The optics monitoring tool opticsmon implements the user-space portion
of reporting optics data to the SE. Its basic functionality is to
collect optical module information equivalent to "ethtool --module-info"
for PCI Physical Functions and forwards this data to the SE using the
new SCLP Write Event Data Action Qualifier 3.
For the part of finding all PFs we need to look at all PCI
functions and determine which ones are PFs and what netdevs they
correspond to. This is a generally useful functionality so this part as
well as the SCLP issuing code go into a new libzpci library which also
includes a standalone example for listing PCI functions and their s390x
specific attributes. Medium term we plan to add this functionality to
lszdev.
For the opticsmon tool itself there are 2 basic operating modes:
* One-shot Mode: Without parameters opticsmon collects optical module
data and prints a summary of the netdevice in JSON format. With
--module-data it also includes a base64 encoded raw dump equivalent to
ethtool --module-info <netdev> raw on.
* Monitor Mode: With the --monitor flag opticsmon runs continuously
usually started via a systemd unit and collects new optical module
data on a time interval (default 24h) or when the operational state
("/sys/class/net/<netdev/operstate") changes. The tool listens for
changes via netlink so no polling on sysfs is necessary
Note: Both modes will *NOT* issues SCLPs without adding the
--send-report flag but will output a JSON summary for each data
collection so can be tested without firmware impact.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add zpci_is_vf() helper based on the /sys/bus/pci/devices/<dev>/vfn
attribute which is non-zero for VFs unlike the common code VF number
which starts at 0.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The upcoming optics monitoring tool will have to issue SCLP Write Event
data just like zpcictl so pull that functionality out and into libzpci.
While at it decouple getting SMART data from the actual SCLP handling.
No change in behavior intended.
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The SCLP report currently always uses the maximum length even if no
extra data is proved at all. Instead use the actual length of either
just the timestamp and err_log_id or additionally the length of sdata.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This introduces libzpci which is a library intended to handle s390x
specific PCI attributes and peculiarities. As a first step it introduces
code to list PCI devices on s390x including an initial set of s390x
specific attributes like FID, PFT, UID etc. It also collects information
on network device associated with a particular PCI function. The
included example serves as a demonstration of using libzpci to list PCI
devices.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Without including stdio.h before util_file.h tye FILE type will not be
known leading to a build failure. Fix this by including stdio.h.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The '--help-all' and '--help-experimental' flags are now considered
deprecated, but should still be available for backward compatibility.
Fixes: f4cf4ae6eb ("rust: Add a new tool called 'pvimg'")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Removes the C implementation of genprotimg and use the Rust
implementation instead.
Adapt the README.md accordingly.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support for enabling/disabling the backup keys and HMAC-PCKMO key
encryption function plaintext control flags in the Secure Execution
header.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add metadata about the image to the Secure Execution image. This helps
to identify where the Secure Execution header is located in the image
and therefore it's less prone to errors to locate the header.
This patch adds the support for it to 'pvimg' as well as to the
'pvsecret' and 'pvattest' tools.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new tool called 'pvimg' that can be used to create and inspect
Secure Execution images. It has several subcommands:
+ create: create an IBM Secure Execution image (genprotimg compatible
sytnax) and C-'genprotimg' is going to be replaced by a
symlink to this subcommand.
+ test: test various aspects of an existing Secure Execution image
+ info: print information about an existing Secure Execution
image (experimental API!)
+ version: print version and exit
As mentioned above, the 'genprotimg' tool is now a symbolic link to the
'pvimg create' subcommand and the CLI is backward compatible with the
original genprotimg CLI, with the following exceptions:
- '-v' increases the verbosity instead of showing the version
- '-V' is now deprecated in favor of '-v'
- an existing output file is no longer silently overwritten, but there
is a new flag '--overwrite' to get the original behavior
- experimental options are no longer described in the help
- the commands '--cert ...' and '--root-ca' are now mutually exclusive
- to '--no-verify'
- there is now a component check, e.g. it checks if the specified
Linux kernel looks like a raw binary s390x kernel. These checks can be
disabled by using the new command line flag '--no-component-check'
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Hardcode the location and size of the BSS section of stage3a to 0xc000
and 0x1000. This change is made in preparation for storing the Secure
Execution image metadata at the address of the BSS section of stage3a.
The idea behind this is that since there is no ELF loader involved, the
stage3a loader will memset it's BSS section and therefore the Secure
Execution image metadata to 0. This way, it's avoided having any
leftover metadata after running the stage3a loader.
In addition, add .bss.* as input sections for the .bss section.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change is done in preparation for the Rust port of genprotimg.
While at it, format the code using `clang-format`.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new Rust port of genprotimg will have the name 'pvimg' as it has
more functionalities than the original genprotimg tool. As preparation
add a Secure Execution header library and an example how to use it. The
example can be used by the KVM-Unit-Tests for creating the Secure
Execution headers needed by the tests [1].
[1] See dc4f7106f3
more information how to use.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A manpage auto-generation tool can use this trait to get the exit codes
and their documentation of a program.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Refactor `seek_se_hdr_start` so it can be reused. While at it, improve
the documentation of it and format the code.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Command used:
$ cargo +nightly clippy
...
warning: doc list item without indentation
--> pvapconfig/src/ap.rs:71:5
|
71 | /// This may take some time and even loop forever if there
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the ordering of the parameters in 'TryFrom<Confidential<Vec<u8> for
Confidential<[u8; N>'. While at it, convert 'LengthMismatch' error to a
named struct.
Fixes: 7608cf2de4 ("rust/confidential: Add `From` and `Into` for confidential byes arrays/vectors")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the following error:
$ make CROSS_COMPILE=s390x-linux-gnu- HOST_ARCH=s390x
../../../common.mak:117: *** Please specify CROSS_COMPILE=... and try it again!. Stop.
$ make --version
GNU Make 4.4.1
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add column 'UTIL DATA' that indicates the percentage of channel-path
data bandwidth currently in use. Since channel-paths are bidirectional,
this column represents the maximum of read or write bandwidth
utilization.
Also use this new column in place of 'UTIL BUS' for CMG 4 and 5 default
views since the bus utilization no longer provides a relevant value for
DPU-based channel-path types.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New machine models introduce CHPIDs with two new CMG types 4 and 5.
Add support for decoding the associated channel-measurement data.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer kernels provide the full, unfiltered Channel-Measurements
Characteristics Block (CMCB) via a new sysfs attribute named
"measurement_chars_full".
Add support for reading the full CMCB data if available in preparation
of new tool functions that will make use of this data.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The utilization visualization column does not provide meaningful data
when using structured output. Omit it when an output format has been
specified on the command line.
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a new command line flag ("--format") to specify the output
format in batch mode. Valid options are "pairs" for shell-compatible key
value pairs, "csv" for CSV, "json" for a formatted JSON document, and
"json-seq" for a stream of JSON text sequences as per RFC7464[1].
[1]: https://datatracker.ietf.org/doc/html/rfc7464
Note: Specifying the --format flag implies the --batch_mode flag.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The separator line is written as part of the input processing step and
is better be moved to the place where the table is actually written.
Same goes for the terminating '\n' which is performed as the final step
while updating the terminal in batch mode.
While at it, use the designated print functions over raw printf().
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For structured output (i.e. JSON), some type information of the columns
is required, at least the ability to distinguish values that are strings
and possibly need to be quoted. Unfortunately at the time column values
are formatted this information is lost.
The column types are specified implicitly during the unit conversion of
the raw value. For example, online time is stored as a u64 value but is
converted into a "d:h:m" string.
Introduce a private flag per column that signifies if that column is to
be formatted as a string. This flag will be set in the appropriate unit
conversion function.
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This type helps to perform atomic operations by writing to a temporary
file and renaming it to the actual filename when the
`AtomicFile::finish` function is called. If the `AtomicFile::finish`
function is never called, the temporary file is automatically removed
when it goes out of scope. It utilizes the `renameat2` [1] libc function
and its semantics.
[1] https://man7.org/linux/man-pages/man2/renameat.2.html
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename "Authenticated Encryption with Associated Data" (AEAD)
encryption/decryption functions and change the result type. This makes
the functions easier extendable. In addition, it's now possible to use
the functions as following:
`encrypt(decrypt(data)) == decrypt(encrypt(data) == data`
Add more AES and SHA related constants and use them whenever possible.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename `Aes256*` to `Aes256Gcm*` and add a deprecated constant with the
old name for backward compatibility. Adapt existing code to use the new
enum variant.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Combine linker scripts for single volume and multi-volume ECKD dumpers
to avoid duplicating. Use C preprocessor to define conditional symbols.
Cleanup the generic stage2 linker script(stage2.lds). Since it is still
used for FBA and TAPE dumpers (fba2dump and tape2dump) the .stage2dump.tail
section should be preserved.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Move MVDUMP_TOOL_SIZE contsant to loaders_layout.h and rename it
to STAGE2_DUMPER_SIZE_MV.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Write the secret metadata into the same directory as the generated
secret request. Before, the metadata was accidentally written into the
working directory.
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Check if the SE-guests machine firmware is in an IBM approved state.
The machine firmware version can be obtained via setting a flag in the
attestation request.
The opaque 320 byte value from firmware is forwarded to an IBM server
that verifies the firmware value and confirms if the machine is in an
IBM approved firmware state.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a check to verify the hash over the Secret Store in the guest UV
storage. During 'create' the user can request that hash via a flag. During
'check' the user specifies the Add Secret requests and check whether the store is
locked. If the calculated hash over this state matches the one reported
by attestation, this check is successful.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a new command: check. This allows users to perform policy checks on
the Attestation result.
The host-key hashes, and the user-data can be tested for certain values.
While at it fix some typos and enable CSV parsing for the Additional-data flags.
Example:
```
pvattest check attestresp checkresult -k hkd0.crt,hkd1.crt
--host-key-check AttKeyCheck
```
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add additional data for the Attestation request. The secret store hash
measures all added secrets and the state of the store (locked or not)
with a single hash. The hash is computed by concatenating all add-secret
request tags (16 bytes each) and a byte stating the locked state (1 for
locked, 0 for not locked). The firmware state is an opaque state
description of the systems firmware status to be interpreted by an IBM
service. Add request flags and fields in the additional data structure.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add an unrecognized field to the AdditionalData struct that contains any
data that is not known by the library. Generalize the intention of the
additional data read function and make extensions to Additional data
easier. Add tests for serialization.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename 'ATT_ADD_HASH_SIZE' to 'PHKH_SIZE'. The new name describes the
value better. It is the size of the Public Host-Key Hash and not the
size of a generic additional-data item.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the new `cargo clippy` and `cargo doc` findings that were triggered
with the recent policy addition.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
With the recent changes in the pkey kernel module to split it up into
sub-modules, as well as the addition to support Secure Execution
retrievable secrets, an update to the list of modules to copy to
initrd is required.
Besides the pkey module itself, all its sub-modules must be copied.
Furthermore, sub-module pkey_uv requires the uvdevice modules, so copy
this, too.
While at it, remove the old drivers zcrypt_cex2a and zcrypt_pcixcc,
those are not provided anymore since at least 2 years.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Sync all install targets implementations. Some did quote the target
directories some don't. Remove all quotations. This fixes wrong install
locations of install paths that have a '~'. With quotes '~' is
interpreted literally instead of using the home dir.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Enables API users to get the request tag of an Add-Secret request.
This enables them to check for attestation policies.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Allows API users to inspect the value of additional data to use it as
part of a policy check.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This struct is not exported. Prevent any accidental exports by reducing
the visibility to pub(crate).
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename the previous "default" `new` constructor [1] to `with_prefix` and
add a new default `new` constructor that takes no argument is therefore
easier to use.
In addition, improve the overall documentation, add more tests, and
examples to the code.
[1] https://doc.rust-lang.org/nomicon/constructors.html
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use the `enum_dispatch` macro for providing the `From` and `TryInto`
functionalities. In addition, it makes dynamic dispatching using enums
much easier.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Implement `From<SymKeyType> for Nid`. This makes it easier to implement
generalized functions.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This is currently the only key type supported, therefore rename the
function to make this clear. In addition, improve the documentation of
the function as function is now exported.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The library is used by multiple PV related tools, not only for managing
the guest secret store.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Make EcPubKeyCoord available, after renaming it from EcdhPubkeyCoord.
This enables API users to calculate the hash of a public host-key and
compare it to a hash from attestation.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Create one implementation for the verbose option to be used by all
tools. While at it, add a quiet option to decrease the verbosity.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Newer s390 kernels provide the new sysfs /sys/firmware/dump/dump_area_size
attribute which specifies the exact size of machine's dump area size.
Use this value if it is present but fall back to the previous and
slightly improved way of computation of dump area size to support
also older s390 kernels w/o the new sysfs attribute. This has
the advantage that util_arch_hsa_maxsize() has no longer to be adapted
with every introduction of yet another machine type in the future.
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The linear search in the nested loop over SCSI devices and over the indexed
array is still time consuming. So replace the indexed array with an
associative array. Build the array once outside of the nested loop by using
pathname expansion and extracting key and value from each item. Within
the SCSI device loop, an array entry is removed by means of the key without
linear search.
This commit is separate from the previous one so it is possible to revert
this one in case associative arrays would not be available and still get
the speed improvement from the indexed array in the previous commit.
Before:
$ time ~/git/s390-tools/zconf/lszfcp -De | wc -l
1036
real 0m17.605s
user 0m17.159s
sys 0m0.308s
After:
$ time ~/git/s390-tools/zconf/lszfcp -De | wc -l
1036
real 0m0.207s
user 0m0.175s
sys 0m0.032s
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Apparently the repeated string concatenation and word splitting was
much slower.
While at it, also remember in $ZFCP_UNIT_PATH whether the loop over
ZFCP_UNIT_ARRAY already found a zfcp_unit and re-use the path string to
replace the previous file glob construct generating the zfcp_unit path by
means of pathname expansion. This only works for the extended output case.
Before:
$ time lszfcp -De | wc -l
1036
real 2m15.387s
user 2m9.323s
sys 0m5.130s
After:
$ time ~/git/s390-tools/zconf/lszfcp -De | wc -l
1036
real 0m17.605s
user 0m17.159s
sys 0m0.308s
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Just go ahead and read the sysfs attribute directly as the syscalls are
needed anyway.
If necessary stderr could be redirected to /dev/null in the future,
but there was no case so far where the attribute did not exist.
This does not make a runtime difference when running on sysfs. Change it
anyway to avoid somebody searching for speed improvement options stumbling
over it again.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
It's not on the hot path as the glob match is done only once.
But there is no point in matching anything but SCSI devices
such as "fc_transport" and "subsystem"
just to have an additional child process filter it once more.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
A simple built-in parameter expansion removing the matching prefix
pattern (everything up to and including the last slash) is sufficient to
strip the path from the basename.
Speeds up "lszfcp -D" significantly.
Before:
$ time ~/git/s390-tools/zconf/lszfcp -D | wc -l
1028
real 0m5.322s
user 0m0.300s
sys 0m4.907s
After:
$ time ~/git/s390-tools/zconf/lszfcp -D | wc -l
1028
real 0m0.602s
user 0m0.100s
sys 0m0.492s
Above measurements are from the fast in-memory sysfs. The improvements are
likely amplified when running "lszfcp --sysfs ..." on collected debug data
in a regular file system.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
An online CCW device, which is available and not defunct and not failed,
can have an undesired fc_host port_state, which is not Online and does not
have the special case Linkdown. Indicate such unexpected state.
Complements
v2.9.0 commit 4036e80b26 ("lszfcp: add new output marker for non-good FCP
devices (hosts)")
v2.9.0 commit be7b854969 ("lszfcp: also mark FCP devices (hosts) that are
not available")
v2.18.0 commit 45e3f016f4 ("lszfcp: add linkdown case to host marker of
extended output")
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Switch from atoi() to existing parse_int() helper function for parsing
the integer --cmg argument to better handle invalid values such as
numbers followed by an unsupported suffix (e.g. 1x).
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
At the moment the memory range of processed vmdump always corresponds to
the highest defined byte (q v storage) obtained from Address Space
Information Block ignoring memory ranges specified in CP vmdump command.
This might lead to the invalid dump size calculation upon conversion to
s390 format.
Use Requested Range Table from ASIZBK to identify actual memory ranges
being dumped. Consider the end of the highest memory range as a vmdump
upper limit (dump memory size). In case no range table entries present
fall back to the original method using 'storage_size_def_store' value.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This patch adds support for zipl targets over partitions of md-devices.
With this patch it is possible to specify a zipl target over any
partition of an md-device, so that all the physical disks participating
in the mirrored setup will be prepared for IPL.
Unlike a whole md-device which has major number 9, its partitions
have major numbers 259 and the driver name is identified as 'blkext'
in '/proc/devices'. Handle this case in set_driver_name(): call ioctl()
to make sure that device is an md-partition.
Drop re-definition of some macros.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add "zhypinfo" as an overview on Hypervisor structure in runtime.out
Get an overview of all block devices in front of the detailed outputs
using "lsblk" into runtime.out
Starting OpenSSL3.0 "openssl engine" is deprecated and needs replacement by:
"openssl list --providers" (keep "engine" for older versions)
Suggested-by: Christian Rund <Christian.Rund@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Define and set the minimal supported Rust version (MSRV) to 1.75.0. This
is the (current) minimal supported version over all supported distros
that use rust in s390-tools.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
String is more or less a Vec<u8> with some extra invariants (i.e. only
UFF-8 chars). Zeroroize is implemented by calling the Vec<u8>
implementation. The zero byte is a valid UTF-8 symbol. The String
invariant is uphold by the clearing code.
Also, implement a into_inner function for clone-able inner types.
This allows converting confidential types into no-confidential types.
As Drop is implemented this requires a clone (see E0509).
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Generalize the `Confidential` impl over Vec<T> and [COUNT; T] instead of
specializing T to u8.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Migrate Confidential to pv_core crate. This has no impact on the public
API of pv as the migrated symbols are reexported.
This enables pv_core to manage confidential data as well.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The size of an EC-secp521r1 signature can be up to 139 bytes (if ASN1
encoded). There is no lower bound, although sizes lower than 137 are
very unlikely but possible.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The new cpacfinfo command provides information about CPACF, such as which CPACF functions are installed, and make use of the new MSA 13 Query Authentication Information function.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add extra trace logs for vmdump processing.
Log number of Index Pages, Bit-Key Pages and actual stored pages in the
vmdump.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new format option to HexSlice to print every byte with a separated
space in between. Additionally the old format option 'alternate'
together with the new one results in another new format which prints
every byte separated by a space AND every byte has a leading '0x'.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Co-developed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
It's uncommon and prone to error to silently stop decoding/parsing a
hex-string if there is an invalid character. Therefore, add a new
function `decode_hex` which fixes this behavior and use it in the code.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make it possible to convert internal key format to OpenSSL public key
format and vice versa. E.g. this can be useful when reading UV data
structures.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This makes it possible to reuse the constant. In addition, change the
type from i32 to usize since the value describes a size.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The size of an AES key depends on the mode of operation, so add this
information at least in the comments, as the API cannot be changed as it
is already published.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use Self instead of the struct name whenever possible.
Automagically replace struct name with Self:
`cargo clippy --fix -- -W clippy::use_self`
This streamlines the code.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a queue is removed from a SE guest which was in a state other
than "usable" (for example "unbound") the state displayed by lszcrypt
switches to "usable" until the queue device is finally removed by the
AP bus scan running every 30s.
This intermediate state is caused by reading 0x00000000 on the
underlying /sys/devices/cardxx/xx.yyyy/ap_functions. lszcrypt only
extracts the BS bits from this value and maps these both bits to
string output
0: "usable"
1: "bound"
2: "unbound"
3: "illicit"
totally ignoring the fact that there is no AP function at all.
Now the code checks for a valid ap_functions value first, before
actually extracting and displaying the SE state. In case the
ap_functions reads as 0x00000000 lszcrypt now displays the string
"invalid".
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
According to vmdump format, each bit of the Index page represents a Bit-Key
page and indicates if that Bit-Key page exists.
Due to the bug in vmdump64big_init() only 4096 bits of the Index Page were
processed instead of 32768. Thus for vmdumps of guests with defined storage
above 64G we could have invalid memory_start_record calculated. This ruins
the VMDUMP mem chunk read callback function.
One of the problem symptoms reported was missing UTS data in
'zgetdump -i' output caused by inability to locate OS_INFO in the dump.
Fixes: 067dd5c7ef ("zdump: Add vmdump dfi for vmdump format to elf format")
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer rust std libary code checks if a fd is already closes and panics.
Test code created a file with fd=17 and relied that test code never
touched the file. This cannot be done anymore. Just use the working dir
as backing file.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`sizeof` was added into the prelude in rustc 1.80.
This triggers a lint-warning for `unused_qualifications` if rustc 1.80+
is used. Fix this warning by using a use statement to stay compatible
for <1.80.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The RCs 30, 31, 32 may be caused by a malicious host or host bug.
Make this clear and advise to stop the SE-guest.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When checking CDL formatted DASD for installed dump-tool (zgetdump -d),
we might stumble upon an 'empty' boot record pointer in the volume label
filled with bytes of 0x40 (EBCDIC spaces). This leads to the following
seek error reported:
# zgetdump -d /dev/dasdb
zgetdump: Could not seek "/dev/dasdb" (Invalid argument)
Check for empty boot record and return proper error code by
ngdump_get_eckd_part_num() in order to end up with a regular
"No dump tool found" message.
Fixes: f3bcd94524 ("zdump: Add zgetdump -d support for ECKD ldipl-dump")
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes a segfault when the option '--dry-run' is specified for
device-based dumps (for which the bootmap file is created on a RAW
device, not formatted with a file system).
The actual status is that the option '--dry-run' for device-based
dumps is not implemented. The implementation is evaluated as not
trivial: In contrast with filesystem-based dumps, it is not possible
to simply make do with rename/unlink of temporary created bootmap.
The fixup returns error on any not file system based dumps being
created with the option '--dry-run'.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Drop a pair of duplicated assignmets
Replace the parameter 'struct job_data' with 'struct job_dump_data'
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move all checks from check_dump_device_late() to disk_is_approproate()
and drop check_dump_device_late() entirely
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the function check_dump_device_late() drop the case of
(info->device != target_info->device) which never happens. Indeed,
the @info created in check_dump_device_late() coincides with the
@target_info previously created by
prepare_build_program_table_{file, device}.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since the following kernel commit:
"32db401965f1 s390/mm: Pin identity mapping base to zero"
we can have zero identity_base value in os_info. This makes zgetdump
check for non-VR kernel in vm_info_get() incorrect what leads to missing
data (e.g. UTS kernel version) in 'zgetdump -i' output.
Check for zero kaslr_offset value instead (like crash and makedumpfile
do) in order to identify non-VR kernel.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since memory chunks can overlap for vr-kernel dumps stored in elf
format (ngdump, zfcpdump), we need to consider this when converting to
s390 dump output format. For that sort DFI memory chunks by start
address and adjust dfo_s390 logic for identifying memory gaps.
Otherwise we might end up with bogus DFO memory chunks being created.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On vertical polarization, kernel can be adjusting CPU capacities
dynamically, and cpuplugd can interfere this with hotplug operations
causing performance degradation. To prevent this, check if system has
switched its polarization state, and act accordingly.
If system is on vertical polarization when daemon starts, no CPU hotplug
action is triggered. If system changes to vertical polarization during
daemon runtime, revert cpuhotplug adjustments and stop further CPU
hotplug actions. If system switches back to horizontal polarization
during runtime of the daemon, start evaluating CPU hotplug rules and
trigger adjustments.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Simplify the cpu management parts of cpuplugd code by introducing
functions from libutil and rework some logic to drop some assumptions
about how kernel assigns cpuids.
Right now cpuplugd assumes that the cpuids are always sequential and
there are no gaps in between, however kernel does not guarantee that.
Make cpuplugd compliant by traversing cpu sysfs entries instead.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes c0f02d2f6 which results in problems when preparing qcow2
images for IPL:
zipl -V --blsdir /tmp/tmp.kdPooQjoBh/boot//loader/entries/ --config /
Program terminated with signal SIGFPE, Arithmetic exception.
Don't use pointer to not initialized struct disk_info after failed
auto-detection of disk parameters. Make the check that the file
locates on the disk in the form of a separate procedure.
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Tested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When detecting disk type, the function disk_get_info() is called.
It can fail for various reasons (e.g. when the logial target is not
eligible for boot record installation).
Once disk_get_info() fails, don't proceed with type detection.
Return error instead. When applicable, mark the dump job with
"is_ngdump" flag to avoid extra type detection calls.
Acked-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes d6b702d57 which introduces a problem: SCSI dump
installation fails:
zipl -V -d /dev/mapper/mpathd1
Error: Invalid dump device: Could not read partition table
The reasons:
1) Wrong (logical) device is passed as a target base;
2) In case of 'source_script' the check to make sure that specified
target is over a partition isn't applicable any more after zipl
support of complex logical targets (e.g. mirrors).
The fixup passes the physical device as a target base (instead of
the logical one). Also the fixup removes invalid check from
check_dump_device_late() and instead adds a more generic check to
the helper script that data starts beyong the boot area.
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This option is experimental, but can still be useful.
While at it, sort the options alphabetically.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes 670bf3e8 which actually isn't an equivalent refactoring.
The generic dm-device resolution procedure was modified to not resolve
the topmost dm-device in the path. So that any calles who don't expect
it, should complete the resolutioin process by themselves. In case of
chreipl_helper such completion was missed. chreipl(8) utility doesn't
expect dm-devices at the output of chreipl_helper.device-mapper
Example:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 20G 0 disk
|-sda1 8:1 0 20G 0 part
`-mpathb 253:0 0 20G 0 mpath
`-mpathb1 253:2 0 20G 0 part /
sdb 8:16 0 20G 0 disk
|-sdb1 8:17 0 20G 0 part
`-mpathb 253:0 0 20G 0 mpath
`-mpathb1 253:2 0 20G 0 part /
Expected result:
8:16
Actual result:
253:0
As a result, the chreipl(8) "node" option stopped working.
The fixup adds the completion.
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The .note.package [1] section is not used by the zipl/genprotimg bootloaders,
therefore discard them via linker script.
This fix solves the error:
/usr/bin/ld: Heap section doesn't conform to the described memory layout
collect2: error: ld returned 1 exit status
make[4]: *** [Makefile:77: stage3a.elf] Error 1
make[4]: Leaving directory '/<>/genprotimg/boot'
make[3]: *** [Makefile:20: all-recursive] Error 1
make[3]: Leaving directory '/<>/genprotimg'
make[2]: *** [Makefile:56: genprotimg] Error 2
[1] https://systemd.io/ELF_PACKAGE_METADATA/
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/174
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/176
[seiden@linux.ibm.com: Add/edit fixes tags]
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce target operations (struct target_ops);
For each supported device-mapper target implement
. check_target_status()
. get_target_data()
Add support for new 'raid' device-mapper target, which is now default
in LVM.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a script to process mirrored zipl targets managed by Linux "md"
driver (AKA "software mirrors")
. In the file zipl_helper.device-mapper.c implement two handlers
identified by pairs (ZIPL_UTIL_ID, MD_DRIVER_ID) and
(CHREIPL_UTIL_ID, MD_DRIVER_ID) for the helpers zipl_helper.md
and chreipl_helper.md respectively
. zipl_helper.md: prints sets of target parameters (one such set
per mirror) for a specified logical zipl target managed by linux
"md" driver.
. chreipl_helper.md: for a specified logical zipl target managed
by linux "md" driver prints a random disk from the set of disks
participating in the mirrored setup.
. Add zipl_helper.md and chreipl_helper.md as symbolic links to
zipl_helper.device-mapper
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For "mirror" device-mapper targets:
. Check status of all the mirrors;
. Return error if some mirror contain failures;
. Align the sample output properly
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For "mirror" device-mapper targets:
. Don't assign a logical mirrored device as a zipl target base.
Instead, add one more branch in complete_physical_device() and
proceed (in that new branch) to the physical disk participating
in the mirrored target. This approach allowes to handle
heterogeneous mirrors properly;
. Provide a set of target parameters for each found physical disk
by calling dm_dev_to_zipl_params() recursively;
. Don't allow "nested mirrors" by checking/updating the
fail_on_mirror global;
. Remove the requirements on including block #0 to the mirrored
device-mapper setup (no more actual);
. Update comments.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This is used by the next patches in the series to support mirror
setups not including boot sectors (e.g. mirrors over partitions).
. Rework the core procedure of device resolution (by walking along
the device-mapper tree during logical device resolution) to be an
explicit sequence of pairs (level-lookup, goto-parent-level);
. Add an "extended" device to keep a track of file system offset
while ascending the device tree;
. Identify all possible results of a single level lookup;
. Rename target_entry to dmpath_entry;
. Make the main() function to look like a call of a handler
identified by a pair (driver-id, util-id) and found by the name
of the executable.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix mistake in @fs_offset calculation.
Since any logical dm-device can be built of partitions, @fs_offset
must not decrease while ascending the "device tree" during the
procedure of dm-device resolution (which always starts at the
formatted logical device, for which @fs_offset is 0).
This bug was not reproducible earlier because of restricted
functionality in a combination with side-effects. The fixup is
required however by the next patches in the series implementing
support of mirrored targets by zipl tool
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
. Modify disk_get_info() to process multiple sets of target parameters
provided by the helper script and store it in the array of "targets"
of the structure job_target_data;
. Besides the logical device, maintain an array of physical base disks
in the disk_info structure;
. Use the logical target device only to create bootmap (it is
automatically mirrored by the respective linux driver (dm, or md)
managing the mirrored target). In contrast, install bootstrap blocks
to each physical base disk individually, bypassing that driver;
. Report in verbose mode on which base disks the bootstrap
installation was performed;
. Use the following logic of setting @info->device (which is printed
as "Device...:" in verbose mode):
. source_auto - the target base disk is set;
. source_script - the target (logical) device is set;
. source_user - the device specified by user (via --targetbase
option), or config file is set.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add new command-line option --ipldev. When specified and IPL was done
from a supported device type, the IPL device is selected for the
requested tool operation.
Example to list IPL device information:
$ lszdev --ipldev
Example to create a persistent configuration for the IPL device:
$ chzdev --enable --persistent --ipldev
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reduce code complexity by adding a utility function for reading text
files based on a variable path.
Note: chzdev/lszdev tools apply special path-handling via command line
option --base to allow redirecting hard-coded paths therefore libutil's
util_file functions cannot easily be used.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Steps to reproduce: Prepare some disk for IPL, specifying its
parameters via zipl "target options", and an image IMAGE_NAME
located on another disk. Don't specify "-a" option.
Actual result: Installation succeeded (resulting in unbootable setup)
Expected result: "Error: Could not add image file 'IMAGE_NAME': File
is not on target device"
The problem is in incorrect evaluation of device number (dev_t)
of the base disk where the image is located by the function
add_component_file_range() in case when target parameters are
specified by user.
Fixup: Retrieve info of the underlying disk without any user hints,
passing zeroed structure job_target_data
This is an improved version of fb0b6263d that was reverted by
63ff07ba3 afterwards. The shortcoming of the original ( fb0b6263d )
fix: it fails to prepare for IPL mounted qcow2 images.
The difference from the original fix: when making sure that boot
files are located on the target disk: in case of failed auto-detection
of disk parameters skip the check with warnings instead of aborting
the whole installation session.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
MSA 10 and MSA 11 introduce new function codes containing Full XTS
functions for KM instruction and HMAC functions for KMAC instruction.
Additional Full XTS and HMAC for PCKMO instruction is introduced.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Perl logs warning message if a variable is not initialized.
get_device_data() set mp_dev with multipath device for a scsi disk device.
mp_dev remain uninitialized if there is no multipath device.
This can happen if a scsi device is not managed by dm multipath driver.
Warning message:
"Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 136"
Fix it by skipping the code dealing with mp_dev and continue with next
scsi device in the loop.
To reproduce, remove a scsi device from dm multipath.
$multipathd -k'del path sdh'
Then run `ziorep_config -D`.
Signed-off-by: Nihar Panda <niharp@linux.ibm.com>
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
We changed lscss for more detailed output.
Adding use of dasdview for a detailed view on DASD storage.
This data will be collected in a separate file, as many DASDs might flood
the runtime.out
Also updated man pages as a new step is added
Reviewed-by: Stefan Hberland <sth@linux.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ap.rs code is already prepared for possible support
for CCA mode APQNs for the Secure Execution environment.
However, this patch marks these fields and structs with
pragma allow(dead_code) to prevent warnings during cargo
build of pvapconfig.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new action type 'capabilities' for the 'get' event. This
will return a JSON list of events and actions that the callout
script recognizes and actually does something with. It omits
events like 'notify' and actions like 'list' that ap-check
currently ignores.
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
mdevctl introduces a new event type 'live' with action 'modify',
indicating that the specified configuration changes should be
made dynamically if possible. Use this as a trigger to perform
dynamic configuration changes to the specified vfio-ap device
if it is active.
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While unlikely, it is possible for a vfio-ap configuration JSON
to include the 'ap_config' attribute. In this case, process it
by overwriting the current list of adapters, domains and control
domains for the associated vfio-ap device struct.
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For a given vfio-ap mdev, determine whether or not the device will
need dynamic config operations. This boils down to whether or not
the device is currently active + whether or not the kernel is
detected to support dynamic config operations (via the
'ap_config' sysfs attribute).
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The qeth-udev-rule execution logs a warning as below in the journalfs.
Failed to write ATTR{/sys/bus/ccwgroup/drivers/qeth/group}, \
ignoring: Invalid argument
This occurs because the udev rule for qeth devices is triggered by
multiple ccw devices and can be invoked in parallel. This can lead to a
situation where each of the three parallel-running udev rules tries to
group the devices simultaneously. As a result, only the first rule
succeeds, while the others fail with an -EINVAL error because the CCW
devices have already been grouped.
To prevent this, schedule a new change uevent for the base device, which
will verify the sysfs before attempting the grouping. The change event is
triggered by all three devices, ensuring that the actual write to the
attribute occurs only once and only when the sysfs attribute is ready.
Hence the add events on different devices are serialized to change event
on the base device, which then prevent duplicate concurrent grouping
attempts.
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function copy_table_entry_write() maps/unmaps /proc/vmcore for each
64kB of the file in order to write its content to a dump partition.
This requires a page allocation of order 2 in kernel (crst_table_alloc)
each time a mmap() syscall is performed and which cannot always be
fulfilled due to external memory fragmentation. And this in turn
results in a OOM kernel panic while writing /proc/vmcore content to
a dump partition. To make zfcpdump more robust in the face of such
problems with page allocations of order > 0, we use a simple file
read/write loop to transfer the content of /proc/vmcore to a dump
partition. This solution is less efficient (by not much) than the old
one with mmap() because it requires additional user space copy but
we trade off here efficiency for robustness which is more important
for zfcpdump.
We use a statically allocated buffer to read data into from /proc/vmcore
and write to a dump partition to avoid repeated use of the memory
mapping kernel path which would be required for a buffer allocated
dynamically at each entry of copy_table_entry_write().
Another possible and very convenient solution would be to use sendfile()
which would avoid any user space copies but, unfortunately, sendfile()
doesn't work with large /proc files.
Example of failed mmap() call for /proc/vmcore
==============================================
[ 26.568654] init invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=2, oom_score_adj=0
[ 26.568665] CPU: 0 PID: 1 Comm: init Not tainted 6.9.0-20240504.rc6.git0.9986ea583f39.300.fc39.s390x+zfcpdump #1
[ 26.568668] Hardware name: IBM 3931 A01 704 (LPAR)
[ 26.568669] Call Trace:
[ 26.568671] [<000003ffe03277c6>] dump_stack_lvl+0x76/0x98
[ 26.568676] [<000003ffe00f15c8>] dump_header+0x58/0x2d0
[ 26.568680] [<000003ffe00f219a>] out_of_memory+0x252/0x348
[ 26.568683] [<000003ffe0132f3e>] __alloc_pages_slowpath.constprop.0+0x65e/0x7c0
[ 26.568686] [<000003ffe01331a4>] __alloc_pages+0x104/0x128
[ 26.568688] [<000003ffe001ab46>] crst_table_alloc+0x2e/0xa0
[ 26.568693] [<000003ffe01164c4>] __pmd_alloc+0x24/0x160
[ 26.568696] [<000003ffe0116650>] pmd_alloc+0x50/0x68
[ 26.568698] [<000003ffe0117be4>] remap_pfn_range_notrack+0x194/0x310
[ 26.568701] [<000003ffe0117d7c>] remap_pfn_range+0x1c/0x28
[ 26.568703] [<000003ffe0015442>] remap_oldmem_pfn_range+0xb2/0x108
[ 26.568705] [<000003ffe01a0544>] mmap_vmcore+0x414/0x448
[ 26.568707] [<000003ffe01937c4>] proc_reg_mmap+0x84/0xa0
[ 26.568709] [<000003ffe011f264>] mmap_region+0x22c/0x6f8
[ 26.568711] [<000003ffe011fae8>] do_mmap+0x3b8/0x410
[ 26.568713] [<000003ffe01015cc>] vm_mmap_pgoff+0x9c/0xe8
[ 26.568715] [<000003ffe011d006>] ksys_mmap_pgoff+0x8e/0xb8
[ 26.568716] [<000003ffe011d0f4>] __s390x_sys_old_mmap+0x74/0x90
[ 26.568718] [<000003ffe0341a2a>] __do_syscall+0x1aa/0x220
[ 26.568720] [<000003ffe03478b0>] system_call+0x70/0x98
[ 26.568724] Mem-Info:
[ 26.568725] active_anon:1 inactive_anon:12 isolated_anon:0
active_file:83590 inactive_file:93939 isolated_file:0
unevictable:201 dirty:17845 writeback:4
slab_reclaimable:4259 slab_unreclaimable:1482
mapped:174 shmem:0 pagetables:810
sec_pagetables:0 bounce:0
kernel_misc_reclaimable:0
free:2694 free_pcp:105 free_cma:0
[ 26.568729] Node 0 active_anon:4kB inactive_anon:48kB active_file:334360kB inactive_file:375756kB unevictable:804kB isolated(anon):0kB isolated(file):0kB mapped:696kB dirty:71380kB writeback:16kB shmem:0kB writeback_tmp:0kB kernel_stack:544kB pagetables:3240kB sec_pagetables:0kB all_unreclaimable? no
[ 26.568732] DMA free:10776kB boost:0kB min:3496kB low:4368kB high:5240kB reserved_highatomic:0KB active_anon:4kB inactive_anon:48kB active_file:334360kB inactive_file:375756kB unevictable:804kB writepending:71360kB present:786428kB managed:764664kB mlocked:0kB bounce:0kB free_pcp:420kB local_pcp:420kB free_cma:0kB
[ 26.568735] lowmem_reserve[]: 0 0 0
[ 26.568738] DMA: 1069*4kB (UH) 757*8kB (UH) 11*16kB (H) 6*32kB (H) 1*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 10764kB
[ 26.568747] 177773 total pagecache pages
[ 26.568748] 196607 pages RAM
[ 26.568748] 0 pages HighMem/MovableOnly
[ 26.568749] 5441 pages reserved
[ 26.568749] Tasks state (memory values in pages):
[ 26.568750] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name
[ 26.568751] Out of memory and no killable processes...
[ 26.568752] Kernel panic - not syncing: System is deadlocked on memory
[ 26.568755] CPU: 0 PID: 1 Comm: init Not tainted 6.9.0-20240504.rc6.git0.9986ea583f39.300.fc39.s390x+zfcpdump #1
[ 26.568758] Hardware name: IBM 3931 A01 704 (LPAR)
[ 26.568759] Call Trace:
[ 26.568760] [<000003ffe03277c6>] dump_stack_lvl+0x76/0x98
[ 26.568763] [<000003ffe001f14e>] panic+0x10e/0x2e8
[ 26.568765] [<000003ffe00f21c8>] out_of_memory+0x280/0x348
[ 26.568768] [<000003ffe0132f3e>] __alloc_pages_slowpath.constprop.0+0x65e/0x7c0
[ 26.568771] [<000003ffe01331a4>] __alloc_pages+0x104/0x128
[ 26.568773] [<000003ffe001ab46>] crst_table_alloc+0x2e/0xa0
[ 26.568776] [<000003ffe01164c4>] __pmd_alloc+0x24/0x160
[ 26.568779] [<000003ffe0116650>] pmd_alloc+0x50/0x68
[ 26.568781] [<000003ffe0117be4>] remap_pfn_range_notrack+0x194/0x310
[ 26.568784] [<000003ffe0117d7c>] remap_pfn_range+0x1c/0x28
[ 26.568787] [<000003ffe0015442>] remap_oldmem_pfn_range+0xb2/0x108
[ 26.568789] [<000003ffe01a0544>] mmap_vmcore+0x414/0x448
[ 26.568791] [<000003ffe01937c4>] proc_reg_mmap+0x84/0xa0
[ 26.568793] [<000003ffe011f264>] mmap_region+0x22c/0x6f8
[ 26.568795] [<000003ffe011fae8>] do_mmap+0x3b8/0x410
[ 26.568797] [<000003ffe01015cc>] vm_mmap_pgoff+0x9c/0xe8
[ 26.568799] [<000003ffe011d006>] ksys_mmap_pgoff+0x8e/0xb8
[ 26.568801] [<000003ffe011d0f4>] __s390x_sys_old_mmap+0x74/0x90
[ 26.568803] [<000003ffe0341a2a>] __do_syscall+0x1aa/0x220
[ 26.568805] [<000003ffe03478b0>] system_call+0x70/0x98
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For vr-kernel dumps use the offsets stored in os_info entries for
virt to phys address conversion when dump virtual address is to be
read, (e.g. vmcoreinfo symbols) using similar method as implemented
in crash-utility.
It is mainly required for reading "init_uts_ns" symbol and, in case
of crashed kdump, "lowcore_ptr" symbol along with a pointers to the
lowcore of every CPU.
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Support vmcore based dumps (ngdump, zfcpdump) with uncoupled physical and
virtual addresses. For that we just remove p_paddr != p_vaddr sanity check
for elf load headers.
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Output generated using libutil's util_fmt_*() functions contains
meta-data such as hostname and time of invocation. When writing test
cases that compare expected and actual tool output, this run-time
variable information needs to be filtered out, resulting in increased
complexity.
To address this, add a global option to suppress meta-data output via
environment variable FMT_NOMETA. If set to '1', no meta-data will be
generated.
Example:
$ FMT_NOMETA=1 chpstat --format json
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The previous implementation did stop after the first download was
successful, even if it did not contain a CRL. This behavior renders a
second, third, ... link as backup location useless as the code ignores
them if the URI e.g. contains a error message. That results in not
having a CRL and probably a failed certificate verification.
Fix this by trying again if the download was successful but did not
contain a CRL
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In order to allow loop devices usage for DASD dump emulation in fvt-tests,
do not bail out on ZG_TYPE_DASD device type returned by zg_type() for
s390_ext dump.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
There are still a few scripts using the 'which' command to determine
either the full path or the mere existence of an executable.
Some of these scripts might run in minimal environments where 'which' is
not available due to dependency restriction. 'which' is also considered
unreliable for historical implementation details.
Use the POSIX defined [1] built-in 'command -v' instead to reduce
package dependencies and improve reliability.
[1] https://pubs.opengroup.org/onlinepubs/9699919799/
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The new parameter 'SCP_DATA' can be used to pass additional kernel cmdline
parameters to a stand-alone SCSI/NVMe/ECKD dumper for debugging purposes.
Configuration example
=====================
ON_PANIC=dump_reipl
DUMP_TYPE=fcp
DEVICE=0.0.4711
WWPN=0x5005076303004711
LUN=0x4711000000000000
BOOTPROG=0
BR_LBA=0
SCP_DATA="dump_debug=6 ignore_loglevel earlyprintk=sclp panic_print=3"
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When dump is copied to the filesystem in s390 format, follow on
'zgetdump -i' can fail with ioctl error:
# zgetdump /dev/dasdb1 -f s390 dump.s390
Format Info:
Source: s390_ext
Target: s390
Copying dump:
00000001 / 00008192 MB
00003688 / 00008192 MB
00006646 / 00008192 MB
00008192 / 00008192 MB
Success: Dump has been copied
# zgetdump -iVVVV dump.s390
zgetdump: Operation "BLKSSZGET" failed on "dump.s390" (Inappropriate ioctl for device)
Call ioctl(BLKSSZGET) only for s390_ext dump format (dump can be
stored on DASD partition only, not on the filesystem). For s390 format
a blocksize is not required for dump processing since s390 dump data is
not compressed.
Fixes: 271b809495 ("zdump/dfi_s390: Support reading compressed s390_ext dumps")
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
pvattest-C had a -a option for --arpk which the Rust implementation
missed.
Add this short option.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The commit fb0b6263d1 ("zipl/src: Fix problems when target parameters
are specified by user") breaks the case where the user has to provide
all target attributes via the zipl command line, because the target
device cannot be used to retrieve those attributes.
$ zipl -V --blsdir /tmp/tmp.xHmFUdgBCi/boot//loader/entries/ --config /tmp/tmp.dSv9MJ3svs
Looking for components in '/lib/s390-tools'
Using config file '/tmp/tmp.dSv9MJ3svs' (from command line)
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//50_normal.conf'
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//45_normal_swiotlb.conf'
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//40_pv.conf'
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//30_pv_reboot.conf'
Secure boot support: yes
Target device information
Device..........................: 2b:00
Device name.....................: nbd0 *)
Device driver name..............: nbd
Type............................: disk device
Disk layout.....................: SCSI disk layout *)
Geometry - start................: 2048 *)
File system block size..........: 4096
Physical block size.............: 512 *)
Device size in physical blocks..: 2095071
*) Data provided by user.
Building bootmap in '/tmp/tmp.xHmFUdgBCi/boot/'
Building menu 'zipl-automatic-menu'
Adding #1: IPL section 'Normal Guest' (default)
initial ramdisk...: /tmp/tmp.xHmFUdgBCi/boot//ramdisk-s390x
kernel image......: /tmp/tmp.xHmFUdgBCi/boot//vmlinux-s390x
zIPL environment block content:
Error: Could not add image file '/tmp/tmp.xHmFUdgBCi/boot//vmlinux-s390x': Could not get disk geometry
This reverts commit fb0b6263d1.
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Having timestamps in gzip leads to lintian warning
'package-contains-timestamped-gzip' and will harm reproducible builds.
Gzip option '-n' avoids saving original file name and especially timestamps
by default.
Fixes: https://github.com/ibm-s390-linux/s390-tools/pull/169
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
[seiden@linux.ibm.com: Fix commit message]
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Do some formatting that are in experimental stage but improve the code
readability.
Use rustfmt with a nightly toolchain and enable:
format_code_in_doc_comments = true
reorder_impl_items = true
comment_width = 100
wrap_comments = true
normalize_comments = true
(see .rustfmt.toml)
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Remove all the code just pvattest-C used from libpv.
z(get)dump is the only user as of now.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This will reduce code dependency to otherwise unused code in libpv.
This code will be removed with the next patch.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a CLI compatible Rust implementation of pvattest-C.
- All (non-experimental) options are supported and work exactly as in
the C implementation. For some options/parameters new variants are
available.
- `perform` now also accepts positional arguments, while keep accepting
-i and -o that was mandatory in the C implementation.
- `version` may also be a command instead of an option now.
- -V is deprecated
- -v increases verbosity instead of showing the version
- all experimental options are dropped
Acked-by: Qi Feng Huo <huoqif@cn.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Renames pv crate to s390_pv and pv_core to s390_pv_core. pv was already
taken on crates.io.
Bump the versions of all crates to 0.10.0. From now on we follow Semver
compatibility rules when it comes to updates. patch-level updates will
not introduce any backwards incompatible changes. For now all crates in
this directory will have the same version number. A version update may,
therefore, not add any new things.
Library users in this repository still use the non prefixed names and
rename the crate in the Cargo.toml. Doc-tests have to use the new name
however.
Add some Cargo metadata to the Cargo.toml.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use `AsRef<Path>` instead of `&Path`, &str, .... to be more versatile
and accept more input types. In addition, use `PathBuf` and `Path` for
paths instead of `String` and `str`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Denies compiling if one of the following lints find something in pv or
pv_core:
missing_docs,
missing_debug_implementations,
trivial_numeric_casts,
unstable_features,
unused_import_braces,
unused_qualifications
Those lint force developers to avoid unnecessary code and providing
debuggability & documentation for each public symbol.
Fix the compile time error introduced with those lints.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
crates.io does not like sub-crates in a crate. Unpack the
openssl-extensions sub-crate into a (private) module.
While at it, fix some styling issues.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add functionality for:
* sending attestation requests to the uvdevice and retrieve the
response
* create/read the attestation exchange format file format
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a function to decrypt a block with aes_gcm.
Add functionality to perform HMAC operations.
Acked-by: Qi Feng Huo <huoqif@cn.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a thin wrapper around [u8] to be able to represent an u8-slice as a
hex-string for Display and Serialize.
Acked-by: Qi Feng Huo <huoqif@cn.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Remove !#[allow(unused)] in pv_core and fix all unused warnings from the
Rust compiler.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Prepare pv & pv_core crates to be released on crates.io:
* Remove any unused API to stay flexible
* Remove utils dependency
* Move cli, tmpfile and version utilities to local utils crate
* Use the new utilities in the pv tools
* Rename Secret into Confidential to avoid confusion of Secret (now
Confidential) and AddSecret requests.
* Move the uvsecret module out of the request module and change the name
to secret.
* Cleanup dependencies
* Precise and correct minimal dependency versions
* Inline `Aes256Key::from_digest`
The cleanup ensures that the code also compiles with the dependencies
resolved to their minimal versions using:
$ cargo +nightly -Z minimal-versions update
$ cargo build
For more information refer to this blog post:
https://users.rust-lang.org/t/psa-please-specify-precise-dependency-versions-in-cargo-toml/71277/8
Signed-off-by: Marc Hartmayer <mhartmay@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add subcommands in the man description. Add description for the help option.
Fix some minor wording issues.
Add the curve type in the --user-data option of create.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a new tool named chpstat that can be used to view channel-path
statistics such as utilization and I/O throughput, and to query and
control the status of the channel-path statistics function.
Note: Channel-path statistics are only available on systems running in
an LPAR or DPM partition.
When run without further options, data for all channel-paths is
displayed repeatedly with a 5 second delay in table format.
Example output:
CHANNEL-PATH UTILIZATION(%) READ(B/s) WRITE(B/s)
ID TYP CMG SHR SPEED PART TOTAL BUS PART TOTAL PART TOTAL
1d 25 2 1 - 7.16 7.50 7.50 129M 129M 0.00 161K
21 1b 2 1 32G 0.00 0.00 0.00 0.00 0.00 0.00 0.00
34 1b 2 1 32G 0.00 0.00 0.00 0.00 0.00 0.00 0.00
61 25 2 1 - 0.00 0.01 0.00 0.00 2.00K 0.00 307K
63 25 2 1 - 0.00 0.01 0.00 0.00 0.00 0.00 381K
bd 11 2 1 10G - - - 529.8 532.1 616.3 616.3
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add helper functions for converting structured key-value data into
different formats such as JSON, text pairs, and CSV.
Using these functions the resulting output format can be dynamically
configured at run-time without the need to duplicate output-generating
code for each format type. Also format-specific requirements such as
quoting, indentation, and comma-placement are automatically taken care
of.
Basic API calling sequence:
util_fmt_init() => Select output format
util_fmt_obj_start() => Start a new object or list
util_fmt_pair() => Emit a key-value pair
util_fmt_obj_end() => End the most recent object or list
util_fmt_exit() => Cleanup
Notes:
- Supported data elements are objects, lists and key-value pairs
(mappings)
- Scalars are only supported as part of a mapping
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add function util_concatf() that appends the result of a format string
expansion to the end of an existing string while taking care of the
required memory allocations.
Usage example:
char *str = NULL;
util_concatf(&str, "list:");
for (int i = 1; i <= 3; i++)
util_concatf(&str, "%spart%d", (i > 1 ? "," : ""), i);
printf("%s\n", str); /* list:part1,part2,part3 */
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add helper macros to easily create, enlarge and append new elements to
dynamic arrays of arbitrary types.
Note: The use of dynamic arrays over lists may be preferable in some
cases to reduce complexity, and they may be required in cases where
elements need to be addressed directly by index.
Usage example:
struct {
int a;
int b;
} *array = NULL, element = { 1, 2 };
unsigned int num = 0;
util_add_array(&array, &num, element);
printf("array[0].a=%d\n", array[0].a); /* array[0].a=1 */
printf("array[0].b=%d\n", array[0].b); /* array[0].b=2 */
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The current implementation of util_hexdump_grp() enforces a minimum
indentation of 1 space which may not be suitable for all users.
Fix this by allowing a true zero indentation level.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The separator line emitted by util_rec functions may not be suitable for
all users. Fix this by making the hdr_sep parameter optional.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
By default, files opened via fopen are block-buffered. As a result,
I/O errors that occur during file write operations via util_file_write_*
are silently ignored because fputs() only buffers data while actual I/O
occurs during the flush operation that is part of the final fclose()
library call.
Fix this by indicating errors that occur during fclose() via the
util_file_write_* function return code.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Steps to reproduce: Prepare some target disk for IPL, specifying
its parameters via zipl "target options", and an image IMAGE_NAME
located on another disk. Don't specify "-a" option.
Actual result: Installation succeeded (resulting in unbootable setup)
Expected result: "Error: Could not add image file 'IMAGE_NAME': File
is not on target device"
The problem is in incorrect evaluation of device number(dev_t) where
the image is located by the function add_component_file_range() in
case when target parameters are specified by user.
Fixup: Retrieve info of the underlying disk without any user hints,
passing zeroed structure job_target_data
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This patch fixes a bug in disk_get_info()
Steps to reproduce: Prepare a SCSI disk for IPL, specifying an image
("-i IMAGE_NAME") located on DASD and a target directory ("-t /mnt")
located on SCSI (dm). Don't specify "-a" option.
Actual result: Installation succeeded (resulting in unbootable setup!)
Expected result: "Error: Could not add image file 'IMAGE_NAME':
File is not on target device".
The problem is in incorrect evaluation of device number (dev_t) of
the device, where the image file is located, by the function
add_component_file_range(). To evaluate it, disk_get_info() is called
with the structure job_target_data (passed as the second argument)
previously completed by disk_get_info() called earlier to evaluate
parameters of the specified target device (SCSI dm) by the function
prepare_build_program_table_file(). Since the targetbase is already
set in the passed job_target_data (by the first call), in the second
call the source type is evaluated as "source_user", so the number of
the device where the image is located is calculated by the base SCSI
disk, which is incorrect.
Fixup: Rework disk_get_info(): introduce a dedicated function to
evaluate source type not depending on the job_target_data content.
Implement the core procedure as a switch by the evaluated source
type.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use "bootmap_dir" field of struct job_target_data instead,
thus avoid allocation/releasing additional resources.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This patch fixes a bug in disk_get_info()
Steps to reproduce: Prepare a DASD disk for IPL, specifying an
image ("-i IMAGE_NAME") located on SCSI (dm) and a target directory
("-t /mnt") located on DASD. Don't specify "-a" option.
Actual result: "Run /lib/s390-tools//zipl_helper.device-mapper /mnt
Error: Could not retrieve device-mapper information for device
'dasda1'"
Expected result: "Run /lib/s390-tools//zipl_helper.device-mapper 253:4
Error: Could not add image file 'IMAGE_NAME': File is not on target
device"
The problem is in incorrect calculation by disk_get_info()
parameters for @device associated with the image file. Specifically,
@target->bootmap_dir is passed to the script, which is wrong.
Fixup: Get rid of bogus branching in disk_get_info() in case when
target parameters are evaluated in "source_script" mode. Always pass
major and minor of the @device (whose parameters to be calculated)
to the helper script.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The man page title was incorrectly set to "LSDASD". Set the correct name
"DASDSTAT".
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped. Fix whitespace damage
along the way.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyphens are converted by groff to a different unicode character leading
to failing command execution of copy-pasted options or examples.
Ensure that all hyphens are properly escaped.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Under QEMU user can attach disk with smth like:
```
-device virtio-scsi-ccw,... -device scsi-hd,...
```
So virtio block device appears as '/dev/sda' instead of '/dev/vda'.
chreipl assumes all '/dev/sd*' disks as FCP disks, which is not a
case in such setup.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/154
Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
Acked-by: Marc Hartmayer mhartmay@linux.ibm.com
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add helper function to get device's real path under SYSFS_ROOT devices
hierarchy.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/154
Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Acked-by: Marc Hartmayer mhartmay@linux.ibm.com
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
If many invocations of mdevctl occur simultaneously (as can happen with
libvirt) then waiting for 5-60 seconds per lock retry is simply too long.
Anticipating this possibility, retry more frequently but also attempt
significantly more retries than before.
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Tested-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The default values for repeated attempts at acquiring a file lock created
by util_lockfile are on the order of seconds. Let's leave this the
default, but allow for a caller to specify smaller values by adding
cw (custom_wait) functions and by switching from using sleep to usleep.
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Ensure that all hyphens in command options and examples are escaped properly.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Ensure that all hyphens in command options and examples are escaped properly.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When formatting an ESE (thin-provisioned) ECKD DASD, dasdfmt(8)
defaults to the quick-format mode instead of full-format for normal
DASDs. This results in a significant performance impact during first
sequential write to each track, which may be unexpected for users.
To address this, change the default for dasdfmt to always use
full-format mode. Customers that require thin provisioning(*) still
override the default by specifying quick format explicitly using the
"-M" option.
Get rid of the related fallbacks; In case of unsuccessful space
release always fail. The customers that still require quick format can
proceed by specifying "--no-discard" option.
(*) Thin provisioning: while providing a large amount of logical
space, zero amount of actual space is provisioned and then
allocated on an on-demand basis.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check for vmcore LOAD segment with zero paddr (instead of zero vaddr) to
identify HSA since physical and virtual addresses can be uncoupled on s390.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'lschp' command's output contains a 'type' identifier column. For
information about each value of this identifier, provide the
reference to the z/OS public documentation in the manpage.
Suggested-by: Mike Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get rid of all arch barriers in main.rs. cmd.rs handles the arch
barriers for the individual commands. Simplifies main.rs & cmd.rs and
makes it easier to read and understand the code.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix findings from `cargo clippy --all-targets`. `warning: calls to
`push` immediately after creation` The findings were in test code only.
Also, replace a while loop with a function from Vec.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
They add no value and code outside the crate does not need those constants.
Reduces unnecessary constant duplication. Introduce an error for to
large Add-Secret requests and check for this to render those contsnts
fully unnecessary for the API.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The BinGuestSecret type provides no benefits. The public GuestSecret
struct can handle everything. Therefore, move the two functions from bin
to the non-bin variant. While at it, use a struct to define the binary
structure instead of copy numbers to some positions in a Vec. This
simplifies the addition of further secret types.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This streamlines and unifies the use and (de)serialization of structs
using a secret id. As a bonus, the hidden `for_pv` module is not longer
needed.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Provides a default for the cmd function for an UvCmd. This is enabled by
requiring an associated constant for the IOCTL nr of the command.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The content of `pv/src/uvsecret/uvc.rs` was moved with
9b51b8b882 ("rust/pv: Refactor pv crate") to pv_core.
The content was unused, but the file was not deleted.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix clippy waring `warning: very complex type used.` by introducing a
new struct containing the tuple, that was returned before.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
During the remove of mockito, lazy_static dependency was accidentally
removed as well.
Fix this by adding lazy-static as dev dependency again.
Fixes: aba8900074 ("rust/pv_core: Remove mockito dependency")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This adds the counter numbers to the corresponding counter names to the
cpacfstats output. This aims to ease using this tool with other related
tools which may use other names for the counters.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
All files created by chzdev feature a common header; however, this
header is absent in temporary files. It is necessary to incorporate
the consistent "Generated by chzdev" header into temporary files
generated by chzdev as well, so as to properly identify these files
via option --is-owner.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Enhance the 'chzdev' tool by introducing a new option to discern
files created by 'zdev-tools.' The command usage is as follows:
$ chzdev --is-owner <file-name>
When executed, the command will return an exit code of 0 for all
files generated by zdev-tools. In the case of an unknown file, the
tool will return the exit code 'EXIT_UNKNOWN_FILE i.e 33.'
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add zdev-specific definitions into a lightweight header file. Rather
than creating a new one, transform the existing "site.h" into "zdev.h"
to house all generic zdev-specific definitions that needs to be shared
between chzdev, lszdev and zdev_id going forward.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Up until now cpacfstats assumes that on the running hardware either all
PAI and CPUMF are available or non at all. Which counters are supported
may be hardware dependent and can vary in the future. With
this commit cpacfstats dynamically loads the counters from sysfs entries
in (/sys/devices/pai_crypto/events/) and (/sys/devices/cpum_cf/events/)
respectively.
Additionally cpacfstats has a new way of determining which PAI counters
are meant for kernel usage.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With f6c6f0cc71 ("rust/pv/test: Code + Certificate refactoring")
no code uses mockito anymore, but it's dependency was not removed.
Remove the mockito dependency from the rust workspace.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
OpenSSL 1.1 seems to use a non-const parameter to X509_name_dup(), but
x509_armonk_locality_fixup() is passing a const there. The compile then
fails on "discards 'const' qualifier", when -Werror is used. Thus
resolve with a type-cast like in c2b_name().
Fixes: https://github.com/ibm-s390-linux/s390-tools/pull/167
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Dan Horák <dan@danny.cz>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
OpenSSL 1.1 seems to use a non-const parameter to X509_name_dup(), but
x509_armonk_locality_fixup() is passing a const there. The compile then
fails on "discards 'const' qualifier", when -Werror is used. Thus
resolve with a type-cast like in pv_c2b_name().
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/167
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Dan Horák <dan@danny.cz>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix leak of temporary files: if prepare_build_program_table_file()
is called in no dry-run mode and there was an error then the file
@filename will not be deleted in free_bootloader()).
Fix leak of renamed files as well as corruption of previously
created bootmap files with the same name in case of unsuccessful
IPL installation.
Add a special flag to keep a track of file's "temporary" state;
Base the cleanup decision on this flag instead of checking dry-run;
Release resources captured by prepare_bootloader() in the error path;
Move the final rename to be called only after successful installation.
Original logic:
prepare_bootloader_ipl():
prepare_bootloader_ngdump():
always create temporary @filename
if (!dry-run) rename @filename;
install;
cleanup: if (dry_run) drop @filename (*** LEAK ***)
prepare_bootloader_device():
if (dry_run) create temporary @filename
install, don't rename;
cleanup: if (dry_run) drop @filename
New logic:
prepare_bootloader_ipl():
prepare_bootloader_ngdump():
always create temporary @filename and set @tmp_filename_created;
install;
if (!dry_run) rename @filename and clear @tmp_filename_created;
cleanup: if (@tmp_filename_created is set), drop @filename
prepare_bootloader_device():
if (dry_run) create @filename and set @tmp_filename_created;
install, don't rename;
cleanup: if (@tmp_filename_created is set) drop @filename.
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/165
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Convert the assertion to a GError since an out-of-disk-space situation
is a valid situation that should be handled.
ERROR:utils/crypto.c:1843:__encrypt_decrypt_bio: assertion failed: (num_bytes_written == out_len)
Bail out! ERROR:utils/crypto.c:1843:__encrypt_decrypt_bio: assertion failed: (num_bytes_written == out_len)
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The parser setup falsely set the argument type as filename array, but
code expected a single filename. Fixed by setting up the parser
correctly to expect a single file name.
Fixes: 3ab06d77fb ("pvattest: Create, perform, and verify attestation measurements")
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
New IBM signing keys will have Armonk as locality in the subject.
Ensure that CRLs with Poughkeepsie as issuer locality are still
discovered if they are signed with the signing keys private key.
Also, drop the check for issuer/subject comparison and only rely on
validity period and cryptographic signatures.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
New IBM signing certificates will have 'Armonk' as locality in the
subject. Make sure that certificate revocations lists (CRL) with
'Poughkeepsie' as issuer locality are still considered as valid as long
as they are signed with the IBM signing keys private key. In addition,
drop the check for 'issuer(HKD) == subject(HKSK)' as it doesn't improve
security. While at it, remove now unused functions and fix a memory leak
of @akid in `check_crl_issuer`.
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
New IBM signing keys will have Armonk as locality in the subject.
Ensure that CRLs with Poughkeepsie as issuer locality are still
discovered if they are signed with the signing keys private key.
Also, drop the check for issuer/subject comparison and only rely on
validity period and cryptographic signatures.
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
* Get rid of Mockito
* create certs with AKID
* simplify things in the `create_certs.py` script
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For LUKS2 volumes, zkey generates 'cryptsetup luksFormat' commands with
options '--pbkdf argon2i --pbkdf-memory 32 --pbkdf-force-iterations 4'
for low memory and time requirements. Using the default Argon2i options
might cause out-of-memory errors when multiple encrypted volumes are
unlocked automatically at boot through /etc/crypttab.
When the system runs in FIPS mode, which is indicated by file
/proc/sys/crypto/fips_enabled containing '1', the Argon2i password based
key derivation function might be disabled by a policy, and such
'cryptsetup luksFormat' commands might fail.
Generate '--pbkdf pbkdf2' instead if the system runs in FIPS mode.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the support for staged installs. The Makefile variable `PKGDATADIR`
uses `DESTDIR` for all Makefile target, but actually it should only be
used for the `install*` and `uninstall*` targets. [1] Fix this by using
`DESTDIR` only for `install*` targets - uninstall* targets are not
supported by s390-tools.
Before this change, if `DESTDIR` was set for staged installs,
`genprotimg` has tried to find the bootloader binaries at the temporary
installation path `$DESTDIR$(TOOLS_DATADIR)/genprotimg/` instead of
`$(TOOLS_DATADIR)/genprotimg`.
[1] https://www.gnu.org/prep/standards/html_node/DESTDIR.html
Fixes: 65b9fc442c ("genprotimg: introduce new tool for the creation of PV images")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Make ngdump_get_part_path() public in order for unit-tests to access it.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Clear CCW-type DASD standalone dumper (if installed on the DASD) upon
successful installation of the List-Directed ECKD dump tool on the same
device. This helps to avoid 'zgetdump -d' confusion and have only one
'active' dump tool per disk.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add DF_S390_DUMPER_MAGIC_SIZE constant to s390_dump.h.
Use it instead of hardcoded length when processing dumper magics
in zgetdump code.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Move DUMPER_MAGIC constants from df_s390.h to the global header
include/dump/s390_dump.h in order to reuse it in zipl code.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Update dumpconf man page with list-directed ECKD dump information (new
attributes and configuration example for ECKD LDIPL dump).
Update etc/sysconfig/dumpconf with list-directed ECKD dump configuration
example.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
- Write the following sysfs attributes for list-directed ECKD devices
introducing setup_eckd_device() function.
br_chr: location of boot record
bootprog: boot program selector
- Remove redundant parameters from setup_ccw_device() and setup_fcp_device()
functioins.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reject conversion of other key types with a proper error message.
Also fix a typo in another error message of the convert command.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use similar `install` mode option in Makefile as in commit
9b2fb1d4d2 ("zdev: add helper to convert from dasd_mod.dasd to zdev
config").
Fixes: 73c46a3056 ("zdev/dracut: fix kdump by only activating required devices")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
s390-tools doesn't define a common C/C++ standard at the moment.
Set the standard to gnu11/gnu++11, which is also used by the Kernel, and
establish a common baseline for all tools.
The -std flag is added to ALL_CFLAGS and ALL_CXXFLAGS to avoid losing it
in case CFLAGS are set by an outside entity.
It is also added to CLAGS_FOR_BUILD for this one special cross build
case.
The -std flag is removed from all tools that set it manually until now.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduces the ability to `pvsecret` to add a signature (ecdsa or rsa)
to the program-reserved space (user-data) of an add-secret request
during the request creation. Additionally, some arbitrary data may be
inserted.
The new command `verify` checks if add-secret requests are sane (e.g.
start with the correct magic value). If the request contains a
user-signature `verify` will also verify this signature.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Makes the source for the manfiles&README more readable. Fixes some nits
like double spaces, unnessecary indentations, line breaks, ...
Removes pvsecret-version.1 as this command maps to the --version
option.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a function to read a private key in PEM or DER format.
While at it, fix some documentation issues in read_{certs, crls}.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
User-data can be added to add-secret requests. User-data can be unsigned
or containing a signature of the request using a custom private key.
The user-data is placed at offset 0x218 and 0x200 bytes long.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add four new user-data types an add-secret request could have:
Unsigned, Signed(EcSECP521R1, Rsa(2048, 3072))
As the user-data enum was not marked as non-exaustive this might be a
breaking change for users. (Not for any crate in this repo though).
The addition of such user-data is provided by following patches.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve the warning for the case where a host key document contains
multiple certificates (only possible for a PEM file). In case there are
multiple host key document only the first certificate is used.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix a panic in `pvsecret` when a empty file is used as a host key
document.
$ touch hkd
$ pvsecret create --no-verify -k hkd --output req.bin --hdr sehdr
...
The host key document in 'bla' contains more than one certificate!
thread 'main' panicked at pvsecret/src/cmd/create.rs:192:31:
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the `TemporaryDirectory` type to create a temporary directory. This
type has the advantage that the directory is automatically removed once
it goes out of scope. The old implementation in test_sysfs_write_i32
leaks a directory if a previous subtest failed. Also, using a temporary
directory for the LockFile test fixes the following error:
$ RUST_BACKTRACE=1 cargo test -- helper::tests::test_lockfile
...
running 1 test
test helper::tests::test_lockfile ... FAILED
failures:
---- helper::tests::test_lockfile stdout ----
thread 'helper::tests::test_lockfile' panicked at pvapconfig/src/helper.rs:265:9:
assertion failed: r1.is_ok()
stack backtrace:
0: rust_begin_unwind
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/std/src/panicking.rs:597:5
1: core::panicking::panic_fmt
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/panicking.rs:72:14
2: core::panicking::panic
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/panicking.rs:127:5
3: pvapconfig::helper::tests::test_lockfile
at ./src/helper.rs:265:9
4: pvapconfig::helper::tests::test_lockfile::{{closure}}
at ./src/helper.rs:263:24
5: core::ops::function::FnOnce::call_once
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/ops/function.rs:250:5
6: core::ops::function::FnOnce::call_once
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the type `TemporaryDirectory` that creates a temporary directory
that is automatically removed when it goes out of scope.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Recent changes makes it reasonable to update the version string of pv
and pv_base to 1.0.0. Recent changes introduced some non-backwards
compatible changes, like move some Error definition from pv to the new
pv_core crate. Also, the pv crates seem to be in a good shape to be
considered released.
Therefore, move up the Semver to 1.0.0.
See also:
https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html
NOTE: As these crates are not published to `crates.io` as of now, the
version number is meaningless, as cargo will not pull them from
anywhere and just use the files provided by this repository.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update the zerocopy dependency from v0.6.* to the non forward compatible
v0.7.*. Incompatible changes are the requirment of the FromZeroes trait
for FromBytes trait and the non-default derive feature which this
patches handles as well.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use a static Mockito server instead of creating multiple on-the-fly
during testing. Add the `mockito_server_available` test to quickly
verify that the mockito server could be constructed. Relocate the
verifier API test to the test folder as it tests the public API. Also,
make the Debug impl for CertVerifier public. The test relocation
requires this. Before, there could be a test local implementation of the
Debug impl as it was in the same crate.
While at it, get rid of the lazy_static crate in favor of the once_cell
crate. As the new std lib implementation is very near to the one from
once cell. The project will switch to the std impl when v1.70 is
available in all supported distros. See:
https://doc.rust-lang.org/std/sync/struct.OnceLock.html
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace all libc references to rust-std references if available.
This eliminates the need to include libc in the pv crate.
However, pv_base still refers to libc::ioctl and libc::ENOTTY.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The rust std lib already provides functionality to compare two slies.
Replace all `memeq` invocations with == and remove the `memeq` function.
As a side effect this eliminates some unsafe code in this crate.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Big refactoring patch of the pv crate. The main reason behind this
refactoring is to simplify testing and maintaining the pv crate while
keeping OpenSSL/libcurl dependencies optional. Using crate features
increases the number of targets that have to be tested. This refactoring
eliminates the use of features by splitting the functionality of pv into
a use OpenSSL and no-use-OpenSSL crate.
Split off some code from the pv crate into a pv_core crate. pv requires
pv_core and reexports all symbols. pv_base contains all code from former
pv that does not use OpenSSL or libcurl functionalities. The refactored
pv crate contains functionalities to generate requests and validate host
key documents. All features from pv are dropped as they are not needed
anymore and to streamline the codebase for easier use and testing. While
at it fix some documentation issues.
Users (pvsecret & pvapconfig) have next to no code change, besides the
different import of the crate.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A function does the job as well. This improves code readability and
useability. While at it remove the implicit Buffer wrapper. Users are
currently not use the benefits of a buffered write. Also, streamline the
write_out helper function.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With kernel commit 496bb034f4ff ("s390/smp: disallow CPU hotplug
of CPU 0") it is no longer possible to hotplug CPU 0.
As a side effect, the sysfs handle /sys/devices/system/cpu/cpu0/online
does no longer exist. Since cpuplugd relies on checking all online
handles of all CPUs, this change causes cpuplugd to fail as it
interprets a non existing online file as an indicator that no other CPUs
with higher IDs exist as well. This leads to cpuplugd assuming that
there are no CPUs available.
Instead of checking for the online file, it is preferable to check for
the existence of the parent folder to verify the existence of a CPU.
As a consequence, all other checks for non-existing online files must
now imply that the CPU is online, but not hotpluggable.
Signed-off-by: Tobias Huschle <huschle@linux.ibm.com>
Tested-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When pai records data it may fail in select() system call.
This error is not reported and the pai program exits with success.
Change this and exit with proper exit code.
Fixes: d7b1cbad8b ("cpumf/pai: Add Processor Activity Instrumentation tool")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Running command pai -r <file> might encounter entries of type
PERF_RECORD_SWITCH. Entries of that type are currently not handled
and cause an error message:
# pai -r ~/paicrypto.000
unknown header-type 14 unknown header-type 14 \
unknown header-type 14 ...
The error message is not terminated by a newline.
Handle entries of this type PERF_RECORD_SWITCH. These records
do not carry any payload at all, just a bit is set in the
header::misc member. This bit set determines context switch out.
Output after:
# ./pai -r ~/paicrypto.000
0x4b814018f4f3 6 cs-out
0x4b817bc3c936 6 cs-in
0x4b817bc5246c 6 cs-out
0x4b817bd90e9a 6 cs-in
....
#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add pre-commit (https://pre-commit.com/) configuration to allow
developers to run certain checks on their commits automatically.
Currently enabled checks and hooks are:
- Generic checks (e.g. merge-conflicts, trailing whitespace, etc.)
- git clang-format
- Codespell
- Shellcheck (https://www.shellcheck.net/)
Note: For some hooks Rust is excluded as a lot of false positives are
produced at the moment.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
step "initrd config files" was added as 19th step to our data collection
updating for newer date and distro version in the sample output
Reviewed-by: Michael Storzer <mstorzer@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pvapconfig is a new tool for automatically configuring the APQNs
within an Secure Execution KVM guest with AP pass-through support.
Based on a given AP configuration it tries to find a matching
APQN and bind and associate it with the correct secret.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adds getter for SecretList and SecretEntry.
Adds enum to represent secret types.
Add Iterator functionality for SecretList.
While at it, make the datatype of the capacity of the list transparent
for users.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For each initrd, collect verbose content listing as well as
the content of files matching the file glob patterns in $CONFIGFILES.
For dracut-squash such as RHEL kdump, this includes squashfs content.
Code is intentionally compatible with dash, so no bashisms.
Ubuntu initramfs has zdev persistent device configuration udev rules under
/lib/udev/rules.d/ (as opposed to /etc/udev/rules.d/).
Ubuntu initramfs stores configuration under /conf/.
Ubuntu kdump-tools have initrds under /var/lib/kdump/.
SLES auxiliary boot stage with grub2-s390x-emu has initrds under /boot/zipl/.
Dracut initramfs stores configuration under /etc/cmdline.d/ and /etc/conf.d/.
Dracut kdump have initrds under /boot/.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Converts zdev configuration into the syntax of the dracut cmdline option
rd.znet. Only znet options with non-default values are emitted. The result
string occurs on stdout. It represents one device-specification for the
given network interface name.
Example:
/lib/s390-tools/zdev-to-rd.znet persistent encbdf0
qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1
User:
https://github.com/rhinstaller/anaconda/pull/5250
to generate dracut cmdline entries such as
rd.znet=qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Useful for debugging (what happened during early boot).
Also useful for distro installers, which can import the early config into
their own environment early after starting:
chzdev --import /run/zdev.initrd.config --persistent --yes \
--no-root-update --force --verbose
After that, distro installers can modify/add the device config based
on interactive or unattended installation choices using
chzdev --enable --active --persistent ...
Finally, distro installers can likewise transfer the entire device config
to the installed system mounted under $SYSROOT:
chzdev --export /tmp/zdev.config --all --type --persistent --verbose
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add parsing of dracut cmdline option "rd.zfcp=..." at initrd runtime.
It delegates configuration to chzdev.
Implement `dracut --print-cmdline` and `dracut --hostonly-cmdline` for
initrd build time. Emit an rd.zfcp option for each zfcp-attached SCSI disk
in dracut's device dependency graph (to mount the root-fs, or to access the
kdump target).
This allows a distribution independent device configuration.
Configuration is consistent by using chzdev as backend.
It also prevents duplicate activations of the same device.
Along with the existing functionality of zdev/dracut, it makes the
following dracut modules superfluous:
https://github.com/dracutdevs/dracut/tree/master/modules.d/95zfcp
[rd.zfcp.conf is no longer needed and thus ignored here; the preceding
("zdev/dracut: fix marking hostonly files so delete option works")
makes rd.hostonly=0 work as a generic replacement]
https://github.com/dracutdevs/dracut/tree/master/modules.d/95zfcp_rules
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The existing code can already determine the required devices for the
actively running system, but this does not work for execution environments
in different (disaster recovery) sites.
Kdump likely does not notice when running in a different site and does not
re-generate the kdump initrd (because the kdump config itself does not
change).
The new code allows users to explicitly specify devices required for early
boot in initrd on different sites. Assuming this is a small number of
devices and could even overlap between the root-fs and the kdump case, do
not further distinguish those two sets of devices, but simply use the same
marker attribute "zdev:early=1" for both cases. With all this site
information available at the (initial) kdump initrd generation, the
resulting kdump initrd can work on any site without having to re-generate.
Complements commit 3c7adcc3c81d ("zdev: dracut: modifiy the
module-setup.sh").
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The existing code can already determine the required devices for the
actively running system. In case users would have a need to configure
additional devices for early boot in kdump initrd, import those devices
marked with "zdev:early=1" for completeness. Assuming this is a small
number of devices and could even overlap between the root-fs and the kdump
case, do not further distinguish those two sets of devices.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Additional debugging output can be generated with e.g. dracut option
"--stdlog 5" (or short -L5). It shows the chzdev export result, the output
of chzdev imports, and an overview of the resulting persistent config
within the initrd.
On systems, which default to using dracut option "--quiet", you might need
an additional "--verbose" to counter "--quiet" so -L5 has effect.
Typically combined with "--debug" to get a shell trace from building an
initrd (Note: --debug does not increase the log levels).
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Otherwise, dracut skips modules that are "not hostonly", i.e. not used /
loaded on the system when running dracut to build an initrd.
Without the fix, zdev device auto configuration only works for device
types for which a device driver happened to be loaded when building an
initrd. Likewise for specifying rd.* boot options.
Hostonly mode is often the default in Linux distributions.
Make zdev device auto configuration work nonetheless without users
having to know about and tweak dracut modes for initrd generation.
On the typical sloppy hostonly mode, the code disables hostonly for
installing kernel modules. This covers building regular initrds, where zdev
device auto configuration should even work for device types, for which
device drivers were not loaded when an initrd was generated. This can
happen when new devices of new types are configured for a DPM logical
partition. Also, users could want to start using dracut cmdline options
rd.{dasd,zfcp,znet} for a device type that was not used when the initrd was
built.
The special strict hostonly mode is used by some kdump implementations. In
that case, hostonly remains in effect intentionally because only support
for the really required devices as determined by dracut module 95zdev-kdump
should be included in a kdump initrd due to the memory-constrained kdump
environment. Cf. commit 73c46a3056 ("zdev/dracut: fix kdump by only
activating required devices"), which also provides more references on
strict hostonly mode. Even for non-kdump cases, let strict hostonly mode be
effective here in 95zdev in case some future use case appears for this
special mode beyond kdump.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
\fBdasdfmt\fR formats a DASD (ECKD) disk drive to prepare it
@@ -26,26 +26,26 @@ Any device node created by udev for kernel 2.6 can be used
.SHOPTIONS
.TP
\fB-h\fR or \fB--help\fR
\fB\-h\fR or \fB\-\-help\fR
Print usage and exit.
.TP
\fB-t\fR or \fB--test\fR
\fB\-t\fR or \fB\-\-test\fR
Disables any modification of the disk drive.
.br
\fBdasdfmt\fR just prints
out, what it \fBwould\fR do.
.TP
\fB-v\fR
\fB\-v\fR
Increases verbosity.
.TP
\fB-y\fR
\fB\-y\fR
Start formatting without further user-confirmation.
.TP
\fB--norecordzero\fR
\fB\-\-norecordzero\fR
Remove permission for subsystem to format write record zero.
.br
This is an expert option: Per default in recent dasd drivers, subsystems are
@@ -54,32 +54,32 @@ to remove this permission.
.br
.TP
\fB-L\fR or \fB--no_label\fR
\fB\-L\fR or \fB\-\-no_label\fR
Omit the writing of a disk label after formatting.
.br
This makes only sense for the 'ldl' disk layout.
.br
The '-L' option has to be specified after the '-d ldl' option.
The '\-L' option has to be specified after the '\-d ldl' option.
.br
e.g. dasdfmt -d ldl -L /dev/...
e.g. dasdfmt \-d ldl \-L /dev/...
.TP
\fB-V\fR or \fB--version\fR
\fB\-V\fR or \fB\-\-version\fR
Print version number and exit.
.TP
\fB-F\fR or \fB--force\fR
\fB\-F\fR or \fB\-\-force\fR
Formats the device without performing sanity checking.
.TP
\fB-C\fR or \fB--check_host_count\fR
\fB\-C\fR or \fB\-\-check_host_count\fR
Force dasdfmt to check the host access open count to ensure the device
is not online on another operating system instance
.TP
\fB-d\fR\fIlayout\fR or \fB--disk_layout\fR=\fIlayout\fR
\fB\-d\fR\fIlayout\fR or \fB\-\-disk_layout\fR=\fIlayout\fR
Formats the device with compatible disk layout or linux disk layout.
\fIlayout\fR is either \fIcdl\fR for the compatible disk layout
(default) or \fIldl\fR for the linux disk layout.
@@ -95,39 +95,39 @@ Do not use this option if you are using a 3270 console,
running in background or redirecting the output to a file.
.TP
\fB-P\fR or \fB--percentage\fR
\fB\-P\fR or \fB\-\-percentage\fR
Print one line for each formatted cylinder showing the number of the
cylinder and percentage of formatting process.
Intended to be used by higher level interfaces.
.TP
\fB-m\fR\fIstep\fR or \fB--hashmarks\fR=\fIstep\fR
\fB\-m\fR\fIstep\fR or \fB\-\-hashmarks\fR=\fIstep\fR
Print a hashmark every \fIstep\fR cylinders. The value \fIstep\fR has to be within range [1,1000], otherwise it will be set to the default, which is 10.
.br
You can use this option to see the progress of formatting in case you
are not able to use the progress bar option -p, e.g. with a 3270
are not able to use the progress bar option \-p, e.g. with a 3270
terminal.
.br
The value will be at least as big as the -r or --requestsize value.
The value will be at least as big as the \-r or \-\-requestsize value.
.br
.TP
\fB-M\fR\fImode\fR or \fB--mode\fR=\fImode\fR
\fB\-M\fR\fImode\fR or \fB\-\-mode\fR=\fImode\fR
Specify the \fImode\fR to be used to format the device. Valid modes are:
.RS
.IPfull
Format the entire disk with the specified blocksize. (default)
.IPquick
Format the first two tracks and write label and partition information. Use this
option only if you are sure that the target DASD already contains a regular
format with the specified blocksize. A blocksize can optionally be specified
using \fB-b\fR (\fB--blocksize\fR).
Format the first two tracks and write label and partition information.
.br
For thin-provisioned DASD ESE volumes, quick is the default mode. A full space
release then precedes the formatting step. If this space release fails, dasdfmt
falls back to a full-format mode. Formatting stops if the space release fails
and quick mode was specified explicitly using \fB-M\fR. Specify the
\fB--no-discard\fR option to omit the space release.
Use this option for DASD ESE volumes to take the benefits of thin provisioning.
In this case, a full space release precedes the formatting step. If this space
release fails, then the formatting also fails. Specify the \fB\-\-no\-discard\fR
option to omit the space release.
.br
For non-ESE volumes use this option only if you are sure that the target DASD
already contains a regular format with the specified blocksize. A blocksize can
optionally be specified using \fB\-b\fR (\fB\-\-blocksize\fR).
.IPexpand
Format all unformatted tracks at the end of the target DASD. This mode assumes
@@ -135,20 +135,20 @@ that tracks at the beginning of the DASD volume have already been correctly
formatted, while a consecutive set of tracks at the end are unformatted. You can
use this mode to make added space available for Linux use after dynamically
increasing the size of a DASD volume. A blocksize can optionally be specified
using \fB-b\fR (\fB--blocksize\fR).
using \fB\-b\fR (\fB\-\-blocksize\fR).
.RE
.TP
\fB--check\fR
\fB\-\-check\fR
Perform a complete format check on a DASD volume. A blocksize can be specified
with \fB-b\fR (\fB--blocksize\fR).
with \fB\-b\fR (\fB\-\-blocksize\fR).
.TP
\fB--no-discard\fR
\fB\-\-no\-discard\fR
Omit a full space release when formatting a thin-provisioned DASD ESE volume.
.TP
\fB-r\fR\fIcylindercount\fR or \fB--requestsize\fR=\fIcylindercount\fR
\fB\-r\fR\fIcylindercount\fR or \fB\-\-requestsize\fR=\fIcylindercount\fR
Number of cylinders to be processed in one formatting step.
The value must be an integer in the range 1 - 255.
.br
@@ -158,19 +158,19 @@ devices, counting the base device and all alias devices.
.br
.TP
\fB-b\fR\fIblksize\fR or \fB--blocksize\fR=\fIblksize\fR
\fB\-b\fR\fIblksize\fR or \fB\-\-blocksize\fR=\fIblksize\fR
Specify blocksize to be used. \fIblksize\fR must be a positive integer
and always be a power of two. The recommended blocksize is 4096 bytes.
.TP
\fB-l\fR\fIvolser\fR or \fB--label\fR=\fIvolser\fR
\fB\-l\fR\fIvolser\fR or \fB\-\-label\fR=\fIvolser\fR
Specify the volume serial number or volume identifier to be written
to disk after formatting. If no label is specified, a sensible default
is used. \fIvolser\fR is interpreted as ASCII string and is automatically
converted to uppercase and then to EBCDIC.
.br
e.g. -l LNX001 or --label=DASD01
e.g. \-l LNX001 or \-\-label=DASD01
.br
The \fIvolser\fR identifies by serial number the volume. A volume serial
@@ -192,11 +192,11 @@ NOTE: Try to avoid using special characters in the volume serial. This may cause
In case you really have to use special characters, make sure you are using quotes. In addition there is a special handling for the '$' sign. Please specify it using '\\$' if necessary.
.br
e.g. -l 'a@b\\$c#' to get A@B$C#
e.g. \-l 'a@b\\$c#' to get A@B$C#
.br
.TP
\fB-k\fR or \fB--keep_volser\fR
\fB\-k\fR or \fB\-\-keep_volser\fR
Keeps the Volume Serial Number when writing the Volume Label. This is useful if
the volume already has a Serial Number that should not be overwritten.
_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
