIFO, &param))
+		err(EXIT_FAILURE, "Could not set realtime priority");
+}
+
 int main(int argc, char **argv)
 {
 	bool crypto_record = false, report = false;
@@ -1061,6 +1079,9 @@ int main(int argc, char **argv)
 			record_cpus_nnpa(optarg);
 			nnpa_record = true;
 			break;
+		case 'R':
+			setprio(optarg);
+			break;
 		case 'r':
 			report = true;
 			break;

dasdfmt/dasdfmt.8

@@ -118,12 +118,17 @@ Specify the \fImode\fR to be used to format the device. Valid modes are:
 .IP full
 Format the entire disk with the specified blocksize. (default)
 .IP quick
-Format the first two tracks and write label and partition information. Only use
+Format the first two tracks and write label and partition information. Use this
-this option if you are sure that the target DASD already contains a regular
+option only if you are sure that the target DASD already contains a regular
 format with the specified blocksize. A blocksize can optionally be specified
 using \fB-b\fR (\fB--blocksize\fR).
 .br
-For thin-provisioned DASD ESE volumes this is the default mode.
+For thin-provisioned DASD ESE volumes, quick is the default mode. A full space
+release then precedes the formatting step. If this space release fails, dasdfmt
+falls back to a full-format  mode. Formatting stops if the space release fails
+and quick mode was specified explicitly using \fB-M\fR. Specify the
+\fB--no-discard\fR option to omit the space release.
+
 .IP expand
 Format all unformatted tracks at the end of the target DASD. This mode assumes
 that tracks at the beginning of the DASD volume have already been correctly
@@ -192,9 +197,8 @@ e.g. -l 'a@b\\$c#' to get A@B$C#
 
 .TP
 \fB-k\fR or \fB--keep_volser\fR
-Keeps the Volume Serial Number, when writing the Volume Label. This is
+Keeps the Volume Serial Number when writing the Volume Label. This is useful if
-useful, if the Serial Number has been written with a VM Tool and should not
+the volume already has a Serial Number that should not be overwritten.
-be overwritten.
 .br
 
 .SH SEE ALSO

dasdfmt/dasdfmt.c

@@ -1230,7 +1230,7 @@ static void dasdfmt_find_start(unsigned int cylinders, unsigned int heads,
 	format_params->start_unit = first;
 }
 
-static void dasdfmt_release_space(void)
+static int dasdfmt_release_space(void)
 {
 	format_data_t r = {
 		.start_unit = 0,
@@ -1240,12 +1240,21 @@ static void dasdfmt_release_space(void)
 	int err = 0;
 
 	if (!g.ese || g.no_discard)
-		return;
+		return 0;
 
 	printf("Releasing space for the entire device...\n");
 	err = dasd_release_space(g.dev_node, &r);
-	if (err)
+	/*
+	 * Warn or Error on failing RAS depending on QUICK mode set explicitly or automatically
+	 */
+	if (err && !g.mode_specified) {
+		warnx("Could not release space. Falling back to full format.");
+		return 1;
+	} else if (err && g.mode_specified) {
 		error("Could not release space: %s", strerror(err));
+	}
+
+	return 0;
 }
 
 static void dasdfmt_prepare_and_format(unsigned int cylinders, unsigned int heads,
@@ -1445,8 +1454,12 @@ static void do_format_dasd(volume_label_t *vlabel, format_data_t *p,
 			dasdfmt_prepare_and_format(cylinders, heads, p);
 			break;
 		case QUICK:
-			dasdfmt_release_space();
+			if (dasdfmt_release_space()) {
-			dasdfmt_quick_format(cylinders, heads, p);
+				p->stop_unit  = (cylinders * heads) - 1;
+				dasdfmt_prepare_and_format(cylinders, heads, p);
+			} else {
+				dasdfmt_quick_format(cylinders, heads, p);
+			}
 			break;
 		case EXPAND:
 			dasdfmt_expand_format(cylinders, heads, p);

dasdview/Makefile

@@ -16,13 +16,8 @@ check_dep:
 
 BUILDTARGET = check_dep
 
-ifneq ($(shell sh -c 'command -v pkg-config'),)
+CURL_CFLAGS = $(shell $(PKG_CONFIG) --silence-errors --cflags libcurl)
-CURL_CFLAGS = $(shell pkg-config --silence-errors --cflags libcurl)
+CURL_LDLIBS = $(shell $(PKG_CONFIG) --silence-errors --libs libcurl)
-CURL_LDLIBS = $(shell pkg-config --silence-errors --libs libcurl)
-else
-CURL_CFLAGS = -I/usr/include/s390x-linux-gnu/curl
-CURL_LDLIBS = -lcurl
-endif # shell
 
 endif # HAVE_CURL
 

dump2tar/src/tar.c

@@ -23,9 +23,16 @@
 
 #define BLOCKSIZE	512
 
+#if __has_attribute(nonstring)
+#  define __nonstring	__attribute__ ((nonstring))
+#else
+#  define __nonstring
+#endif
+
+
 /* Basic TAR header */
 struct tar_header {
-	char name[100];
+	char name[100] __nonstring;
 	char mode[8];
 	char uid[8];
 	char gid[8];
@@ -33,7 +40,7 @@ struct tar_header {
 	char mtime[12];
 	char chksum[8];
 	char typeflag;
-	char linkname[100];
+	char linkname[100] __nonstring;
 	char magic[6];
 	char version[2];
 	char uname[32];
@@ -78,7 +85,7 @@ static void set_time(char *dest, size_t len, time_t value)
 #define SET_TIME_FIELD(obj, name, value) \
 	set_time((obj)->name, sizeof((obj)->name), (time_t) (value))
 #define SET_STR_FIELD(obj, name, value) \
-	util_strlcpy((obj)->name, (value), sizeof((obj)->name))
+	strncpy((obj)->name, (value), sizeof((obj)->name))
 
 /* Initialize the tar file @header with the provided data */
 static void init_header(struct tar_header *header, const char *filename,

fdasd/fdasd.8

@@ -52,10 +52,10 @@ mode.
 
 .TP
 \fB-k\fR or \fB--keep_volser\fR
-Keeps the volume serial when writing the volume label. 
+Keeps the Volume Serial Number when writing the Volume Label.
 .br
-This is useful, if the volume serial has been written before and should not
+This is useful if the volume already has a Serial Number that should not be
-be overwritten. This option is only applicable in non-interactive mode.
+overwritten. This option is only applicable in non-interactive mode.
 
 .TP
 \fB-l\fR \fIvolser\fR or \fB--label\fR \fIvolser\fR

genprotimg/Makefile

@@ -10,10 +10,8 @@ RECURSIVE_TARGETS := all-recursive install-recursive clean-recursive
 
 all: all-recursive
 
-install: all install-recursive
+install: install-recursive
 	$(INSTALL) -d -m 755 "$(PKGDATADIR)"
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 boot/stage3a.bin "$(PKGDATADIR)"
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 boot/stage3b_reloc.bin "$(PKGDATADIR)"
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 samples/check_hostkeydoc "$(PKGDATADIR)"
 
 clean: clean-recursive

genprotimg/boot/Makefile

@@ -1,8 +1,13 @@
 # Common definitions
 include ../../common.mak
 
+FILES := stage3a.bin stage3b.bin stage3b_reloc.bin
+DEBUG_FILES := $(addsuffix .debug,$(FILES))
+
+ifeq ($(HOST_ARCH),s390x)
 ZIPL_DIR := $(rootdir)/zipl
 ZIPL_BOOT_DIR := $(ZIPL_DIR)/boot
+PKGDATADIR := $(DESTDIR)$(TOOLS_DATADIR)/genprotimg
 
 INCLUDE_PATHS := $(ZIPL_BOOT_DIR) $(ZIPL_DIR)/include $(rootdir)/include
 INCLUDE_PARMS := $(addprefix -I,$(INCLUDE_PATHS))
@@ -15,11 +20,9 @@ ALL_CFLAGS := $(NO_PIE_CFLAGS) -Os -g \
 	-fno-delete-null-pointer-checks -fno-stack-protector \
 	-fexec-charset=IBM1047 -m64 -mpacked-stack \
 	-mstack-size=4096 -mstack-guard=128 -msoft-float \
-	-Wall -Wformat-security -Wextra -Werror \
+	-Wall -Wformat-security -Wextra \
 	-Wno-array-bounds
 
-FILES := stage3a.bin stage3b.bin stage3b_reloc.bin
-
 ZIPL_SRCS_C := libc.c ebcdic.c ebcdic_conv.c sclp.c
 ZIPL_SRCS_ASM := entry.S
 
@@ -27,9 +30,6 @@ ZIPL_OBJS_C := $(ZIPL_SRCS_C:%.c=%.o)
 ZIPL_OBJS_ASM := $(ZIPL_SRCS_ASM:%.S=%.o)
 ZIPL_OBJS := $(ZIPL_OBJS_C) $(ZIPL_OBJS_ASM)
 
-
-all: $(FILES)
-
 # Prevent make from using some default rules...
 %:	%.S
 
@@ -69,30 +69,43 @@ endif
 
 stage3b_reloc.o: stage3b.bin
 
-stage3a.elf: head.o stage3a_init.o stage3a.o stage3a.lds $(ZIPL_OBJS)
+stage3a.elf: head.o stage3a_init.o $(ZIPL_OBJS)
-stage3b.elf: head.o stage3b.o stage3b.lds $(ZIPL_OBJS)
+stage3b.elf: head.o $(ZIPL_OBJS)
-stage3b_reloc.elf:
 
-%.elf:	%.o
+.SECONDARY: $(FILES:.bin=.lds)
-	case $* in \
+%.elf: %.lds %.o
-		stage3a) SFLAGS="-Wl,-T,stage3a.lds";; \
+	$(LINK) $(NO_PIE_LDFLAGS) $(NO_WARN_RWX_SEGMENTS_LDFLAGS) -Wl,-T,$< -Wl,--build-id=none -m64 -static -nostdlib $(filter %.o, $^) -o $@
-		stage3b) SFLAGS="-Wl,-T,stage3b.lds";; \
-		stage3b_reloc) SFLAGS="-Wl,-estage3b_reloc_start,-Ttext,0";; \
-	esac; \
-	$(LINK) $$SFLAGS $(NO_PIE_LDFLAGS) -m64 -static -nostdlib $(filter %.o, $^) -o $@
 	@chmod a-x $@
 
-%.bin:	%.elf
+%.bin.debug: %.elf
-	$(OBJCOPY) -O binary \
+	$(OBJCOPY) --only-keep-debug $< $@
-		--only-section=.text* \
-		--only-section=.ex_table* \
-		--only-section=.fixup* \
-		--only-section=.data*  \
-		--only-section=.rodata* \
-		$< $@
 	@chmod a-x $@
 
+%.bin: %.elf
+	$(OBJCOPY) -O binary $< $@
+	@chmod a-x $@
+
+install: stage3a.bin stage3b_reloc.bin
+	$(INSTALL) -d -m 755 "$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 stage3a.bin "$(PKGDATADIR)"
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 stage3b_reloc.bin "$(PKGDATADIR)"
+
+else
+# Don't generate the dependency files (see `common.mak` for the
+# `-include $(dependencies_c)` statement).
+.PHONY: $(dependencies_c)
+
+$(FILES) $(DEBUG_FILES):
+	echo "  SKIP    $@ due to HOST_ARCH != s390x"
+
+install:
+	echo "  SKIP    Bootloader installation due to HOST_ARCH != s390x"
+endif
+
+.DEFAULT_GOAL := all
+all: $(FILES) $(DEBUG_FILES)
+
 clean:
-	rm -f *.o *.elf *.bin *.map .*.d *.lds
+	rm -f -- *.o *.elf *.bin *.map .*.d *.lds *.debug
 
 .PHONY: all clean

genprotimg/boot/head.S

@@ -29,3 +29,8 @@ _start:
 	brasl	%r14, initialize
 .Lstack: .long STACK_ADDRESS + STACK_SIZE - STACK_FRAME_OVERHEAD
 .previous
+
+/* The code doesn't require an executable stack */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif

genprotimg/boot/stage3a.c

@@ -11,10 +11,10 @@
 #include "stage3a.h"
 
 #include "lib/zt_common.h"
+#include "boot/error.h"
 #include "boot/s390.h"
 #include "boot/ipl.h"
 #include "sclp.h"
-#include "error.h"
 
 
 static volatile struct stage3a_args __section(".loader_parms") loader_parms;

genprotimg/boot/stage3a.lds.S

@@ -23,8 +23,6 @@ ENTRY(_init)
 
 SECTIONS
 {
-	. = 0x0;
-
 	. = HEAP_ADDRESS;
 	__heap_start = .;
 	.heap : {
@@ -46,7 +44,7 @@ SECTIONS
 	. = STAGE3A_INIT_ENTRY;
 	__text_init_start = .;
 	.text : {
-		stage3a_init.o(.text.init)
+		*(.text.init)
 		__text_init_stop = ABSOLUTE(.);
 		/* Text size of text_init must be smaller than 'PARMAREA - IMAGE_ENTRY',
 		 * otherwise the text data could be overwritten by the original zipl stage3
@@ -56,8 +54,8 @@ SECTIONS
 		. = 0x1000;
 		ASSERT(ABSOLUTE(.) == STAGE3A_ENTRY,
 		       "Text section doesn't conform to the described memory layout");
-		head.o(.text.start)
+		*(.text.start)
-		*(.text)
+		*(.text .text.*)
 	}
 
 	.ex_table ALIGN(16) : {
@@ -74,7 +72,7 @@ SECTIONS
 
 	.rodata ALIGN(16) : {
 		*(.rodata)
-		*(.rodata.*)
+		*(.rodata*)
 	}
 
 	.data ALIGN(16) : {
@@ -90,14 +88,10 @@ SECTIONS
 		ASSERT(ABSOLUTE(.) < 0x13000, "Data section doesn't conform to the described memory layout");
 	}
 
-	/* List this explicitly as otherwise .note.gnu.build-id will be
-	 * put at 0x0 */
-	.notes : {
-		*(.note.*)
-	}
-
 	/* Sections to be discarded */
 	/DISCARD/ : {
 		*(.eh_frame)
+		*(.interp)
+		*(.note.GNU-stack)
 	}
 }

genprotimg/boot/stage3a_init.S

@@ -26,3 +26,8 @@ _init:
 	br	%r1
 .Lstage3a_entry: .long STAGE3A_ENTRY
 .previous
+
+/* The code doesn't require an executable stack */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif

genprotimg/boot/stage3b.c

@@ -11,11 +11,12 @@
 #include "stage3b.h"
 
 #include "lib/zt_common.h"
+#include "boot/psw.h"
+#include "boot/error.h"
 #include "boot/s390.h"
 #include "boot/linux_layout.h"
 #include "boot/loaders_layout.h"
 #include "sclp.h"
-#include "error.h"
 
 
 static volatile struct stage3b_args __section(".loader_parms") loader_parms;
@@ -60,13 +61,17 @@ void __noreturn start(void)
 	if (cmdline->size > get_kernel_cmdline_size())
 		panic(EINTERNAL, "Command line is too large\n");
 
-	/* move the kernel cmdline */
+	if (cmdline->size > 0) {
-	memmove((void *)COMMAND_LINE,
+		/* make sure the cmdline is a null-terminated string */
-		(void *)cmdline->src,
+		if (((char *)cmdline->src)[cmdline->size - 1] != '\0')
-		cmdline->size);
+			panic(EINTERNAL, "Command line needs to be null-terminated\n");
+
+		/* move the kernel cmdline */
+		memmove((void *)COMMAND_LINE, (void *)cmdline->src, cmdline->size);
+	}
 	/* the initrd does not need to be moved */
 
-	if (initrd->size != 0) {
+	if (initrd->size > 0) {
 		/* copy initrd start address and size into new kernel space */
 		*(unsigned long long *)INITRD_START = initrd->src;
 		*(unsigned long long *)INITRD_SIZE = initrd->size;

genprotimg/boot/stage3b.h

@@ -21,7 +21,7 @@
 
 #include <stdint.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 
 /* Must not have any padding included */
 struct memblob {

genprotimg/boot/stage3b.lds.S

@@ -21,8 +21,6 @@ ENTRY(_start)
 
 SECTIONS
 {
-	. = 0x0;
-
 	. = HEAP_ADDRESS;
 	__heap_start = .;
 	.heap : {
@@ -34,8 +32,8 @@ SECTIONS
 
 	. = STAGE3B_ENTRY;
 	.text : {
-		head.o(.text.start)
+		*(.text.start)
-		*(.text)
+		*(.text .text.*)
 	}
 
 	.ex_table ALIGN(16) : {
@@ -52,7 +50,7 @@ SECTIONS
 
 	.rodata ALIGN(16) : {
 		*(.rodata)
-		*(.rodata.*)
+		*(.rodata*)
 	}
 
 	.data ALIGN(16) : {
@@ -74,14 +72,12 @@ SECTIONS
 	}
 	__stack_end = .;
 
-	/* List this explicitly as otherwise .note.gnu.build-id will be
+  	ASSERT(. <= IMAGE_ENTRY, "stage3b size must be smaller than 0x10000 bytes")
-	 * put at 0x0 */
-	.notes : {
-		*(.note.*)
-	}
 
 	/* Sections to be discarded */
 	/DISCARD/ : {
 		*(.eh_frame)
+		*(.interp)
+		*(.note.GNU-stack)
 	}
 }

genprotimg/boot/stage3b_reloc.S

@@ -22,8 +22,8 @@
 
 .org 0x0
 .section .text.start
-.globl stage3b_reloc_start
+.globl _start
-stage3b_reloc_start:
+_start:
 	/* Might be called after a diag308 so better set
 	 * architecture and addressing mode
 	 */
@@ -53,3 +53,8 @@ stage3b_start:
 	.incbin	"stage3b.bin"
 stage3b_end:
 .previous
+
+/* The code doesn't require an executable stack */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif

genprotimg/boot/stage3b_reloc.lds.S

@@ -0,0 +1,19 @@
+OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
+OUTPUT_ARCH(s390:64-bit)
+
+ENTRY(_start)
+
+SECTIONS
+{
+	.text : {
+		*(.text.start)
+		*(.text .text.*)
+	}
+
+	/* Sections to be discarded */
+	/DISCARD/ : {
+		*(.eh_frame)
+		*(.interp)
+		*(.note.GNU-stack)
+	}
+}

genprotimg/man/genprotimg.1

@@ -97,18 +97,29 @@ Do not use for a production image unless you verified
 the host-key document before. Optional.
 .TP
 \fB\-\-comm\-key\fR=\fI\,FILE\/\fR
-Specifies the encryption key you want to use for the PV guest dump. Use a
+Specifies the customer communication key (CCK). This key is used for the
-secure, random, plaintext AES-256 GCM key. Optional.
+PV guest dump encryption and to derive the CCK-derived extension secret
+used for add-secret requests. Use a secure, random, plaintext AES-256
+GCM key. Optional.
 .TP
 \fB\-\-enable\-dump\fR
-Enable PV guest dumps. Requires the \fB\-\-comm-key\fR option. Optional.
+Enable PV guest dumps. Requires the \fB\-\-comm\-key\fR option. Optional.
 .TP
 \fB\-\-disable\-dump\fR
-Disable PV guest dumps. This is the default. Optional.
+Disable PV guest dumps. This is the default.
+.TP
+\fB\-\-enable\-cck\-extension\-secret\fR
+Add-secret requests must provide an extension secret that matches the
+CCK-derived extension secret. Requires the \fB\-\-comm\-key\fR option.
+Optional.
+.TP
+\fB\-\-disable\-cck\-extension\-secret\fR
+Add-secret requests don't have to provide an extension secret. This is
+the default.
 .TP
 \fB\-\-enable\-pckmo\fR
 Enable the support for the DEA, TDEA, AES, and ECC PCKMO key encryption
-functions. This is the default. Optional.
+functions. This is the default.
 .TP
 \fB\-\-disable\-pckmo\fR
 Disable the support for the DEA, TDEA, AES, and ECC PCKMO key encryption

genprotimg/src/Makefile

@@ -17,7 +17,7 @@ WARNINGS := -Wall -Wextra -Wshadow \
 	-Wcast-align -Wwrite-strings -Wmissing-prototypes \
 	-Wmissing-declarations -Wredundant-decls -Wnested-externs \
 	-Wno-long-long -Wuninitialized -Wconversion -Wstrict-prototypes \
-	-Wpointer-arith -Werror -Wno-error=inline \
+	-Wpointer-arith -Wno-error=inline \
 	$(NULL)
 
 $(bin_PROGRAM)_SRCS := $(bin_PROGRAM).c pv/pv_stage3.c pv/pv_image.c \
@@ -36,21 +36,12 @@ ALL_CPPFLAGS += $(INCLUDE_PARMS)
 LDLIBS += $(GLIB2_LIBS) $(LIBCRYPTO_LIBS) $(LIBCURL_LIBS)
 
 
-ifneq ($(shell sh -c 'command -v pkg-config'),)
+GLIB2_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags glib-2.0)
-GLIB2_CFLAGS := $(shell pkg-config --silence-errors --cflags glib-2.0)
+GLIB2_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs glib-2.0)
-GLIB2_LIBS := $(shell pkg-config --silence-errors --libs glib-2.0)
+LIBCRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcrypto)
-LIBCRYPTO_CFLAGS := $(shell pkg-config --silence-errors --cflags libcrypto)
+LIBCRYPTO_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcrypto)
-LIBCRYPTO_LIBS := $(shell pkg-config --silence-errors --libs libcrypto)
+LIBCURL_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcurl)
-LIBCURL_CFLAGS := $(shell pkg-config --silence-errors --cflags libcurl)
+LIBCURL_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcurl)
-LIBCURL_LIBS := $(shell pkg-config --silence-errors --libs libcurl)
-else
-GLIB2_CFLAGS := -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include
-GLIB2_LIBS := -lglib-2.0
-LIBCRYPTO_CFLAGS :=
-LIBCRYPTO_LIBS := -lcrypto
-LIBCURL_CFLAGS :=
-LIBCURL_LIBS := -lcurl
-endif
 
 BUILD_TARGETS := skip-$(bin_PROGRAM)
 INSTALL_TARGETS := skip-$(bin_PROGRAM)

genprotimg/src/common.h

@@ -13,7 +13,6 @@
 #include <glib/gi18n.h>
 
 #include "boot/linux_layout.h"
-#include "boot/s390.h"
 #include "lib/zt_common.h"
 
 static const gchar tool_name[] = "genprotimg";

genprotimg/src/include/pv_hdr_def.h

@@ -12,7 +12,7 @@
 
 #include <openssl/sha.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "lib/zt_common.h"
 #include "utils/crypto.h"
 
@@ -34,6 +34,10 @@
 #define PV_PCF_PCKMO_AES	__PV_BIT(57) /* PCKMO encrypt-AES-key functions allowed */
 #define PV_PCF_PCKM_ECC	__PV_BIT(58) /* PCKMO encrypt-ECC-key functions allowed */
 
+/* Secret control flags */
+#define PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT                                                     \
+	__PV_BIT(1) /* All add-secret requests must provide an extension secret */
+
 /* maxima for the PV version 1 */
 #define PV_V1_IPIB_MAX_SIZE	PAGE_SIZE
 #define PV_V1_PV_HDR_MAX_SIZE	(2 * PAGE_SIZE)

genprotimg/src/pv/pv_args.c

@@ -62,11 +62,12 @@ static gint pv_args_set_defaults(PvArgs *args, GError **err G_GNUC_UNUSED)
 
 static gint pv_args_validate_options(PvArgs *args, GError **err)
 {
+	const PvControlFlagsArgs *cf_args = &args->cf_args;
 	PvComponentType KERNEL = PV_COMP_TYPE_KERNEL;
 
 	/* Check for mutually exclusive arguments */
-	if (args->pcf && !(args->allow_pckmo == PV_NOT_SET &&
+	if (cf_args->pcf &&
-			   args->allow_dump == PV_NOT_SET)) {
+	    !(cf_args->enable_pckmo == PV_NOT_SET && cf_args->enable_dump == PV_NOT_SET)) {
 		g_set_error(
 			err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
 			_("The '--x-pcf' option cannot be used with the '--(enable|disable)-pckmo' or"
@@ -74,6 +75,13 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
 		return -1;
 	}
 
+	if (cf_args->scf && !(cf_args->enable_cck_extension_secret_enforcement == PV_NOT_SET)) {
+		g_set_error(
+			err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
+		return -1;
+	}
+
 	/* Check for unused arguments */
 	if (args->unused_values->len > 0) {
 		g_autofree gchar *unused = NULL;
@@ -93,12 +101,20 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
 	}
 
 	/* Check for mandatory arguments */
-	if (args->allow_dump == PV_TRUE && !args->cust_comm_key_path) {
+	if (cf_args->enable_dump == PV_TRUE && !args->cust_comm_key_path) {
 		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			    _("Option '--allow-dump' requires the '--comm-key' option.\nUse 'genprotimg "
+			    _("Option '--enable-dump' requires the '--comm-key' option.\nUse 'genprotimg "
 			      "--help' for more information"));
 		return -1;
 	}
+	if (cf_args->enable_cck_extension_secret_enforcement == PV_TRUE &&
+	    !args->cust_comm_key_path) {
+		g_set_error(
+			err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			_("Option '--enable-cck-extension-secret' requires the '--comm-key' option.\nUse 'genprotimg "
+			  "--help' for more information"));
+		return -1;
+	}
 
 	if (!args->output_path) {
 		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
@@ -178,11 +194,11 @@ static gboolean cb_set_string_option(const gchar *option, const gchar *value,
 	if (g_str_equal(option, "--x-header-key"))
 		args_option = &args->cust_root_key_path;
 	if (g_str_equal(option, "--x-pcf"))
-		args_option = &args->pcf;
+		args_option = &args->cf_args.pcf;
 	if (g_str_equal(option, "--x-psw"))
 		args_option = &args->psw_addr;
 	if (g_str_equal(option, "--x-scf"))
-		args_option = &args->scf;
+		args_option = &args->cf_args.scf;
 
 	if (!args_option) {
 		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
@@ -217,49 +233,48 @@ static gboolean cb_remaining_values(const gchar *option G_GNUC_UNUSED,
 }
 
 #define MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, VALUE) (cb_##FLAG##_##VALUE)
-#define DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, VALUE)                                        \
+#define DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, VALUE)                                                  \
-	static gboolean MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, VALUE)(                         \
+	static gboolean MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, VALUE)(const gchar *option G_GNUC_UNUSED, \
-		const gchar *option G_GNUC_UNUSED, const gchar *value G_GNUC_UNUSED,     \
+								const gchar *value G_GNUC_UNUSED,  \
-		PvArgs *args, GError **err)                                              \
+								PvArgs *args, GError **err)        \
-	{                                                                                \
+	{                                                                                          \
-		if (!(args->allow_##FLAG == PV_NOT_SET ||                                \
+		if (!(args->cf_args.enable_##FLAG == PV_NOT_SET ||                                 \
-		      args->allow_##FLAG == VALUE)) {                                    \
+		      args->cf_args.enable_##FLAG == VALUE)) {                                     \
-			g_set_error(err, G_OPTION_ERROR, G_OPTION_ERROR_FAILED,          \
+			g_set_error(err, G_OPTION_ERROR, G_OPTION_ERROR_FAILED,                    \
-				    "'--enable-" #FLAG "' and '--disable-" #FLAG         \
+				    "'--enable-" #FLAG "' and '--disable-" #FLAG                   \
-				    "' are mutually exclusive");                         \
+				    "' are mutually exclusive");                                   \
-			return FALSE;                                                    \
+			return FALSE;                                                              \
-		}                                                                        \
+		}                                                                                  \
-		args->allow_##FLAG = VALUE;                                              \
+		args->cf_args.enable_##FLAG = VALUE;                                               \
-		return TRUE;                                                             \
+		return TRUE;                                                                       \
 	}
 
 #define DEFINE_MUT_EXCL_BOOL_FLAG_CBS(FLAG)                                    \
 	DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, PV_TRUE)                            \
 	DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, PV_FALSE)
 
-#define MUT_EXCL_BOOL_FLAG(FLAG, ENABLE_DESC, DISABLE_DESC)                    \
+#define MUT_EXCL_BOOL_FLAG(NAME, FLAG, ENABLE_DESC, DISABLE_DESC)                                  \
-	{                                                                      \
+	{                                                                                          \
-		.long_name = "enable-" #FLAG,                                  \
+		.long_name = "enable-" #NAME,                                                      \
-		.short_name = 0,                                               \
+		.short_name = 0,                                                                   \
-		.flags = G_OPTION_FLAG_NO_ARG,                                 \
+		.flags = G_OPTION_FLAG_NO_ARG,                                                     \
-		.arg = G_OPTION_ARG_CALLBACK,                                  \
+		.arg = G_OPTION_ARG_CALLBACK,                                                      \
-		.arg_data = MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, PV_TRUE),         \
+		.arg_data = MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, PV_TRUE),                             \
-		.description = ENABLE_DESC,                                    \
+		.description = ENABLE_DESC,                                                        \
-	},                                                                     \
+	},                                                                                         \
-	{                                                                      \
+	{                                                                                          \
-		.long_name = "disable-" #FLAG,                                 \
+		.long_name = "disable-" #NAME, .short_name = 0, .flags = G_OPTION_FLAG_NO_ARG,     \
-		.short_name = 0,                                               \
+		.arg = G_OPTION_ARG_CALLBACK,                                                      \
-		.flags = G_OPTION_FLAG_NO_ARG,                                 \
+		.arg_data = MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, PV_FALSE),                            \
-		.arg = G_OPTION_ARG_CALLBACK,                                  \
+		.description = DISABLE_DESC,                                                       \
-		.arg_data = MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, PV_FALSE),        \
-		.description = DISABLE_DESC,                                   \
 	}
 
-#define INDENT "                                   "
+#define INDENT "                                     "
 
 /* Define the callbacks for mutually exclusive command line flags */
-DEFINE_MUT_EXCL_BOOL_FLAG_CBS(dump)
+DEFINE_MUT_EXCL_BOOL_FLAG_CBS(dump);
-DEFINE_MUT_EXCL_BOOL_FLAG_CBS(pckmo)
+DEFINE_MUT_EXCL_BOOL_FLAG_CBS(pckmo);
+DEFINE_MUT_EXCL_BOOL_FLAG_CBS(cck_extension_secret_enforcement);
 
 gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 			   GError **err)
@@ -280,7 +295,7 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 		  .arg_data = &args->host_keys,
 		  .description =
 			_("FILE specifies a host-key document. At least\n" INDENT
-			  "one is required Specify this option multiple times\n" INDENT
+			  "one is required. Specify this option multiple times\n" INDENT
 			  "to enable the image to run on more than one host."),
 		  .arg_description = _("FILE") },
 		{ .long_name = "cert",
@@ -325,27 +340,31 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 		  .description = _("Use the kernel parameters stored in PARMFILE\n" INDENT
 				   "(optional)."),
 		  .arg_description = _("PARMFILE") },
+		MUT_EXCL_BOOL_FLAG(dump, dump,
+				   _("Enable PV guest dumps (optional). This option\n" INDENT
+				     "requires the '--comm-key' option."),
+				   _("Disable PV guest dumps (default).")),
 		MUT_EXCL_BOOL_FLAG(
-			dump,
+			cck-extension-secret, cck_extension_secret_enforcement,
-			_("Enable PV guest dumps (optional). This option\n" INDENT
+			_("Add-secret requests must provide an extension\n" INDENT
-			  "requires the '--comm-key' option."),
+			  "secret that matches the CCK-derived extension\n" INDENT
-			_("Disable PV guest dumps (default) (optional).")),
+			  "secret (optional). This option requires the\n" INDENT
-		MUT_EXCL_BOOL_FLAG(
+			  "'--comm-key' option."),
-			pckmo,
+			_("Add-secret requests don't have to provide\n" INDENT
-			_("Enable the support for the DEA, TDEA, AES, and\n" INDENT
+			  "the CCK-derived extension secret (default).")),
-			  "ECC PCKMO key encryption functions (default)\n" INDENT
+		MUT_EXCL_BOOL_FLAG(pckmo, pckmo,
-			  "(optional)."),
+				   _("Enable the support for the DEA, TDEA, AES, and\n" INDENT
-			_("Disable the support for the DEA, TDEA, AES, and\n" INDENT
+				     "ECC PCKMO key encryption functions (default)."),
-			  "ECC PCKMO key encryption functions (optional).")),
+				   _("Disable the support for the DEA, TDEA, AES, and\n" INDENT
+				     "ECC PCKMO key encryption functions (optional).")),
 		{ .long_name = "comm-key",
 		  .short_name = 0,
 		  .flags = G_OPTION_FLAG_FILENAME,
 		  .arg = G_OPTION_ARG_CALLBACK,
 		  .arg_data = cb_set_string_option,
 		  .description = _(
-			  "FILE contains the key with which you encrypt\n" INDENT
+			  "FILE contains the customer communication key\n" INDENT
-			  "the PV guest dump (optional). Required by\n" INDENT
+			  "(CCK) (optional)."),
-			  "the '--enable-dump' option."),
 		  .arg_description = _("FILE") },
 		{ .long_name = "crl",
 		  .short_name = 0,
@@ -450,6 +469,8 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 		  .arg_data = cb_set_string_option,
 		  .description = _("Specify the secret control flags\n" INDENT
 				   "as a hexadecimal value.\n" INDENT
+				   "Optional; mutually exclusive with\n" INDENT
+				   "'--(enable|disable)-cck-extension-secret';\n" INDENT
 				   "Optional; default: '0x0'."),
 		  .arg_description = _("VALUE") },
 		{ 0 },
@@ -487,8 +508,10 @@ PvArgs *pv_args_new(void)
 	g_autoptr(PvArgs) args = g_new0(PvArgs, 1);
 
 	args->unused_values = g_ptr_array_new_with_free_func(g_free);
-	args->allow_dump = PV_NOT_SET;
+	/* `args->cf_args` is implicitly initialized with zeros since
-	args->allow_pckmo = PV_NOT_SET;
+	 * `g_new0` is used. So there is no reason to explicitly
+	 * initialize the values as PV_NOT_SET == 0.
+	 */
 	return g_steal_pointer(&args);
 }
 
@@ -497,8 +520,8 @@ void pv_args_free(PvArgs *args)
 	if (!args)
 		return;
 
-	g_free(args->pcf);
+	g_free(args->cf_args.pcf);
-	g_free(args->scf);
+	g_free(args->cf_args.scf);
 	g_free(args->psw_addr);
 	g_free(args->cust_root_key_path);
 	g_free(args->cust_comm_key_path);

genprotimg/src/pv/pv_args.h

@@ -23,19 +23,27 @@ PvArg *pv_arg_new(PvComponentType type, const gchar *path);
 void pv_arg_free(PvArg *arg);
 
 typedef enum pv_tristate {
-		  PV_NOT_SET = 0,
+	PV_NOT_SET = 0,
-		  PV_TRUE,
+	PV_TRUE,
-		  PV_FALSE,
+	PV_FALSE,
 } PvTristate;
+/* The value of PV_NOT_SET is not allowed to be changed */
+STATIC_ASSERT(PV_NOT_SET == 0)
+
+typedef struct {
+	gchar *pcf;
+	gchar *scf;
+	/* Add-secret requests do require CCK-extension secrets */
+	PvTristate enable_cck_extension_secret_enforcement;
+	PvTristate enable_dump;
+	PvTristate enable_pckmo;
+} PvControlFlagsArgs;
 
 typedef struct {
 	gint log_level;
 	gint no_verify;
 	gboolean offline;
-	gchar *pcf;
+	PvControlFlagsArgs cf_args;
-	gchar *scf;
-	PvTristate allow_dump;
-	PvTristate allow_pckmo;
 	gchar *psw_addr; /* PSW address which will be used for the start of
 			  * the actual component (e.g. Linux kernel)
 			  */

genprotimg/src/pv/pv_comp.c

@@ -15,7 +15,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include "boot/s390.h"
 #include "common.h"
 #include "utils/align.h"
 #include "utils/buffer.h"

genprotimg/src/pv/pv_comps.c

@@ -12,7 +12,7 @@
 #include <openssl/evp.h>
 #include <stdint.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "boot/stage3b.h"
 #include "common.h"
 #include "utils/align.h"

genprotimg/src/pv/pv_comps.h

@@ -14,7 +14,7 @@
 #include <openssl/evp.h>
 #include <stdint.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "boot/stage3b.h"
 #include "utils/buffer.h"
 

genprotimg/src/pv/pv_hdr.c

@@ -14,7 +14,7 @@
 #include <stdint.h>
 #include <string.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "include/pv_crypto_def.h"
 #include "utils/buffer.h"
 #include "utils/crypto.h"

genprotimg/src/pv/pv_hdr.h

@@ -13,7 +13,6 @@
 #include <glib.h>
 #include <stdint.h>
 
-#include "boot/s390.h"
 #include "include/pv_hdr_def.h"
 #include "utils/crypto.h"
 #include "utils/buffer.h"

genprotimg/src/pv/pv_image.c

@@ -15,7 +15,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "boot/stage3a.h"
 #include "common.h"
 #include "include/pv_crypto_def.h"
@@ -228,37 +228,40 @@ static gint pv_img_set_psw_addr(PvImage *img, const gchar *psw_addr_s,
 	return 0;
 }
 
-static gint pv_img_set_control_flags(PvImage *img, const gchar *pcf_s,
+static void pv_img_set_control_flag(uint64_t *flags, const PvTristate option, const uint64_t flag)
-				     const gchar *scf_s,
+{
-				     PvTristate allow_dump,
+	if (option == PV_TRUE)
-				     PvTristate allow_pckmo, GError **err)
+		*flags |= flag;
+	else if (option == PV_FALSE)
+		*flags &= ~flag;
+}
+
+static gint pv_img_set_control_flags(PvImage *img, const PvControlFlagsArgs *cf_args, GError **err)
 {
 	uint64_t flags;
 
-	if (pcf_s) {
+	/* Set plain control flags */
-		if (hex_str_toull(pcf_s, &flags, err) < 0)
+	if (cf_args->pcf) {
+		if (hex_str_toull(cf_args->pcf, &flags, err) < 0)
 			return -1;
 
 		img->pcf = flags;
 	}
 
-	if (scf_s) {
+	pv_img_set_control_flag(&img->pcf, cf_args->enable_dump, PV_PCF_ALLOW_DUMPING);
-		if (hex_str_toull(scf_s, &flags, err) < 0)
+	pv_img_set_control_flag(&img->pcf, cf_args->enable_pckmo,
+				PV_PCF_PCKM_ECC | PV_PCF_PCKMO_AES | PV_PCF_PCKMO_DEA_TDEA);
+
+	/* Set secret control flags */
+	if (cf_args->scf) {
+		if (hex_str_toull(cf_args->scf, &flags, err) < 0)
 			return -1;
 
 		img->scf = flags;
 	}
 
-	if (allow_dump == PV_TRUE)
+	pv_img_set_control_flag(&img->scf, cf_args->enable_cck_extension_secret_enforcement,
-		img->pcf |= PV_PCF_ALLOW_DUMPING;
+				PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT);
-	else if (allow_dump == PV_FALSE)
-		img->pcf &= ~PV_PCF_ALLOW_DUMPING;
-
-	if (allow_pckmo == PV_TRUE)
-		img->pcf |= PV_PCF_PCKM_ECC | PV_PCF_PCKMO_AES | PV_PCF_PCKMO_DEA_TDEA;
-	else if (allow_pckmo == PV_FALSE)
-		img->pcf &= ~(PV_PCF_PCKM_ECC | PV_PCF_PCKMO_AES | PV_PCF_PCKMO_DEA_TDEA);
-
 	return 0;
 }
 
@@ -610,9 +613,7 @@ PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err)
 		return NULL;
 
 	/* set the control flags: PCF and SCF */
-	if (pv_img_set_control_flags(ret, args->pcf, args->scf,
+	if (pv_img_set_control_flags(ret, &args->cf_args, err) < 0)
-				     args->allow_dump, args->allow_pckmo,
-				     err) < 0)
 		return NULL;
 
 	/* read in the keys */
@@ -683,7 +684,26 @@ gint pv_img_add_component(PvImage *img, const PvArg *arg, GError **err)
 {
 	g_autoptr(PvComponent) comp = NULL;
 
-	comp = pv_component_new_file(arg->type, arg->path, err);
+	switch (arg->type) {
+	case PV_COMP_TYPE_INITRD:
+	case PV_COMP_TYPE_KERNEL:
+	case PV_COMP_TYPE_STAGE3B:
+		comp = pv_component_new_file(arg->type, arg->path, err);
+		break;
+	case PV_COMP_TYPE_CMDLINE: {
+		g_autoptr(PvBuffer) buf = NULL;
+		g_autofree char *data = NULL;
+		gsize length;
+
+		if (!g_file_get_contents(arg->path, &data, &length, err))
+			return -1;
+
+		/* Add one for the null terminator */
+		buf = pv_buffer_take(g_steal_pointer(&data), length + 1);
+		comp = pv_component_new_buf(arg->type, buf, err);
+	} break;
+	}
+
 	if (!comp)
 		return -1;
 

genprotimg/src/pv/pv_image.h

@@ -15,7 +15,7 @@
 #include <openssl/evp.h>
 #include <stdint.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "utils/buffer.h"
 
 #include "pv_args.h"

genprotimg/src/pv/pv_ipib.c

@@ -13,7 +13,6 @@
 #include <stdio.h>
 
 #include "boot/ipl.h"
-#include "boot/s390.h"
 #include "common.h"
 #include "include/pv_hdr_def.h"
 #include "lib/zt_common.h"
@@ -60,7 +59,7 @@ static gint pv_ipib_init(IplParameterBlock *ipib, GSList *comps,
 	ipib_size = MAX(ipl_pl_hdr_size + blk0_len, (uint32_t)PAGE_SIZE);
 	g_assert(pv_ipib_get_size(comps_length) == ipib_size);
 
-	pv->pbt = IPL_TYPE_PV;
+	pv->pbt = IPL_PBT_PV;
 	pv->len = GUINT32_TO_BE(blk0_len);
 	pv->num_comp = GUINT32_TO_BE(comps_length);
 	/* both values will be overwritten during the IPL process by

genprotimg/src/pv/pv_stage3.h

@@ -15,7 +15,6 @@
 #include <stdint.h>
 
 #include "boot/ipl.h"
-#include "boot/s390.h"
 #include "boot/stage3b.h"
 #include "utils/buffer.h"
 

genprotimg/src/utils/align.h

@@ -10,8 +10,8 @@
 #ifndef PV_UTILS_ALIGN_H
 #define PV_UTILS_ALIGN_H
 
-#include "boot/s390.h"
 #include "lib/zt_common.h"
+#include "boot/page.h"
 
 #define IS_ALIGNED(addr, size) (!(addr & (size - 1)))
 

genprotimg/src/utils/buffer.c

@@ -26,6 +26,15 @@ PvBuffer *pv_buffer_alloc(gsize size)
 	return ret;
 }
 
+PvBuffer *pv_buffer_take(char *data, gsize size)
+{
+	PvBuffer *ret = g_new0(PvBuffer, 1);
+
+	ret->data = data;
+	ret->size = size;
+	return ret;
+}
+
 PvBuffer *pv_buffer_dup(const PvBuffer *buf, gboolean page_aligned)
 {
 	PvBuffer *ret;

genprotimg/src/utils/buffer.h

@@ -21,6 +21,10 @@ typedef struct PvBuffer {
 } PvBuffer;
 
 PvBuffer *pv_buffer_alloc(gsize size);
+/* After this call @data belongs to the PvBuffer and must no longer be modified
+ * by the caller.
+ */
+PvBuffer *pv_buffer_take(char *data, gsize size);
 void pv_buffer_free(PvBuffer *buf);
 void pv_buffer_clear(PvBuffer **buf);
 gint pv_buffer_write(const PvBuffer *buf, FILE *file, GError **err);

genprotimg/src/utils/crypto.c

@@ -24,7 +24,7 @@
 #include <stdint.h>
 #include <string.h>
 
-#include "boot/s390.h"
+#include "boot/page.h"
 #include "common.h"
 #include "include/pv_crypto_def.h"
 #include "pv/pv_error.h"

hmcdrvfs/Makefile

@@ -19,13 +19,8 @@ check_dep:
 		"fuse3-devel or libfuse3-dev", \
 		"HAVE_FUSE=0")
 
-ifneq ($(shell sh -c 'command -v pkg-config'),)
+FUSE_CFLAGS = $(shell $(PKG_CONFIG) --silence-errors --cflags fuse3)
-FUSE_CFLAGS = $(shell pkg-config --silence-errors --cflags fuse3)
+FUSE_LDLIBS = $(shell $(PKG_CONFIG) --silence-errors --libs fuse3)
-FUSE_LDLIBS = $(shell pkg-config --silence-errors --libs fuse3)
-else
-FUSE_CFLAGS = -D_FILE_OFFSET_BITS=64 -I/usr/include/fuse3
-FUSE_LDLIBS = -lfuse3
-endif
 ALL_CFLAGS += -DFUSE_USE_VERSION=30 -D_LARGEFILE_SOURCE $(FUSE_CFLAGS)
 LDLIBS += $(FUSE_LDLIBS) -lpthread -lrt -ldl -lm
 
@@ -52,7 +47,7 @@ install-scripts: lshmc
 		cat $$i | \
 		sed -e 's/%S390_TOOLS_VERSION%/$(S390_TOOLS_RELEASE)/' \
 		>$(DESTDIR)$(USRSBINDIR)/$$i; \
-		chown $(OWNER).$(GROUP) $(DESTDIR)$(USRSBINDIR)/$$i; \
+		chown $(OWNER):$(GROUP) $(DESTDIR)$(USRSBINDIR)/$$i; \
 		chmod 755 $(DESTDIR)$(USRSBINDIR)/$$i; \
 	done
 

hsavmcore/Makefile

@@ -22,26 +22,16 @@ else # HAVE_FUSE
 #
 # FUSE
 #
-ifneq ($(shell sh -c 'command -v pkg-config'),)
+FUSE_CFLAGS = $(shell $(PKG_CONFIG) --silence-errors --cflags fuse3)
-  FUSE_CFLAGS = $(shell pkg-config --silence-errors --cflags fuse3)
+FUSE_LDLIBS = $(shell $(PKG_CONFIG) --silence-errors --libs fuse3)
-  FUSE_LDLIBS = $(shell pkg-config --silence-errors --libs fuse3)
-else
-  FUSE_CFLAGS = -I/usr/include/fuse3
-  FUSE_LDLIBS = -lfuse3
-endif
 
 #
 # systemd
 #
 ifneq (${HAVE_SYSTEMD},0)
   ifeq ($(call check_header_prereq,"systemd/sd-daemon.h"),yes)
-    ifneq ($(shell sh -c 'command -v pkg-config'),)
+    SYSTEMD_CFLAGS = $(shell $(PKG_CONFIG) --silence-errors --cflags libsystemd)
-      SYSTEMD_CFLAGS = $(shell pkg-config --silence-errors --cflags libsystemd)
+    SYSTEMD_LDLIBS = $(shell $(PKG_CONFIG) --silence-errors --libs libsystemd)
-      SYSTEMD_LDLIBS = $(shell pkg-config --silence-errors --libs libsystemd)
-    else
-      SYSTEMD_CFLAGS =
-      SYSTEMD_LDLIBS = -lsystemd
-    endif
     ALL_CPPFLAGS += -DHAVE_SYSTEMD
   else
     $(warning "systemd support disabled")

hsci/Makefile

@@ -5,7 +5,7 @@ all:
 install: hsci
 	$(SED) -e 's/%S390_TOOLS_VERSION%/$(S390_TOOLS_RELEASE)/' \
 	< hsci >$(DESTDIR)$(BINDIR)/hsci; \
-	chown $(OWNER).$(GROUP) $(DESTDIR)$(BINDIR)/hsci; \
+	chown $(OWNER):$(GROUP) $(DESTDIR)$(BINDIR)/hsci; \
 	chmod 755 $(DESTDIR)$(BINDIR)/hsci; \
 	$(INSTALL) -d -m 755 $(DESTDIR)$(BINDIR) $(DESTDIR)$(MANDIR)/man8
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 hsci.8 \

hyptop/dg_debugfs_lpar.c

@@ -116,6 +116,7 @@ static void l_sd_cpu_fill(struct sd_cpu *cpu, struct l_x_cpu_info *cpu_info,
 			  int threads)
 {
 	sd_cpu_cpu_time_us_set(cpu, cpu_info->lp_time);
+	sd_cpu_threads_per_core_set(cpu, threads);
 	if (threads > 1)
 		sd_cpu_thread_time_us_set(cpu,
 			cpu_info->lp_time * threads - cpu_info->mt_idle_time);
@@ -297,6 +298,7 @@ static struct sd_sys_item *l_sys_item_vec[] = {
 	&sd_sys_item_thread_cnt,
 	&sd_sys_item_core_diff,
 	&sd_sys_item_thread_diff,
+	&sd_sys_item_smt_diff,
 	&sd_sys_item_mgm_diff,
 	&sd_sys_item_core,
 	&sd_sys_item_thread,
@@ -311,6 +313,7 @@ static struct sd_sys_item *l_sys_item_vec[] = {
 static struct sd_sys_item *l_sys_item_enable_vec[] = {
 	&sd_sys_item_core_cnt,
 	&sd_sys_item_core_diff,
+	&sd_sys_item_thread_diff,
 	&sd_sys_item_mgm_diff,
 	&sd_sys_item_core,
 	&sd_sys_item_mgm,
@@ -325,6 +328,7 @@ static struct sd_cpu_item *l_cpu_item_vec[] = {
 	&sd_cpu_item_type,
 	&sd_cpu_item_core_diff,
 	&sd_cpu_item_thread_diff,
+	&sd_cpu_item_smt_diff,
 	&sd_cpu_item_mgm_diff,
 	&sd_cpu_item_core,
 	&sd_cpu_item_thread,
@@ -339,6 +343,7 @@ static struct sd_cpu_item *l_cpu_item_vec[] = {
 static struct sd_cpu_item *l_cpu_item_enable_vec[] = {
 	&sd_cpu_item_type,
 	&sd_cpu_item_core_diff,
+	&sd_cpu_item_thread_diff,
 	&sd_cpu_item_mgm_diff,
 	NULL,
 };

hyptop/helper.c

@@ -391,3 +391,24 @@ void hyptop_helper_init(void)
 	if (l_iconv_ebcdic_ascii == (iconv_t) -1)
 		ERR_EXIT("Could not initialize iconv\n");
 }
+
+/*
+ * Calculate real SMT utilization
+ * @core_us: core utilization in us
+ * @thr_us: thread utilization in us
+ * @mgm_us: management utilization in us
+ * @thread_per_core: SMT thread count per core
+ */
+s64 ht_calculate_smt_util(u64 core_us, u64 thr_us, u64 mgm_us, int thread_per_core)
+{
+	s64 component1, component2, smt_us;
+	double smt_factor = g.o.smt_factor;
+
+	component1 = thread_per_core * core_us - thr_us;
+	if (thread_per_core > 1)
+		component1 /= smt_factor;
+	component2 = thr_us - core_us;
+	smt_us = G0(component1 + component2 + mgm_us);
+
+	return smt_us;
+}

hyptop/helper.h

@@ -34,6 +34,7 @@ extern void ht_ebcdic_to_ascii(char *in, char *out, size_t len);
 extern char *ht_mount_point_get(const char *fs_type);
 extern u64 ht_ext_tod_2_us(void *tod_ext);
 extern void ht_print_time(void);
+extern s64 ht_calculate_smt_util(u64 core_us, u64 thr_us, u64 mgm_us, int thread_per_core);
 
 /*
  * Memory alloc functions

hyptop/hyptop.8

@@ -74,6 +74,18 @@ In this mode no user input is accepted.
 .BR "\-d <SECONDS>" " or " "\-\-delay=<SECONDS>"
 Specifies the delay between screen updates.
 .TP
+.BR "\-m <FACTOR>" " or " "\-\-smt_factor=<FACTOR>"
+Specifies a workload dependent SMT speedup factor.
+For IBM z15 servers, the default value is 1.3. If the workload benefits
+from SMT, you can specify a higher value. If the workload does not benefit
+from SMT, specifying lower values results in more accurate reports of
+real CPU SMT utilization field for LPARs. There is no hard boundary except
+that it must be a positive value. Example ranges to select a sensible value
+from:
+
+ For IBM z13: [0.8, 1.3]
+ For IBM z15: [1.1, 1.5]
+.TP
 .BR "\-n <ITERATIONS>" " or " "\-\-iterations=<ITERATIONS>"
 Specifies the maximum number of iterations before ending.
 
@@ -119,6 +131,7 @@ The following fields are available under LPAR:
   In "sys_list" and "sys" window:
   'c' - Core dispatch time per second
   'e' - Thread time per second
+  'S' - Real CPU SMT utilization
   'm' - Management time per second
   'C' - Total core dispatch time
   'E' - Total thread time

hyptop/hyptop.h

@@ -22,6 +22,7 @@
 #include "table.h"
 
 #define HYPTOP_OPT_DEFAULT_DELAY	2
+#define HYPTOP_OPT_DEFAULT_SMT_SCALE	1.3
 #define HYPTOP_MAX_WIN_DEPTH		4
 #define HYPTOP_MAX_LINE			512
 #define PROG_NAME			"hyptop"
@@ -60,6 +61,8 @@ struct hyptop_opts {
 
 	int				delay_s;
 	int				delay_us;
+
+	double				smt_factor;
 };
 
 /*

hyptop/opts.c

@@ -39,6 +39,7 @@ static char HELP_TEXT[] =
 "-t, --cpu_types TYPE[,..]       CPU types used for time calculations\n"
 "-b, --batch_mode                Use batch mode (no curses)\n"
 "-d, --delay SECONDS             Delay time between screen updates\n"
+"-m, --smt_factor FACTOR         Machine generation dependent SMT speedup factor.\n"
 "-n, --iterations NUMBER         Number of iterations before ending\n";
 
 /*
@@ -48,6 +49,7 @@ static void l_init_defaults(void)
 {
 	g.prog_name = PROG_NAME;
 	g.o.delay_s = HYPTOP_OPT_DEFAULT_DELAY;
+	g.o.smt_factor = HYPTOP_OPT_DEFAULT_SMT_SCALE;
 	g.w.cur = &win_sys_list;
 	g.o.cur_win = &win_sys_list;
 }
@@ -108,6 +110,20 @@ static void l_delay_set(char *delay_string)
 	g.o.delay_us = 0;
 }
 
+/*
+ * Set SMT factor option
+ */
+static void l_factor_set(char *value_string)
+{
+	double factor;
+
+	if (sscanf(value_string, "%lf", &factor) != 1)
+		ERR_EXIT("The SMT factor \"%s\" is invalid\n", value_string);
+	if (factor <= 0)
+		ERR_EXIT("The SMT factor \"%s\" is <= 0\n", value_string);
+	g.o.smt_factor = factor;
+}
+
 /*
  * Get number of occurrences of character 'c' in "str"
  */
@@ -299,6 +315,7 @@ void opts_parse(int argc, char *argv[])
 		{ "help",        no_argument,       NULL, 'h'},
 		{ "batch_mode",  no_argument,       NULL, 'b'},
 		{ "delay",       required_argument, NULL, 'd'},
+		{ "smt_factor",  required_argument, NULL, 'm'},
 		{ "window",      required_argument, NULL, 'w'},
 		{ "sys",         required_argument, NULL, 's'},
 		{ "iterations",  required_argument, NULL, 'n'},
@@ -307,7 +324,7 @@ void opts_parse(int argc, char *argv[])
 		{ "cpu_types",   required_argument, NULL, 't'},
 		{ NULL,          0,                 NULL, 0  }
 	};
-	static const char option_string[] = "vhbd:w:s:n:f:t:S:";
+	static const char option_string[] = "vhbd:m:w:s:n:f:t:S:";
 
 	l_init_defaults();
 	while (1) {
@@ -328,6 +345,9 @@ void opts_parse(int argc, char *argv[])
 		case 'd':
 			l_delay_set(optarg);
 			break;
+		case 'm':
+			l_factor_set(optarg);
+			break;
 		case 'w':
 			l_window_set(optarg);
 			break;

hyptop/sd.h

@@ -200,6 +200,7 @@ struct sd_cpu {
 	struct sd_cpu_info	*d_cur;
 	struct sd_cpu_info	*d_prev;
 	u16			cnt;
+	int			threads_per_core;
 	enum sd_cpu_state	state;
 };
 
@@ -232,6 +233,11 @@ static inline void sd_cpu_cpu_time_us_set(struct sd_cpu *cpu, u64 value)
 	cpu->d_cur->cpu_time_us = value;
 }
 
+static inline void sd_cpu_threads_per_core_set(struct sd_cpu *cpu, int value)
+{
+	cpu->threads_per_core = value;
+}
+
 static inline void sd_cpu_thread_time_us_set(struct sd_cpu *cpu, u64 value)
 {
 	cpu->d_cur->thread_time_us = value;
@@ -335,6 +341,7 @@ extern struct sd_cpu_item sd_cpu_item_state;
 extern struct sd_cpu_item sd_cpu_item_cpu_diff;
 extern struct sd_cpu_item sd_cpu_item_core_diff;
 extern struct sd_cpu_item sd_cpu_item_thread_diff;
+extern struct sd_cpu_item sd_cpu_item_smt_diff;
 extern struct sd_cpu_item sd_cpu_item_mgm_diff;
 extern struct sd_cpu_item sd_cpu_item_wait_diff;
 extern struct sd_cpu_item sd_cpu_item_steal_diff;
@@ -398,6 +405,7 @@ static inline char *sd_sys_item_str(struct sd_sys *sys,
 extern struct sd_sys_item sd_sys_item_cpu_cnt;
 extern struct sd_sys_item sd_sys_item_core_cnt;
 extern struct sd_sys_item sd_sys_item_thread_cnt;
+extern struct sd_sys_item sd_sys_item_smt_diff;
 extern struct sd_sys_item sd_sys_item_cpu_oper_cnt;
 extern struct sd_sys_item sd_sys_item_cpu_deconf_cnt;
 extern struct sd_sys_item sd_sys_item_cpu_stop_cnt;

hyptop/sd_cpu_items.c

@@ -98,6 +98,18 @@ static u64 l_cpu_item_64(struct sd_cpu_item *item, struct sd_cpu *cpu)
 		return l_cpu_info_u64(cpu->d_cur, item->offset) / cpu->cnt;
 }
 
+static u64 l_cpu_smt_util(struct sd_cpu_item *item, struct sd_cpu *cpu)
+{
+	u64 core_us, thr_us, mgm_us;
+	(void)item;
+
+	core_us = sd_cpu_item_u64(&sd_cpu_item_core_diff, cpu);
+	thr_us = sd_cpu_item_u64(&sd_cpu_item_thread_diff, cpu);
+	mgm_us = sd_cpu_item_u64(&sd_cpu_item_mgm_diff, cpu);
+
+	return ht_calculate_smt_util(core_us, thr_us, mgm_us, cpu->threads_per_core);
+}
+
 /*
  * CPU item definitions
  */
@@ -139,6 +151,13 @@ struct sd_cpu_item sd_cpu_item_thread_diff = {
 	.fn_u64	= l_cpu_diff_u64,
 };
 
+struct sd_cpu_item sd_cpu_item_smt_diff = {
+	.table_col = TABLE_COL_TIME_DIFF_SUM(table_col_unit_perc, 'S', "smt"),
+	.type	= SD_TYPE_U64,
+	.desc	= "Real CPU SMT utilization",
+	.fn_u64	= l_cpu_smt_util,
+};
+
 struct sd_cpu_item sd_cpu_item_mgm_diff = {
 	.table_col = TABLE_COL_TIME_DIFF_SUM(table_col_unit_perc, 'm', "mgm"),
 	.type	= SD_TYPE_U64,

hyptop/sd_sys_items.c

@@ -208,6 +208,18 @@ static s64 l_sys_cpu_info_diff_s64(struct sd_sys_item *item, struct sd_sys *sys)
 	return rc;
 }
 
+static u64 l_sys_smt_util(struct sd_sys_item *item, struct sd_sys *sys)
+{
+	u64 core_us, thr_us, mgm_us;
+	(void)item;
+
+	core_us = sd_sys_item_u64(sys, &sd_sys_item_core_diff);
+	thr_us = sd_sys_item_u64(sys, &sd_sys_item_thread_diff);
+	mgm_us = sd_sys_item_u64(sys, &sd_sys_item_mgm_diff);
+
+	return ht_calculate_smt_util(core_us, thr_us, mgm_us, sys->threads_per_core);
+}
+
 /*
  * System item definitions
  */
@@ -277,6 +289,13 @@ struct sd_sys_item sd_sys_item_thread_diff = {
 	.fn_u64	= l_sys_cpu_info_diff_u64,
 };
 
+struct sd_sys_item sd_sys_item_smt_diff = {
+	.table_col = TABLE_COL_TIME_DIFF_SUM(table_col_unit_perc, 'S', "smt"),
+	.type	= SD_TYPE_U64,
+	.desc	= "Real CPU SMT utilization",
+	.fn_u64	= l_sys_smt_util,
+};
+
 struct sd_sys_item sd_sys_item_mgm_diff = {
 	.table_col = TABLE_COL_TIME_DIFF_SUM(table_col_unit_perc, 'm', "mgm"),
 	.offset = SD_CPU_INFO_OFFSET(mgm_time_us),

include/boot/boot_defs.h

@@ -85,7 +85,8 @@ enum blkptr_format_id {
 	 * this is the "new" format which serves only List-Directed IPL,
 	 * but is also suitable for CCW-type IPL.
 	 */
-	BLKPTR_FORMAT_ID
+	BLKPTR_FORMAT_ID,
+	NR_BLKPTR_FORMATS
 };
 
 /*
@@ -194,15 +195,25 @@ struct boot_info_bp_dump {
 	uint8_t		unused[16];
 } __packed;
 
+/* This represents on-disk pointer to a block on disk */
+union disk_blockptr {
+	struct eckd_blockptr_legacy eckd_legacy;
+	struct eckd_blockptr eckd;
+	struct linear_blockptr linear;
+};
+
 struct boot_info_bp_ipl {
-	union {
+	union disk_blockptr bm_ptr;
-		struct eckd_blockptr_legacy eckd_legacy;
-		struct eckd_blockptr eckd;
-		struct linear_blockptr lin;
-	} bm_ptr;
 	uint8_t		unused[16];
 } __packed;
 
+struct disk_program_table {
+	uint32_t magic;
+	uint32_t version;
+	uint64_t unused;
+	union disk_blockptr component_table[0];
+} __packed;
+
 struct boot_info {
 	char		magic[4];
 	uint8_t		version;

include/boot/error.h

@@ -34,10 +34,10 @@
 /* Secure IPL error */
 #define ESECUREBOOT		0x00004512
 
-/* kdump: No operating system information was found */
+/* os_info error: No operating system information was found */
 #define EOS_INFO_MISSING	0x00004520
 
-/* kdump: The checksum of the operating system information is incorrect */
+/* os_info error: The checksum of the operating system information is incorrect */
 #define EOS_INFO_CSUM_FAILED	0x00004521
 
 /* kdump: The major version of the operating system information is too high */

include/boot/ipl.h

@@ -11,7 +11,7 @@
 #define IPL_H
 
 #include "lib/zt_common.h"
-#include "s390.h"
+#include "page.h"
 
 #define IPL_FLAG_SECURE		 0x40
 
@@ -21,10 +21,6 @@
 #define IPL_MAX_SUPPORTED_VERSION	0
 #define IPL_PARM_BLOCK_VERSION		0x1
 
-/* IPL Types */
-#define IPL_TYPE_PV			0x5
-
-
 #ifndef __ASSEMBLER__
 
 #include <stdint.h>
@@ -43,6 +39,16 @@ struct ipl_pb_hdr {
 	uint8_t  pbt;
 } __packed;
 
+/* IPL Parameter Block types */
+enum ipl_pbt {
+	IPL_PBT_FCP = 0,
+	IPL_PBT_SCP_DATA = 1,
+	IPL_PBT_CCW = 2,
+	IPL_PBT_ECKD = 3,
+	IPL_PBT_NVME = 4,
+	IPL_PBT_PV = 5,
+};
+
 /* IPL Parameter Block 0 with common fields */
 struct ipl_pb0_common {
 	uint32_t len;

include/boot/loaders_layout.h

@@ -14,12 +14,26 @@
 #include "lib/zt_common.h"
 #include "linux_layout.h"
 
+#define STAGE0_LOAD_ADDRESS		_AC(0x0, UL)
+
+#define STAGE1_LOAD_ADDRESS		_AC(0x18, UL)
+#define STAGE1B_LOAD_ADDRESS		_AC(0xe000, UL)
+
 #define STAGE2_DESC			_AC(0x78, UL)
 #define STAGE2_ENTRY			_AC(0x2018, UL)
 #define STAGE2_HEAP_ADDRESS		_AC(0x6000, UL)
+#define ECKD2DUMP_SV_HEAP_ADDRESS	_AC(0xb000, UL)
 #define STAGE2_HEAP_SIZE		_AC(0x3000, UL)
 #define STAGE2_STACK_ADDRESS		_AC(0xe400, UL)
 #define STAGE2_STACK_SIZE		_AC(0x1c00, UL)
+#define ECKD2DUMP_SV_STACK_ADDRESS	_AC(0xe000, UL)
+#define ECKD2DUMP_SV_STACK_SIZE		_AC(0x2000, UL)
+#define STAGE2_MAX_SIZE			_AC(0x3000, UL)
+
+#define STAGE2_DUMPER_SIZE_V1		_AC(0x1000, UL)
+#define STAGE2_DUMPER_SIZE_V2		_AC(0x2000, UL)
+#define STAGE2_DUMPER_SIZE_V3		_AC(0x3000, UL)
+#define STAGE2_DUMPER_SIZE_ZLIB		_AC(0x8000, UL)
 
 #define STAGE3_ENTRY			_AC(0xa000, UL)
 

include/boot/os_info.h

@@ -0,0 +1,78 @@
+/*
+ * zipl - zSeries Initial Program Loader tool
+ *
+ * os-info definitions
+ *
+ * Copyright IBM Corp. 2013, 2023
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef OS_INFO_H
+#define OS_INFO_H
+
+#include "lib/zt_common.h"
+#include "boot/error.h"
+#include "boot/s390.h"
+#include <stdint.h>
+
+#define OS_INFO_MAGIC			0x4f53494e464f535aULL /* OSINFOSZ */
+#define OS_INFO_CSUM_SIZE		(sizeof(struct os_info) - offsetof(struct os_info, version_major))
+#define OS_INFO_FLAGS_ENTRY_SIZE	(sizeof(unsigned long))
+
+#define OS_INFO_VMCOREINFO		0
+#define OS_INFO_REIPL_BLOCK		1
+#define OS_INFO_FLAGS_ENTRY		2
+
+#define OS_INFO_FLAG_REIPL_CLEAR	(1UL << 0)
+
+struct os_info_entry {
+	uint64_t addr;
+	uint64_t size;
+	uint32_t csum;
+} __packed;
+
+struct os_info {
+	uint64_t magic;
+	uint32_t csum;
+	uint16_t version_major;
+	uint16_t version_minor;
+	uint64_t crashkernel_addr;
+	uint64_t crashkernel_size;
+	struct os_info_entry entry[3];
+	uint8_t reserved[4004];
+} __packed;
+
+/*
+ * Return 0 in case of valid os_info
+ * Return -EOS_INFO_MISSING if os_info address is not page aligned or page is
+ * not accessible or os_info magic value is missing.
+ * Return -EOS_INFO_CSUM_FAILED if os_info checksum is invalid.
+ */
+static inline int os_info_check(const struct os_info *os_info)
+{
+	if (!os_info ||
+	    (unsigned long)os_info % PAGE_SIZE ||
+	    !page_is_valid((unsigned long)os_info) ||
+	    os_info->magic != OS_INFO_MAGIC)
+		return -EOS_INFO_MISSING;
+	if (os_info->csum != csum_partial(&os_info->version_major, OS_INFO_CSUM_SIZE, 0))
+		return -EOS_INFO_CSUM_FAILED;
+	return 0;
+}
+
+/*
+ * Return 1 in case of valid os_info_entry, otherwise 0
+ * Make sure that the entire os_info structure is checked first with os_info_check().
+ */
+static inline int os_info_entry_is_valid(const struct os_info_entry *entry)
+{
+	return (entry &&
+		entry->addr &&
+		entry->size &&
+		page_is_valid(entry->addr) &&
+		entry->csum == csum_partial((void *)entry->addr, entry->size, 0));
+}
+
+#endif /* OS_INFO_H */

include/boot/page.h

@@ -0,0 +1,15 @@
+/*
+ * Page related definitions and functions.
+ *
+ * Copyright IBM Corp. 2023
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef BOOT_PAGE_H
+#define BOOT_PAGE_H
+#include "lib/zt_common.h"
+
+#define PAGE_SIZE		_AC(4096, UL)
+#endif

include/boot/psw.h

@@ -0,0 +1,31 @@
+/*
+ * Program Status Word related definitions and functions.
+ *
+ * Copyright IBM Corp. 2023
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef BOOT_PSW_H
+#define BOOT_PSW_H
+
+#include "lib/zt_common.h"
+
+#define PSW32_ADDR_MASK   _AC(0x000000007fffffff, UL)
+#define PSW_MASK_BA	  _AC(0x0000000080000000, UL)
+#define PSW_MASK_EA	  _AC(0x0000000100000000, UL)
+#define PSW_MASK_BIT_12	  _AC(0x0008000000000000, UL)
+#define PSW_LOAD	  _AC(0x0008000080000000, UL)
+#define PSW_DISABLED_WAIT _AC(0x000a000000000000, UL)
+
+#ifndef __ASSEMBLER__
+#include <stdint.h>
+
+struct psw_t {
+	uint64_t mask;
+	uint64_t addr;
+} __aligned(8);
+
+#endif
+#endif

include/boot/s390.h

@@ -1,7 +1,8 @@
 /*
  * s390 related definitions and functions.
+ * Should only be used for code targeting s390 (bootloader code)
  *
- * Copyright IBM Corp. 2013, 2020
+ * Copyright IBM Corp. 2013, 2023
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -12,29 +13,23 @@
 
 #include "lib/zt_common.h"
 #include "boot/sigp.h"
+#include "boot/psw.h"
+#include "boot/page.h"
 
 #define __LC_IPLDEV		0x0c6c
 #define __LC_OS_INFO		0x0e18
 
 #define LOWCORE_SIZE		_AC(0x2000, UL)
 
-#define PAGE_SIZE		_AC(4096, UL)
-
 /* Minimum size of a stack frame in bytes */
 #define STACK_FRAME_OVERHEAD	_AC(160, U)
 
 /* Facilities */
+#define DFLTCC_FACILITY		_AC(151, U)
 #define UNPACK_FACILITY		_AC(161, U)
 
-#define PSW32_ADDR_MASK   _AC(0x000000007fffffff, UL)
-#define PSW_MASK_BA	  _AC(0x0000000080000000, UL)
-#define PSW_MASK_EA	  _AC(0x0000000100000000, UL)
-#define PSW_MASK_BIT_12	  _AC(0x0008000000000000, UL)
-#define PSW_LOAD	  _AC(0x0008000080000000, UL)
-#define PSW_DISABLED_WAIT _AC(0x000a000000000000, UL)
-
-
 #ifndef __ASSEMBLER__
+#include <stdint.h>
 
 /*
  * Helper macro for exception table entries
@@ -46,18 +41,6 @@
 	".long	(" #_target ")\n"	\
 	".previous\n"
 
-struct psw_t {
-	uint64_t mask;
-	uint64_t addr;
-} __aligned(8);
-
-struct psw32_t {
-	uint32_t mask;
-	uint32_t addr;
-} __aligned(8);
-
-void load_wait_psw(uint64_t, struct psw_t *);
-
 struct subchannel_id {
 	uint32_t cssid:8;
 	uint32_t:4;
@@ -303,18 +286,21 @@ static __always_inline void __ctl_set_bit(unsigned int cr, unsigned int bit)
  * DIAG 308 support
  */
 enum diag308_subcode {
-	DIAG308_REL_HSA	  = 2,
+	DIAG308_CLEAR_RESET = 0,
-	DIAG308_IPL	  = 3,
+	DIAG308_LOAD_NORMAL_RESET = 1,
-	DIAG308_DUMP	  = 4,
+	DIAG308_REL_HSA = 2,
-	DIAG308_SET	  = 5,
+	DIAG308_LOAD_CLEAR = 3,
-	DIAG308_STORE	  = 6,
+	DIAG308_LOAD_NORMAL_DUMP = 4,
+	DIAG308_SET = 5,
+	DIAG308_STORE = 6,
+	DIAG308_LOAD_NORMAL = 7,
 	DIAG308_SET_PV	  = 8,
 	DIAG308_UNPACK_PV = 10,
 };
 
 enum diag308_rc {
 	DIAG308_RC_OK	      = 0x0001,
-	DIAG308_RC_NO_CONF    = 0x0102,
+	DIAG308_RC_NOCONFIG   = 0x0102,
 };
 
 static __always_inline unsigned long diag308(unsigned long subcode, void *addr)

include/dump/s390_dump.h

@@ -0,0 +1,134 @@
+/*
+ * s390 related definitions and functions.
+ *
+ * Copyright IBM Corp. 2013, 2023
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef S390_DUMP_H
+#define S390_DUMP_H
+
+#include <stdint.h>
+
+#include "boot/page.h"
+#include "lib/zt_common.h"
+
+/*
+ * S390 dump format defines
+ */
+#define DF_S390_MAGIC		0xa8190173618f23fdULL
+#define DF_S390_MAGIC_EXT	0xa8190173618f23feULL
+#define DF_S390_HDR_SIZE	0x1000
+#define DF_S390_EM_SIZE		16
+#define DF_S390_EM_MAGIC	0x44554d505f454e44ULL
+#define DF_S390_EM_STR		"DUMP_END"
+#define DF_S390_CPU_MAX		512
+#define DF_S390_MAGIC_BLK_ECKD	3
+
+/*
+ * Architecture of dumped system
+ */
+enum df_s390_arch {
+	DF_S390_ARCH_32	= 1,
+	DF_S390_ARCH_64	= 2,
+};
+
+/*
+ * zipl parameters passed at tail of dump tools
+ */
+struct stage2dump_parm_tail {
+	char		reserved[6];
+	uint8_t		no_compress;
+	uint8_t		mvdump_force;
+	uint64_t	mem_upper_limit;
+} __packed;
+
+/*
+ * s390 dump header format
+ */
+struct df_s390_hdr {
+	uint64_t	magic;				/* 0x000 */
+	uint32_t	version;			/* 0x008 */
+	uint32_t	hdr_size;			/* 0x00c */
+	uint32_t	dump_level;			/* 0x010 */
+	uint32_t	page_size;			/* 0x014 */
+	uint64_t	mem_size;			/* 0x018 */
+	uint64_t	mem_start;			/* 0x020 */
+	uint64_t	mem_end;			/* 0x028 */
+	uint32_t	num_pages;			/* 0x030 */
+	uint32_t	pad;				/* 0x034 */
+	uint64_t	tod;				/* 0x038 */
+	uint64_t	cpu_id;				/* 0x040 */
+	uint32_t	arch;				/* 0x048 */
+	uint32_t	volnr;				/* 0x04c */
+	uint32_t	build_arch;			/* 0x050 */
+	uint64_t	mem_size_real;			/* 0x054 */
+	uint8_t		mvdump;				/* 0x05c */
+	uint16_t	cpu_cnt;			/* 0x05d */
+	uint16_t	real_cpu_cnt;			/* 0x05f */
+	uint8_t		zlib_version_s390;		/* 0x061 */
+	uint32_t	zlib_entry_size;		/* 0x062 */
+	uint8_t		end_pad1[0x200 - 0x066];	/* 0x066 */
+	uint64_t	mvdump_sign;			/* 0x200 */
+	uint64_t	mvdump_zipl_time;		/* 0x208 */
+	uint8_t		end_pad2[0x800 - 0x210];	/* 0x210 */
+	uint32_t	lc_vec[DF_S390_CPU_MAX];	/* 0x800 */
+} __packed __aligned(16);
+
+/*
+ *  End marker: Should be at the end of every valid s390 crash dump
+ */
+struct df_s390_em {
+	union {
+		uint64_t magic;
+		char str[8];
+	};
+	uint64_t tod;
+} __packed __aligned(16);
+
+/*
+ * Dump segment header
+ */
+struct df_s390_dump_segm_hdr {
+	union {
+		struct {
+			uint64_t start;				/* 0x000 */
+			uint64_t len;				/* 0x008 */
+			uint64_t stop_marker;			/* 0x010 */
+			/* Size in blocks of compressed dump segment written to disk */
+			uint32_t size_on_disk;			/* 0x018 */
+			uint8_t  reserved_pad[0x30 - 0x1c];	/* 0x01c */
+			/*
+			 * Number of compressed entries in this dump segment (up to
+			 * 1011 entries)
+			 */
+			uint32_t entry_count;			/* 0x030 */
+			/*
+			 * Offsets in blocks to compressed entries written to disk
+			 * from the start of the dump segment.
+			 * High-order bit is set if the entry has been written
+			 * uncompressed.
+			 */
+			uint32_t entry_offset[];		/* 0x034 */
+		} __packed;
+		uint8_t padding[PAGE_SIZE];
+	};
+};
+
+/* Data compression granularity (size of input data chunk for zlib deflate) */
+#define DUMP_SEGM_ZLIB_ENTSIZE   (1 * MIB)
+/* Maximum number of compressed entries in one dump segment */
+#define DUMP_SEGM_ZLIB_MAXENTS   ((sizeof(struct df_s390_dump_segm_hdr) \
+				   - offsetof(struct df_s390_dump_segm_hdr, entry_offset)) \
+				   / sizeof(uint32_t))
+/*
+ * Maximum length of compressed dump segment considering the size of
+ * a single input chunk
+ */
+#define DUMP_SEGM_ZLIB_MAXLEN    (DUMP_SEGM_ZLIB_MAXENTS * DUMP_SEGM_ZLIB_ENTSIZE)
+/* Bitmask to mark uncompressed chunks */
+#define DUMP_SEGM_ENTRY_UNCOMPRESSED    0x80000000
+
+#endif /* S390_DUMP_H */

include/lib/ap.h

@@ -89,6 +89,7 @@ void ap_list_remove_all(struct util_list *list);
 /* Lock Functions */
 int ap_get_lock(void);
 int ap_get_lock_callout(void);
+int ap_try_lock_callout(void);
 int ap_release_lock(void);
 int ap_release_lock_callout(void);
 

include/lib/util_lockfile.h

@@ -23,4 +23,6 @@ int util_lockfile_parent_lock(char *lockfile, int retries);
 int util_lockfile_release(char *lockfile);
 int util_lockfile_parent_release(char *lockfile);
 
+int util_lockfile_peek_owner(char *lockfile, int *pid);
+
 #endif /** LIB_UTIL_LOCKFILE_H @} */

include/libpv/glib-helper.h

@@ -18,6 +18,12 @@
 #define GLIB_VERSION_MIN_REQUIRED GLIB_VERSION_2_56
 #endif
 
+#define GLIB_VERSION_MAX_ALLOWED GLIB_VERSION_2_56
+
+#ifdef __G_LIB_H__
+#error "glib.h must be included via libpv/glib-helper.h"
+#endif
+
 #include <glib.h>
 #include <gmodule.h>
 #include <stdio.h>

include/libpv/se-hdr.h

@@ -13,7 +13,7 @@
 
 #include <openssl/sha.h>
 
-#include "boot/s390.h"
+#include "boot/psw.h"
 #include "libpv/crypto.h"
 #include "libpv/macros.h"
 

ip_watcher/Makefile

@@ -12,7 +12,7 @@ clean:
 install: ip_watcher.pl xcec-bridge start_hsnc.sh
 	$(SED) -e 's/%S390_TOOLS_VERSION%/$(S390_TOOLS_RELEASE)/' \
 	< start_hsnc.sh >$(DESTDIR)$(USRSBINDIR)/start_hsnc.sh; \
-	chown $(OWNER).$(GROUP) $(DESTDIR)$(USRSBINDIR)/start_hsnc.sh; \
+	chown $(OWNER):$(GROUP) $(DESTDIR)$(USRSBINDIR)/start_hsnc.sh; \
 	chmod 755 $(DESTDIR)$(USRSBINDIR)/start_hsnc.sh; \
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 ip_watcher.pl \
 		$(DESTDIR)$(USRSBINDIR)

ipl_tools/cmd_chreipl.c

@@ -23,12 +23,15 @@
 #define BOOTPARMS_CCW_MAX	64
 #define BOOTPARMS_FCP_MAX	3452
 
+#define OPT_BRCHR		0x80
+
 enum target_type {
 	TT_CCW,
 	TT_FCP,
 	TT_NSS,
 	TT_NODE,
 	TT_NVME,
+	TT_ECKD,
 };
 
 enum reipl_type {
@@ -36,12 +39,14 @@ enum reipl_type {
 	REIPL_CCW,
 	REIPL_NSS,
 	REIPL_NVME,
+	REIPL_ECKD,
 };
 
 static const char *const usage_chreipl =
 "Usage: %s [TARGET] [ARGS] [OPTIONS]\n"
 "\n"
 " chreipl [ccw] [-d] <DEVICE> [OPTIONS]\n"
+" chreipl [eckd] [-d] <DEVICE> [OPTIONS]\n"
 " chreipl [fcp] [-d] <DEVICE> [-w] <WWPN> [-l] <LUN> [OPTIONS]\n"
 " chreipl nvme  [-i] <FID> [-s] <NSID> [OPTIONS]\n"
 " chreipl [node] <NODE|DIR> [OPTIONS]\n"
@@ -50,6 +55,7 @@ static const char *const usage_chreipl =
 "\n"
 "The following re-IPL targets are supported:\n"
 "  ccw      IPL from CCW device\n"
+"  eckd     IPL from ECKD device\n"
 "  fcp      IPL from FCP device\n"
 "  nvme     IPL from NVME device\n"
 "  nss      IPL from NSS\n"
@@ -66,6 +72,13 @@ static const char *const usage_chreipl =
 "  -L, --loadparm <PARM>   Loadparm specification\n"
 "  -c, --clear 0|1         Control if memory is cleared on re-IPL\n"
 "\n"
+"Options for eckd target:\n"
+"  -d, --device <DEVICE>   Device number of the ECKD IPL device\n"
+"  -b, --bootprog <BPROG>  Bootprog specification\n"
+"      --brchr <C,H,R>     Boot record location in Cylinder,Head,Record format\n"
+"  -L, --loadparm <PARM>   Loadparm specification\n"
+"  -c, --clear 0|1         Control if memory is cleared on re-IPL\n"
+"\n"
 "Options for fcp target:\n"
 "  -d, --device <DEVICE>   Device number of the adapter of the FCP IPL device\n"
 "  -l  --lun <LUN>         Logical unit number of the FCP IPL device\n"
@@ -114,6 +127,8 @@ static struct locals {
 	int			target_type_auto_mode;
 	enum reipl_type		reipl_type;	/* CCW, FCP, NVME, NSS */
 	int			reipl_clear;
+	char			*brchr;
+	int			brchr_set;
 } l;
 
 static void __noreturn print_usage_chreipl_exit(void)
@@ -329,6 +344,19 @@ static void parse_ccw_args(char *nargv[], int nargc)
 	set_device(nargv[0]);
 }
 
+static void parse_eckd_args(char *nargv[], int nargc)
+{
+	/*
+	 * we might be called like this:
+	 * chreipl eckd 4711
+	 */
+	if (l.busid_set)
+		ERR_EXIT("Use either options or positional parameters");
+	if (nargc > 1)
+		ERR_EXIT("Too many arguments specified for \"eckd\" re-IPL type");
+	set_device(nargv[0]);
+}
+
 static void parse_nss_args(char *nargv[], int nargc)
 {
 	/*
@@ -369,6 +397,8 @@ static int set_reipl_type(const char *dev_name)
 		l.reipl_type = REIPL_FCP;
 	else if (strncmp(dev_name, "nvme", strlen("nvme")) == 0)
 		l.reipl_type = REIPL_NVME;
+	else if (strncmp(dev_name, "eckd", strlen("eckd")) == 0)
+		l.reipl_type = REIPL_ECKD;
 	else
 		return -1;
 
@@ -493,12 +523,15 @@ static void parse_pos_args(char *nargv[], int nargc)
 	case TT_NODE:
 		parse_node_args(nargv, nargc);
 		break;
+	case TT_ECKD:
+		parse_eckd_args(nargv, nargc);
+		break;
 	}
 }
 
 static void check_fcp_opts(void)
 {
-	if (l.nss_name_set)
+	if (l.nss_name_set || l.brchr_set)
 		ERR_EXIT("Invalid option for \"fcp\" target specified");
 	if (!(l.busid_set && l.wwpn_set && l.lun_set))
 		ERR_EXIT("The \"fcp\" target requires device, WWPN, "
@@ -507,7 +540,8 @@ static void check_fcp_opts(void)
 
 static void check_nvme_opts(void)
 {
-	if (l.nss_name_set || l.wwpn_set || l.lun_set || l.busid_set)
+	if (l.nss_name_set || l.wwpn_set || l.lun_set || l.busid_set ||
+	    l.brchr_set)
 		ERR_EXIT("Invalid option for \"nvme\" target specified");
 	if (!(l.fid_set && l.nsid_set))
 		ERR_EXIT("The \"nvme\" target requires FID, and optional NSID");
@@ -515,16 +549,25 @@ static void check_nvme_opts(void)
 
 static void check_ccw_opts(void)
 {
-	if (l.bootprog_set || l.lun_set || l.wwpn_set || l.nss_name_set)
+	if (l.bootprog_set || l.lun_set || l.wwpn_set || l.nss_name_set ||
+	    l.brchr_set)
 		ERR_EXIT("Invalid option for \"ccw\" target specified");
 	if (!l.busid_set)
 		ERR_EXIT("The \"ccw\" target requires device");
 }
 
+static void check_eckd_opts(void)
+{
+	if (l.nss_name_set || l.wwpn_set || l.lun_set || l.fid_set)
+		ERR_EXIT("Invalid option for \"eckd\" target specified");
+	if (!(l.busid_set))
+		ERR_EXIT("The \"eckd\" target requires device");
+}
+
 static void check_nss_opts(void)
 {
 	if (l.bootprog_set || l.loadparm_set || l.busid_set || l.wwpn_set ||
-	    l.lun_set)
+	    l.lun_set || l.brchr_set)
 		ERR_EXIT("Invalid option for \"nss\" target specified");
 	if (!l.nss_name_set)
 		ERR_EXIT("The \"nss\" target requires NSS name");
@@ -563,6 +606,12 @@ static void set_reipl_clear(const char *arg)
 		ERR_EXIT("re-IPL clear argument must be either 1 or 0");
 }
 
+static void set_brchr(const char *arg)
+{
+	l.brchr = strdup(arg);
+	l.brchr_set = 1;
+}
+
 static void parse_chreipl_options(int argc, char *argv[])
 {
 	int opt, idx;
@@ -580,6 +629,7 @@ static void parse_chreipl_options(int argc, char *argv[])
 		{ "force",	 no_argument,		NULL, 'f' },
 		{ "version",	 no_argument,		NULL, 'v' },
 		{ "clear",	 required_argument,	NULL, 'c' },
+		{ "brchr",       required_argument,	NULL, OPT_BRCHR },
 		{ NULL,		 0,			NULL,  0  }
 	};
 	static const char optstr[] = "hd:vw:l:fL:b:n:p:c:i:s:";
@@ -592,6 +642,8 @@ static void parse_chreipl_options(int argc, char *argv[])
 		set_target_type(TT_FCP, 0);
 	else if (strcmp(argv[1], "ccw") == 0)
 		set_target_type(TT_CCW, 0);
+	else if (strcmp(argv[1], "eckd") == 0)
+		set_target_type(TT_ECKD, 0);
 	else if (strcmp(argv[1], "nss") == 0)
 		set_target_type(TT_NSS, 0);
 	else if (strcmp(argv[1], "nvme") == 0)
@@ -640,6 +692,9 @@ static void parse_chreipl_options(int argc, char *argv[])
 		case 'c':
 			set_reipl_clear(optarg);
 			break;
+		case OPT_BRCHR:
+			set_brchr(optarg);
+			break;
 		case 'v':
 			print_version_exit();
 		default:
@@ -737,6 +792,34 @@ static void chreipl_ccw(void)
 	print_ccw(0);
 }
 
+static void chreipl_eckd(void)
+{
+	check_eckd_opts();
+
+	if (!ccw_is_device(l.busid) && !l.force_set) {
+		if (is_ignored(l.busid))
+			ERR_EXIT("Device is on cio_ignore list, try \"cio_ignore -r %s\"?",
+				 l.busid);
+		ERR_EXIT("Could not find DASD ECKD device \"%s\"", l.busid);
+	}
+
+	if (l.reipl_clear >= 0) {
+		check_exists("reipl/eckd/clear", "ECKD re-IPL clear attribute");
+		write_str(l.reipl_clear ? "1" : "0", "reipl/eckd/clear");
+	}
+
+	if (!l.brchr_set)
+		l.brchr = "auto";
+	write_str(l.brchr, "reipl/eckd/br_chr");
+	if (!l.bootprog_set)
+		sprintf(l.bootprog, "0");
+	write_str(l.bootprog, "reipl/eckd/bootprog");
+	write_str(l.busid, "reipl/eckd/device");
+	write_str_optional(l.loadparm, "reipl/eckd/loadparm", l.loadparm_set, "loadparm");
+	write_str("eckd", "reipl/reipl_type");
+	print_eckd(0, "eckd");
+}
+
 static void chreipl_fcp(void)
 {
 	check_fcp_opts();
@@ -850,6 +933,11 @@ static void chreipl_node(void)
 		l.busid_set = 1;
 		chreipl_ccw();
 		break;
+	case REIPL_ECKD:
+		ccw_busid_get(l.dev, l.busid);
+		l.busid_set = 1;
+		chreipl_eckd();
+		break;
 	case REIPL_FCP:
 		fcp_wwpn_get(l.dev, l.wwpn);
 		l.wwpn_set = 1;
@@ -878,6 +966,9 @@ void cmd_chreipl(int argc, char *argv[])
 	case TT_CCW:
 		chreipl_ccw();
 		break;
+	case TT_ECKD:
+		chreipl_eckd();
+		break;
 	case TT_FCP:
 		chreipl_fcp();
 		break;

ipl_tools/cmd_lsreipl.c

@@ -141,6 +141,30 @@ void print_ccw(int show_ipl)
 		print_fw_str("clear:       %s\n", dir, "clear");
 }
 
+void print_eckd(int show_ipl, const char *name)
+{
+	char *path_loadparm = show_ipl ? "/sys/firmware/ipl/loadparm" :
+		"/sys/firmware/reipl/eckd/loadparm";
+	char *dir = show_ipl ? "ipl" : "reipl/eckd";
+	char loadparm[9], loadparm_path[PATH_MAX];
+
+	printf("%-12s %s\n", get_ipl_banner(show_ipl), name);
+
+	print_fw_str("Device:      %s\n", dir, "device");
+	print_fw_str("bootprog:    %s\n", dir, "bootprog");
+	print_fw_str("br_chr:      %s\n", dir, "br_chr");
+	print_fw_str("Bootparm:    \"%s\"\n", dir, "scp_data");
+	if (access(path_loadparm, R_OK) == 0) {
+		sprintf(loadparm_path, "%s/%s", dir, "loadparm");
+		read_fw_str(loadparm, loadparm_path, sizeof(loadparm));
+		if (strcmp(loadparm, "        ") == 0)
+			loadparm[0] = 0;
+		printf("Loadparm:    \"%s\"\n", loadparm);
+	}
+	if (!show_ipl)
+		print_fw_str("clear:       %s\n", dir, "clear");
+}
+
 static void parse_lsreipl_options(int argc, char *argv[])
 {
 	int opt, idx;
@@ -193,6 +217,9 @@ void cmd_lsreipl(int argc, char *argv[])
 		print_nvme(l.ipl_set, 1);
 	else if (strcmp(reipl_type_str, "ccw") == 0)
 		print_ccw(l.ipl_set);
+	else if (strcmp(reipl_type_str, "eckd") == 0 ||
+		 strcmp(reipl_type_str, "eckd_dump") == 0)
+		print_eckd(l.ipl_set, reipl_type_str);
 	else if (strcmp(reipl_type_str, "nss") == 0)
 		print_nss(l.ipl_set);
 	else

ipl_tools/ipl_tools.h

@@ -45,6 +45,7 @@ extern void print_ccw(int show_ipl);
 extern void print_fcp(int show_ipl, int dump);
 extern void print_nvme(int show_ipl, int dump);
 extern void print_nss(int show_ipl);
+extern void print_eckd(int show_ipl, const char *name);
 
 /*
  * Helper

ipl_tools/man/chreipl.8

@@ -36,6 +36,9 @@ The first argument specifies the re-IPL target:
 .RB "- " ccw :
 Specify a DASD CCW device for reboot
 .TP
+.RB "- " eckd :
+Specify a DASD ECKD device for reboot
+.TP
 .RB "- " fcp :
 Specify a FCP device for reboot
 .TP
@@ -175,6 +178,63 @@ in the installed zIPL environment block for evaluation of zIPL environment
 variables in the kernel command line:
 
 \fB# chreipl ccw -d 0.0.7e78 -L 1S2\fP
+
+.SH eckd
+Use the eckd re-IPL target for DASD devices that are accessed by the hardware
+using channel command word (CCW) channels. In contrast to the ccw re-IPL target,
+the eckd target uses a list-directed bootloader that supports secure boot.
+.TP
+.BR "\-d" " or " "\-\-device"
+Specifies the device bus-ID of the DASD. If the bus-ID starts with "0.0." this
+prefix can be omitted and the four digit short notation can be used (e.g. 5000 is
+the same as 0.0.5000).
+
+.TP
+.BR "\-b" " or " "\-\-bootprog"
+Specifies an entry in the ECKD boot configuration by defining the IPL boot
+program selector. If omitted, '0' is used.
+
+.TP
+.BR "\-\-brchr"
+Specifies the block on the DASD where the boot record is located. If omitted,
+0 is used. The specification comprises comma-separated values for cylinder, head,
+and record: "--brchr C,H,R". Alternatively, specifying "0" or "auto" makes the
+bootloader determine the boot record location from the volume label.
+
+.TP
+.BR "\-L" " or " "\-\-loadparm"
+The loadparm for the eckd re-IPL target is not used to control the ECKD boot
+configuration that is defined by the
+.BR zipl (8)
+boot menu. Instead it can be used to control higher level boot loaders
+like GRUB. For more details refer to distribution specific documentation.
+
+.TP
+.BR "\-c" " or " "\-\-clear"
+Controls whether memory is cleared on re-IPL. Possible values are 0 to
+disable and 1 to enable memory clearing on re-IPL.
+Memory clearing is supported if the "clear" attribute is present in
+/sys/firmware/reipl/eckd/.
+
+.PP
+\fBExamples:\fP
+.br
+
+1. Next time reboot from the ECKD device with the bus-ID 0.0.7e78 and boot
+program selector 0:
+
+\fB# chreipl eckd 0.0.7e78\fP
+
+2. Next time reboot from the ECKD device with the bus-ID 0.0.7e78 and boot
+program selector 2:
+
+\fB# chreipl eckd -d 0.0.7e78 -b 2\fP
+
+3. Next time reboot from the ECKD device with the bus-ID 0.0.7e78 and tell
+the bootloader that the bootrecord is located in Cylinder 3, Head 0, Record 1:
+
+\fB# chreipl eckd -d 0.0.7e78 --brchr 3,0,1\fP
+
 .SH fcp
 Use the fcp re-IPL target for SCSI disks that are accessed by the hardware
 using Fibre Channel Protocol (FCP) channels.

iucvterm/Makefile

@@ -13,8 +13,7 @@ RECURSIVE_TARGETS = all-recursive install-recursive clean-recursive \
 
 
 all: all-recursive
-check: check-recursive
+install: install-recursive
-install: all install-recursive
 clean: clean-recursive
 
 

iucvterm/bin/chiucvallow.in

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 #
 # z/VM IUCV HVC device driver -- Edit z/VM user ID filter
 #

libap/ap.c

@@ -722,6 +722,34 @@ int ap_get_lock_callout(void)
 	return util_lockfile_parent_lock(AP_LOCKFILE, AP_LOCK_RETRIES);
 }
 
+/**
+ * Attempt to acquire the ap config lock using the Parent Process ID without
+ * waiting/retries.  Detect if the attempt was rejected because the lock is
+ * already held by the Parent Process ID.
+ *
+ * @retval         0          Lock acquired on behalf of parent process
+ * @retval         1          Lock not obtained, already held by parent
+ * @retval         != 0       Lock was not obtained, other error
+ */
+int ap_try_lock_callout(void)
+{
+	int pid, ppid, rc;
+
+	if (util_lockfile_parent_lock(AP_LOCKFILE, 0)) {
+		/* Lock is already held, let's peek at the owner */
+		ppid = getppid();
+		rc = util_lockfile_peek_owner(AP_LOCKFILE, &pid);
+		if (rc || pid != ppid) {
+			/* We didn't get the lock, unknown or other owner */
+			return 2;
+		}
+		/* Signify that the lock is already held by the caller */
+		return 1;
+	}
+
+	return 0;
+}
+
 /**
  * Release the ap config lock
  *

libekmfweb/Makefile

@@ -55,7 +55,7 @@ check-dep-libekmfweb: detect-openssl-version.dep
 		"detect-openssl-version.dep", \
 		"openssl-devel version >= 1.1.1", \
 		"HAVE_OPENSSL=0", \
-		-I. -lcrypto -DOPENSSL_SUPPRESS_DEPRECATED)
+		-I. `$(PKG_CONFIG) --cflags --libs libcrypto` -DOPENSSL_SUPPRESS_DEPRECATED)
 	$(call check_dep, \
 		"libekmfweb", \
 		"json-c/json.h", \
@@ -66,7 +66,7 @@ check-dep-libekmfweb: detect-openssl-version.dep
 		"curl/curl.h", \
 		"libcurl-devel", \
 		"HAVE_LIBCURL=0" \
-		`$(CURL_CONFIG) --cflags` `$(CURL_CONFIG) --libs`)
+		`$(PKG_CONFIG) --cflags --libs libcurl`)
 	$(CURL_CONFIG) --ssl-backends | grep OpenSSL >/dev/null 2>&1 || { echo "Error: libcurl is not built with the OpenSSL backend"; exit 1; }
 	touch check-dep-libekmfweb
 
@@ -85,8 +85,8 @@ ekmfweb.o: check-dep-libekmfweb ekmfweb.c utilities.h cca.h $(rootdir)include/ek
 utilities.o: check-dep-libekmfweb utilities.c utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
 cca.o: check-dep-libekmfweb cca.c cca.h utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
 
-libekmfweb.so.$(VERSION): ALL_CFLAGS += -fPIC `$(CURL_CONFIG) --cflags`
+libekmfweb.so.$(VERSION): ALL_CFLAGS += -fPIC `$(PKG_CONFIG) --cflags json-c libcurl libcrypto libssl`
-libekmfweb.so.$(VERSION): LDLIBS = -ljson-c -lcrypto -lssl `$(CURL_CONFIG) --libs` -ldl
+libekmfweb.so.$(VERSION): LDLIBS = `$(PKG_CONFIG) --libs json-c libcurl libcrypto libssl` -ldl
 libekmfweb.so.$(VERSION): ALL_LDFLAGS += -shared -Wl,--version-script=libekmfweb.map \
 	-Wl,-z,defs,-Bsymbolic -Wl,-soname,libekmfweb.so.$(VERM)
 libekmfweb.so.$(VERSION): ekmfweb.o utilities.o cca.o $(libs)
@@ -98,7 +98,7 @@ install-libekmfweb.so.$(VERSION): libekmfweb.so.$(VERSION)
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 -T libekmfweb.so.$(VERSION) $(DESTDIR)$(SOINSTALLDIR)/libekmfweb.so.$(VERSION)
 	ln -srf $(DESTDIR)$(SOINSTALLDIR)/libekmfweb.so.$(VERSION) $(DESTDIR)$(SOINSTALLDIR)/libekmfweb.so.$(VERM)
 	ln -srf $(DESTDIR)$(SOINSTALLDIR)/libekmfweb.so.$(VERSION) $(DESTDIR)$(SOINSTALLDIR)/libekmfweb.so
-	$(INSTALL) -d -m 770 $(DESTDIR)$(USRINCLUDEDIR)/ekmfweb
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRINCLUDEDIR)/ekmfweb
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 $(rootdir)include/ekmfweb/ekmfweb.h $(DESTDIR)$(USRINCLUDEDIR)/ekmfweb
 
 install: all $(INSTALL_TARGETS)

libkmipclient/Makefile

@@ -51,7 +51,6 @@ detect-openssl-version.dep:
 	mv $(TMPFILE) $@
 
 CURL_CONFIG ?= curl-config
-XML2_CONFIG ?= xml2-config
 
 check-dep-libkmipclient: detect-openssl-version.dep
 	$(call check_dep, \
@@ -59,7 +58,7 @@ check-dep-libkmipclient: detect-openssl-version.dep
 		"detect-openssl-version.dep", \
 		"openssl-devel version >= 1.1.1", \
 		"HAVE_OPENSSL=0", \
-		-I. -lcrypto -DOPENSSL_SUPPRESS_DEPRECATED)
+		-I. `$(PKG_CONFIG) --cflags --libs libcrypto` -DOPENSSL_SUPPRESS_DEPRECATED)
 	$(call check_dep, \
 		"libkmipclient", \
 		"json-c/json.h", \
@@ -70,13 +69,13 @@ check-dep-libkmipclient: detect-openssl-version.dep
 		"libxml/tree.h", \
 		"libxml2-devel", \
 		"HAVE_LIBXML2=0", \
-		`$(XML2_CONFIG) --cflags` `$(XML2_CONFIG) --libs`)
+		`$(PKG_CONFIG) --cflags --libs libxml-2.0`)
 	$(call check_dep, \
 		"libkmipclient", \
 		"curl/curl.h", \
 		"libcurl-devel", \
 		"HAVE_LIBCURL=0" \
-		`$(CURL_CONFIG) --cflags` `$(CURL_CONFIG) --libs`)
+		`$(PKG_CONFIG) --cflags --libs libcurl`)
 	$(CURL_CONFIG) --ssl-backends | grep OpenSSL >/dev/null 2>&1 || { echo "Error: libcurl is not built with the OpenSSL backend"; exit 1; }
 	touch check-dep-libkmipclient
 
@@ -107,8 +106,8 @@ tls.o: check-dep-libkmipclient tls.c kmip.h utils.h $(rootdir)include/kmipclient
 names.o: check-dep-libkmipclient names.c names.h utils.h $(rootdir)include/kmipclient/kmipclient.h
 utils.o: check-dep-libkmipclient utils.c names.h utils.h $(rootdir)include/kmipclient/kmipclient.h
 
-libkmipclient.so.$(VERSION): ALL_CFLAGS += -fPIC `$(XML2_CONFIG) --cflags` `$(CURL_CONFIG) --cflags`
+libkmipclient.so.$(VERSION): ALL_CFLAGS += -fPIC `$(PKG_CONFIG) --cflags json-c libcrypto libssl libxml-2.0 libcurl`
-libkmipclient.so.$(VERSION): LDLIBS = -ljson-c -lcrypto -lssl `$(XML2_CONFIG) --libs` `$(CURL_CONFIG) --libs`
+libkmipclient.so.$(VERSION): LDLIBS = `$(PKG_CONFIG) --libs json-c libcrypto libssl libxml-2.0 libcurl`
 libkmipclient.so.$(VERSION): ALL_LDFLAGS += -shared -Wl,--version-script=libkmipclient.map \
 	-Wl,-z,defs,-Bsymbolic -Wl,-soname,libkmipclient.so.$(VERM)
 libkmipclient.so.$(VERSION): kmip.o request.o response.o attribute.o key.o ttlv.o json.o \
@@ -121,7 +120,7 @@ install-libkmipclient.so.$(VERSION): libkmipclient.so.$(VERSION)
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 -T libkmipclient.so.$(VERSION) $(DESTDIR)$(SOINSTALLDIR)/libkmipclient.so.$(VERSION)
 	ln -srf $(DESTDIR)$(SOINSTALLDIR)/libkmipclient.so.$(VERSION) $(DESTDIR)$(SOINSTALLDIR)/libkmipclient.so.$(VERM)
 	ln -srf $(DESTDIR)$(SOINSTALLDIR)/libkmipclient.so.$(VERSION) $(DESTDIR)$(SOINSTALLDIR)/libkmipclient.so
-	$(INSTALL) -d -m 770 $(DESTDIR)$(USRINCLUDEDIR)/kmipclient
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRINCLUDEDIR)/kmipclient
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 644 $(rootdir)include/kmipclient/kmipclient.h $(DESTDIR)$(USRINCLUDEDIR)/kmipclient
 
 install: all $(INSTALL_TARGETS)

libpv/Makefile

@@ -5,21 +5,12 @@ include ../common.mak
 
 LIB := libpv.a
 
-ifneq ($(shell sh -c 'command -v pkg-config'),)
+GLIB2_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags glib-2.0)
-GLIB2_CFLAGS := $(shell pkg-config --silence-errors --cflags glib-2.0)
+GLIB2_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs glib-2.0)
-GLIB2_LIBS := $(shell pkg-config --silence-errors --libs glib-2.0)
+LIBCRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcrypto)
-LIBCRYPTO_CFLAGS := $(shell pkg-config --silence-errors --cflags libcrypto openssl)
+LIBCRYPTO_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcrypto)
-LIBCRYPTO_LIBS := $(shell pkg-config --silence-errors --libs libcrypto openssl)
+LIBCURL_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcurl)
-LIBCURL_CFLAGS := $(shell pkg-config --silence-errors --cflags libcurl)
+LIBCURL_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcurl)
-LIBCURL_LIBS := $(shell pkg-config --silence-errors --libs libcurl)
-else
-GLIB2_CFLAGS := -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include
-GLIB2_LIBS := -lglib-2.0
-LIBCRYPTO_CFLAGS :=
-LIBCRYPTO_LIBS := -lcrypto -lssl
-LIBCURL_CFLAGS := -I/usr/include/s390x-linux-gnu
-LIBCURL_LIBS := -lcurl
-endif
 LDLIBS += $(GLIB2_LIBS) $(LIBCRYPTO_LIBS) $(LIBCURL_LIBS)
 
 WARNINGS := -Wall -Wextra -Wshadow \
@@ -28,7 +19,6 @@ WARNINGS := -Wall -Wextra -Wshadow \
 	    -Wno-long-long -Wuninitialized -Wconversion -Wstrict-prototypes \
 	    -Wpointer-arith -Wno-error=inline \
 	    -Wno-unused-function -Wno-unused-parameter -Wno-unused-variable \
-	    -Werror \
 	    $(NULL)
 
 ALL_CFLAGS += -std=gnu11 \

libseckey/sk_provider.c

@@ -174,6 +174,20 @@ static OSSL_FUNC_keymgmt_settable_params_fn
 					sk_prov_keymgmt_rsa_pss_settable_params;
 static OSSL_FUNC_keymgmt_settable_params_fn
 					sk_prov_keymgmt_ec_settable_params;
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+static OSSL_FUNC_keymgmt_export_types_ex_fn
+					sk_prov_keymgmt_rsa_export_types_ex;
+static OSSL_FUNC_keymgmt_export_types_ex_fn
+					sk_prov_keymgmt_rsa_pss_export_types_ex;
+static OSSL_FUNC_keymgmt_export_types_ex_fn
+					sk_prov_keymgmt_ec_export_types_ex;
+static OSSL_FUNC_keymgmt_import_types_ex_fn
+					sk_prov_keymgmt_rsa_import_types_ex;
+static OSSL_FUNC_keymgmt_import_types_ex_fn
+					sk_prov_keymgmt_rsa_pss_import_types_ex;
+static OSSL_FUNC_keymgmt_import_types_ex_fn
+					sk_prov_keymgmt_ec_import_types_ex;
+#else
 static OSSL_FUNC_keymgmt_export_types_fn
 					sk_prov_keymgmt_rsa_export_types;
 static OSSL_FUNC_keymgmt_export_types_fn
@@ -185,6 +199,7 @@ static OSSL_FUNC_keymgmt_import_types_fn
 static OSSL_FUNC_keymgmt_import_types_fn
 					sk_prov_keymgmt_rsa_pss_import_types;
 static OSSL_FUNC_keymgmt_import_types_fn	sk_prov_keymgmt_ec_import_types;
+#endif
 
 static OSSL_FUNC_keyexch_newctx_fn		sk_prov_keyexch_ec_newctx;
 static OSSL_FUNC_keyexch_dupctx_fn		sk_prov_keyexch_ec_dupctx;
@@ -552,6 +567,33 @@ static const OSSL_PARAM *sk_prov_cached_params_build(
 	return provctx->cached_parms[index];
 }
 
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-function"
+static bool sk_prov_check_uint_param(const OSSL_PARAM params[],
+				     const char *param_name,
+				     const struct sk_prov_key *key,
+				     int key_type,
+				     unsigned int expected_value)
+{
+	const OSSL_PARAM *p;
+	unsigned int value;
+
+	if (key == NULL)
+		return true;
+	if (key->type != key_type)
+		return true;
+
+	p = OSSL_PARAM_locate_const(params, param_name);
+	if (p == NULL)
+		return true;
+
+	if (OSSL_PARAM_get_uint(p, &value) != 1)
+		return true;
+
+	return value == expected_value;
+}
+#pragma GCC diagnostic pop
+
 static struct sk_prov_op_ctx *sk_prov_op_newctx(struct sk_prov_ctx *provctx,
 						const char *propq,
 						int type)
@@ -850,6 +892,20 @@ static int sk_prov_asym_op_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 	for (p = params; p != NULL && p->key != NULL; p++)
 		sk_debug_op_ctx(ctx, "param: %s", p->key);
 
+#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
+	/* OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION is for RSA decrypt only */
+	if (!sk_prov_check_uint_param(params,
+				      OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
+				      ctx->key, EVP_PKEY_RSA, 0) ||
+	    !sk_prov_check_uint_param(params,
+				      OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
+				      ctx->key, EVP_PKEY_RSA_PSS, 0)) {
+		put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
+				 "Implicit rejection is not supported");
+		return 0;
+	}
+#endif
+
 	default_set_params_fn = (OSSL_FUNC_asym_cipher_set_ctx_params_fn *)
 			sk_prov_get_default_asym_func(ctx->provctx,
 				ctx->type,
@@ -1125,6 +1181,14 @@ static int sk_prov_asym_op_decrypt_init(void *vctx, void *vkey,
 	struct sk_prov_op_ctx *ctx = vctx;
 	struct sk_prov_key *key = vkey;
 	const OSSL_PARAM *p;
+#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
+	unsigned int implicit_rejection = 0;
+	OSSL_PARAM set_params[] = {
+		OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
+				&implicit_rejection),
+		OSSL_PARAM_END
+	};
+#endif
 
 	if (ctx == NULL || key == NULL)
 		return 0;
@@ -1133,6 +1197,20 @@ static int sk_prov_asym_op_decrypt_init(void *vctx, void *vkey,
 	for (p = params; p != NULL && p->key != NULL; p++)
 		sk_debug_op_ctx(ctx, "param: %s", p->key);
 
+#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
+	/* OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION is for RSA decrypt only */
+	if (!sk_prov_check_uint_param(params,
+				      OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
+				      key, EVP_PKEY_RSA, 0) ||
+	    !sk_prov_check_uint_param(params,
+				      OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
+				      key, EVP_PKEY_RSA_PSS, 0)) {
+		put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
+				 "Implicit rejection is not supported");
+		return 0;
+	}
+#endif
+
 	default_decrypt_init_fn = (OSSL_FUNC_asym_cipher_decrypt_init_fn *)
 				sk_prov_get_default_asym_func(ctx->provctx,
 					ctx->type,
@@ -1155,6 +1233,26 @@ static int sk_prov_asym_op_decrypt_init(void *vctx, void *vkey,
 		return 0;
 	}
 
+#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
+	if ((key->type == EVP_PKEY_RSA || key->type == EVP_PKEY_RSA_PSS) &&
+	    key->secure_key != NULL) {
+		/*
+		 * By default, implicit rejection is enabled for the default
+		 * provider. We currently do not support implicit rejection with
+		 * secure keys, so disable implicit rejection in the default
+		 * provider operation context to report its status correctly
+		 * with get-params.
+		 */
+		implicit_rejection = 0;
+		if (!sk_prov_asym_op_set_ctx_params(ctx, set_params)) {
+			sk_debug_op_ctx(ctx,
+					"ERROR: sk_prov_asym_op_set_ctx_params "
+					"failed");
+			return 0;
+		}
+	}
+#endif
+
 	return 1;
 }
 
@@ -1361,6 +1459,16 @@ static int sk_prov_sign_op_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 	for (p = params; p != NULL && p->key != NULL; p++)
 		sk_debug_op_ctx(ctx, "param: %s", p->key);
 
+#ifdef OSSL_SIGNATURE_PARAM_NONCE_TYPE
+	/* OSSL_SIGNATURE_PARAM_NONCE_TYPE is used for EC sign ops only */
+	if (!sk_prov_check_uint_param(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE,
+				      ctx->key, EVP_PKEY_EC, 0)) {
+		put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
+				 "Deterministic signature is not supported");
+		return 0;
+	}
+#endif
+
 	default_set_params_fn = (OSSL_FUNC_signature_set_ctx_params_fn *)
 			sk_prov_get_default_sign_func(ctx->provctx,
 				ctx->type, OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS);
@@ -1701,6 +1809,11 @@ static int sk_prov_sign_op_get_pss_saltlen(struct sk_prov_op_ctx *ctx,
 		salt_len = max_saltlen;
 	else if (strcmp(saltlen, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO) == 0)
 		salt_len = max_saltlen;
+#ifdef OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO_DIGEST_MAX
+	else if (strcmp(saltlen,
+			OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO_DIGEST_MAX) == 0)
+		salt_len = MIN(max_saltlen, EVP_MD_size(mgf_md));
+#endif
 	else
 		salt_len = atoi(saltlen);
 
@@ -1729,6 +1842,16 @@ static int sk_prov_sign_op_sign_init(void *vctx, void *vkey,
 	for (p = params; p != NULL && p->key != NULL; p++)
 		sk_debug_op_ctx(ctx, "param: %s", p->key);
 
+#ifdef OSSL_SIGNATURE_PARAM_NONCE_TYPE
+	/* OSSL_SIGNATURE_PARAM_NONCE_TYPE is used for EC sign ops only */
+	if (!sk_prov_check_uint_param(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE,
+				      key, EVP_PKEY_EC, 0)) {
+		put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
+				 "Deterministic signature is not supported");
+		return 0;
+	}
+#endif
+
 	default_sign_init_fn = (OSSL_FUNC_signature_sign_init_fn *)
 				sk_prov_get_default_sign_func(ctx->provctx,
 					ctx->type,
@@ -1955,6 +2078,16 @@ static int sk_prov_sign_op_digest_sign_init(struct sk_prov_op_ctx *ctx,
 	for (p = params; p != NULL && p->key != NULL; p++)
 		sk_debug_op_ctx(ctx, "param: %s", p->key);
 
+#ifdef OSSL_SIGNATURE_PARAM_NONCE_TYPE
+	/* OSSL_SIGNATURE_PARAM_NONCE_TYPE is used for EC sign ops only */
+	if (!sk_prov_check_uint_param(params, OSSL_SIGNATURE_PARAM_NONCE_TYPE,
+				      key, EVP_PKEY_EC, 0)) {
+		put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
+				 "Deterministic signature is not supported");
+		return 0;
+	}
+#endif
+
 	default_digest_sign_init_fn =
 			(OSSL_FUNC_signature_digest_sign_init_fn *)
 				sk_prov_get_default_sign_func(ctx->provctx,
@@ -2829,14 +2962,14 @@ static const OSSL_PARAM sk_prov_imexport_types[] = {
 	OSSL_PARAM_END
 };
 
-static const OSSL_PARAM *sk_prov_keymgmt_export_types(int selection,
+static const OSSL_PARAM *sk_prov_keymgmt_export_types(
-						      int pkey_type)
+						struct sk_prov_ctx *provctx,
+						int selection,
+						int pkey_type)
 {
 	OSSL_FUNC_keymgmt_export_types_fn *default_export_types_fn;
 	const OSSL_PARAM *default_parms = NULL, *params;
-	struct sk_prov_ctx *provctx;
 
-	provctx = OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
 	if (provctx == NULL)
 		return NULL;
 
@@ -2864,14 +2997,14 @@ static const OSSL_PARAM *sk_prov_keymgmt_export_types(int selection,
 					   sk_prov_imexport_types);
 }
 
-static const OSSL_PARAM *sk_prov_keymgmt_import_types(int selection,
+static const OSSL_PARAM *sk_prov_keymgmt_import_types(
-						      int pkey_type)
+						struct sk_prov_ctx *provctx,
+						int selection,
+						int pkey_type)
 {
 	OSSL_FUNC_keymgmt_import_types_fn *default_import_types_fn;
 	const OSSL_PARAM *default_parms = NULL, *params;
-	struct sk_prov_ctx *provctx;
 
-	provctx = OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
 	if (provctx == NULL)
 		return NULL;
 
@@ -3219,15 +3352,39 @@ static const OSSL_PARAM *sk_prov_keymgmt_rsa_settable_params(void *vprovctx)
 	return sk_prov_keymgmt_settable_params(provctx, EVP_PKEY_RSA);
 }
 
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+static const OSSL_PARAM *sk_prov_keymgmt_rsa_export_types_ex(void *vprovctx,
+							     int selection)
+{
+	struct sk_prov_ctx *provctx = vprovctx;
+
+	return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_RSA);
+}
+
+static const OSSL_PARAM *sk_prov_keymgmt_rsa_import_types_ex(void *vprovctx,
+							     int selection)
+{
+	struct sk_prov_ctx *provctx = vprovctx;
+
+	return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_RSA);
+}
+#else
 static const OSSL_PARAM *sk_prov_keymgmt_rsa_export_types(int selection)
 {
-	return sk_prov_keymgmt_export_types(selection, EVP_PKEY_RSA);
+	struct sk_prov_ctx *provctx =
+		OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
+
+	return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_RSA);
 }
 
 static const OSSL_PARAM *sk_prov_keymgmt_rsa_import_types(int selection)
 {
-	return sk_prov_keymgmt_import_types(selection, EVP_PKEY_RSA);
+	struct sk_prov_ctx *provctx =
+		OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
+
+	return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_RSA);
 }
+#endif
 
 static void *sk_prov_keymgmt_rsa_gen_init(void *vprovctx, int selection,
 					  const OSSL_PARAM params[])
@@ -3289,15 +3446,43 @@ static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_settable_params(void *vprovctx)
 	return sk_prov_keymgmt_settable_params(provctx, EVP_PKEY_RSA_PSS);
 }
 
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_export_types_ex(void *vprovctx,
+								 int selection)
+{
+	struct sk_prov_ctx *provctx = vprovctx;
+
+	return sk_prov_keymgmt_export_types(provctx, selection,
+					    EVP_PKEY_RSA_PSS);
+}
+
+static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_import_types_ex(void *vprovctx,
+								 int selection)
+{
+	struct sk_prov_ctx *provctx = vprovctx;
+
+	return sk_prov_keymgmt_import_types(provctx, selection,
+					    EVP_PKEY_RSA_PSS);
+}
+#else
 static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_export_types(int selection)
 {
-	return sk_prov_keymgmt_export_types(selection, EVP_PKEY_RSA_PSS);
+	struct sk_prov_ctx *provctx =
+		OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
+
+	return sk_prov_keymgmt_export_types(provctx, selection,
+					    EVP_PKEY_RSA_PSS);
 }
 
 static const OSSL_PARAM *sk_prov_keymgmt_rsa_pss_import_types(int selection)
 {
-	return sk_prov_keymgmt_import_types(selection, EVP_PKEY_RSA_PSS);
+	struct sk_prov_ctx *provctx =
+		OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
+
+	return sk_prov_keymgmt_import_types(provctx, selection,
+					    EVP_PKEY_RSA_PSS);
 }
+#endif
 
 static void *sk_prov_keymgmt_rsa_pss_gen_init(void *vprovctx, int selection,
 					      const OSSL_PARAM params[])
@@ -3372,15 +3557,39 @@ static const OSSL_PARAM *sk_prov_keymgmt_ec_settable_params(void *vprovctx)
 	return sk_prov_keymgmt_settable_params(provctx, EVP_PKEY_EC);
 }
 
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+static const OSSL_PARAM *sk_prov_keymgmt_ec_export_types_ex(void *vprovctx,
+							    int selection)
+{
+	struct sk_prov_ctx *provctx = vprovctx;
+
+	return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_EC);
+}
+
+static const OSSL_PARAM *sk_prov_keymgmt_ec_import_types_ex(void *vprovctx,
+							    int selection)
+{
+	struct sk_prov_ctx *provctx = vprovctx;
+
+	return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_EC);
+}
+#else
 static const OSSL_PARAM *sk_prov_keymgmt_ec_export_types(int selection)
 {
-	return sk_prov_keymgmt_export_types(selection, EVP_PKEY_EC);
+	struct sk_prov_ctx *provctx =
+		OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
+
+	return sk_prov_keymgmt_export_types(provctx, selection, EVP_PKEY_EC);
 }
 
 static const OSSL_PARAM *sk_prov_keymgmt_ec_import_types(int selection)
 {
-	return sk_prov_keymgmt_import_types(selection, EVP_PKEY_EC);
+	struct sk_prov_ctx *provctx =
+		OSSL_PROVIDER_get0_provider_ctx(sk_prov_securekey_provider);
+
+	return sk_prov_keymgmt_import_types(provctx, selection, EVP_PKEY_EC);
 }
+#endif
 
 static void *sk_prov_keymgmt_ec_gen_init(void *vprovctx, int selection,
 					 const OSSL_PARAM params[])
@@ -4530,11 +4739,21 @@ static const OSSL_DISPATCH sk_prov_rsa_keymgmt_functions[] = {
 
 	/* Import and export routines */
 	{ OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))sk_prov_keymgmt_export },
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+	{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX,
+			(void (*)(void))sk_prov_keymgmt_rsa_export_types_ex },
+#else
 	{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES,
 			(void (*)(void))sk_prov_keymgmt_rsa_export_types },
+#endif
 	{ OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))sk_prov_keymgmt_import },
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+	{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES_EX,
+			(void (*)(void))sk_prov_keymgmt_rsa_import_types_ex },
+#else
 	{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES,
 			(void (*)(void))sk_prov_keymgmt_rsa_import_types },
+#endif
 	/* No copy function, OpenSSL will use export/import to copy instead */
 
 	{ 0, NULL }
@@ -4579,11 +4798,21 @@ static const OSSL_DISPATCH sk_prov_rsapss_keymgmt_functions[] = {
 
 	/* Import and export routines */
 	{ OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))sk_prov_keymgmt_export },
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+	{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX,
+		(void (*)(void))sk_prov_keymgmt_rsa_pss_export_types_ex },
+#else
 	{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES,
 			(void (*)(void))sk_prov_keymgmt_rsa_pss_export_types },
+#endif
 	{ OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))sk_prov_keymgmt_import },
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+	{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES_EX,
+		(void (*)(void))sk_prov_keymgmt_rsa_pss_import_types_ex },
+#else
 	{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES,
 			(void (*)(void))sk_prov_keymgmt_rsa_pss_import_types },
+#endif
 	/* No copy function, OpenSSL will use export/import to copy instead */
 
 	{ 0, NULL }
@@ -4628,11 +4857,21 @@ static const OSSL_DISPATCH sk_prov_ec_keymgmt_functions[] = {
 
 	/* Import and export routines */
 	{ OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))sk_prov_keymgmt_export },
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+	{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX,
+			(void (*)(void))sk_prov_keymgmt_ec_export_types_ex },
+#else
 	{ OSSL_FUNC_KEYMGMT_EXPORT_TYPES,
 			(void (*)(void))sk_prov_keymgmt_ec_export_types },
+#endif
 	{ OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))sk_prov_keymgmt_import },
+#ifdef OSSL_FUNC_KEYMGMT_EXPORT_TYPES_EX
+	{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES_EX,
+			(void (*)(void))sk_prov_keymgmt_ec_import_types_ex },
+#else
 	{ OSSL_FUNC_KEYMGMT_IMPORT_TYPES,
 			(void (*)(void))sk_prov_keymgmt_ec_import_types },
+#endif
 	/* No copy function, OpenSSL will use export/import to copy instead */
 
 	{ 0, NULL }

libseckey/sk_utilities.c

@@ -776,6 +776,10 @@ int SK_UTIL_build_ecdsa_signature(const unsigned char *raw_sig,
 	bn_s = NULL;
 
 	der_len = i2d_ECDSA_SIG(ec_sig, NULL);
+	if (der_len <= 0) {
+		rc = -EIO;
+		goto out;
+	}
 
 	if (sig == NULL) {
 		*sig_len = der_len;
@@ -788,13 +792,14 @@ int SK_UTIL_build_ecdsa_signature(const unsigned char *raw_sig,
 
 	memset(sig, 0, *sig_len);
 	der = sig;
-	*sig_len = i2d_ECDSA_SIG(ec_sig, &der);
+	der_len = i2d_ECDSA_SIG(ec_sig, &der);
-
+	if (der_len <= 0) {
-	if (*sig_len == 0) {
 		rc = -EIO;
 		goto out;
 	}
 
+	*sig_len = der_len;
+
 out:
 	if (ec_sig != NULL)
 		ECDSA_SIG_free(ec_sig);