The audit directory ts-shell configuration and also the output of
getpwuid() are considered tainted when running in Perl taint (-T) mode.
Provide untaint checks with validating the content.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The updateConfiguration() function updates and checks the ts-shell
configuration for each line in the ts-shell configuration file.
Run the checks just once after the configuration is completely read.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a configuration setting to allow administrators to specify
path to the iucvconn binary as part of the ts-shell configuration.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Perl provides a Taint (-T) mode which tracks data that is obtained
by external means (e.g. arguments, reading file contents, environment
variables, ...)
Introduce a first set of corrections to clear and validate data
obtained from external sources.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Do not obtain the pager program through the PAGER environment
variable. Instead, introduce a configuration setting to specify
the pager program as part of the ts-shell configuration.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When ts-shell creates the authorization for current user, the
user name and group names are interpreted as regex. This might
create additional authorizations which are not permitted for
current user.
Correct this behavior by quoting the user name in the regex.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check the return code of fcntl() calls to ensure the close-on-exec
setting succeeded. Otherwise, the PTY and server file descriptors
would become available to the forked client process.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
iucvtty expects to receive the TERM environment information right
after a connection has been established. Reading this information
can lead to a connection stall (DoS). Introduce a temporary timeout
and fall back to the default TERM environment.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The iucvtty_read_msg() now receives the entire message header.
Perform message header checks for specific message types where the
payload length is clearly defined. Also this needs to be done prior
starting the message chunk processing because the message datalen
field will be adjusted based on the read chunks.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The inclusion of termio.h leads to the following compilation error:
CC iucvterm/tests/test_functions.o
test_functions.c:16:10: fatal error: termio.h: No such file or directory
16 | #include <termio.h>
| ^~~~~~~~~~
The termio ioctl interface has been obsolete for a very long time and
was replaced by termios. termio.h was still present for compatibility
but was removed with glibc 2.42.
iucvterm uses termios.h correctly in the tool. The test however not only
includes termio.h erroneously, it doesn't even require it. Remove the
inclusion of termio.h.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If iucvtty_read_data() receives message data and reads less than
MSG_DATA_OFFSET, out-of-bound reads will happen.
Correct and improve the receiving path by always reading the entire
message header. Also improve the "residual" message data handling by
replacing and processing every message now as chunk.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The PTY slave file descriptor is the controlling terminal
allocated for the child process. When all file descriptors
are being closed, a SIGHUP is triggered for the child process.
Keeping the file descriptor in the parent open would prevent
the SIGHUP to be delivered to the child process.
For proper SIGHUP processing, close the file descriptor in
the parent process.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve handling of TERM environment processing by validating
the received terminal name. If the terminal name is not valid,
a message will be displayed and the default terminal will be used.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Explicitly unmount the root partition on unit stopping to prevent still
mounted boot partition on switch root which results in boot being unable
to be mounted after switch root.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since this unit cannot have a dependency on the actual needed
dev-disk-by2xdlabel-boot.device unit because it might not exist if the
label is never set but this unit has to run after it when it does exist
wait for udev-settle which creates the symlink if it does exist.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update osasnmpd to support Object ID Sub-IDs with length up-to and
including 10 digits, in line with SNMP specification. While at it, also
replace sprintf() calls with snprintf(). Together, these changes
contribute to better memory safety.
Suggested-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Hidayath Khan <hidayath@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
These messages indicate verification failures and are therefore reported
as errors rather than debug output. Unfortunately,
X509StoreContext::init(...) expects the callback to return an OpenSSL
ErrorStack, so it's not possible to propagate these failures through our
own error hierarchy.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Enforce root CA organization name requirements during certificate chain
validation to prevent accepting certificates from unexpected root CAs.
Add RootCaVerification enum with RootCaOrganizationPinning and
SkipPinning variants. Extend verify_chain() to validate root CA
organization. Default to pinning "DigiCert" for standard trust chains,
skip pinning when custom root CA is provided.
Assisted-by: IBM Bob:1.0.6
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The command line length value is not properly checked and limited to the
documented 1024 bytes, even though a MAX_CMD_LEN is already defined but
not used.
With this, an overflow of the static char mon_record[] buffer is possible
in read_cmdline(), corrupting adjacent .bss data. The data is sanitized to
printable ASCII bytes, but in theory a crash of the mon_procd daemon could
be possible.
Fix it by adding a check and truncation similar to the other restricted
fields like e.g. ruser_len or cmd_len.
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The yes_no() function was leaking memory when returning
early from the loop, as the 'answer' buffer allocated by
getline() was not freed before the return statements.
Restructure the function to use a single exit point, ensuring
free(answer) is always called before returning.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
sort_bls_entries() already checks for the keyword "title"
duplication. Add also checks for keywords "linux", "initrd", and
"options" duplication (Rule #5).
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check decimal prefixes, representing site values in on-disk
environment block. Reject any values different from {0, ..., 9}
as invalid ones.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before extracting a file trailer, check that the file is big enough;
Check that signature length stored in the extracted trailer doesn't
exceed the size of the file without the trailer. Treat the case of
the failed checks as unsigned file.
Without the checks, memcmp() may read the area before the allocated
@buffer, dumping heap into bootmap or crashing.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When parsing environment block, check each its line for the
compliance with the 'foo=bar\n' pattern. In case of missing '=',
or '\n' abort the parsing procedure with a warning message.
Without this check, stage3 may write a zero byte to the absolute
address 0 (robustness defect)
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When parsing environment block, limit the number of the hash table
entries, so that total size of all records doesn't exceed PAGE_SIZE
bytes allocated for that hash table.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
By design, before replacement of '${FOO}' with its value, the
procedure checks that the resulted command line doesn't exceed the
maximum one.
The old check used the never updated length of the original command
line, which is incorrect. Instead, use its current length resulting
from the replacement happened at the previous iteration.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
mem_init_flex() allocates the page header index array sized for
ADDR_TO_IDX(mem_end) + 1 entries, but never checked that each
page record's address falls within [0, mem_end).
A crafted LKCD page record with addr >= mem_end writes 8 bytes
beyond the allocation.
Fix by rejecting any page record whose address is > mem_end - PAGE_SIZE
with ERR_EXIT(), immediately after the end-of-dump marker check.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
read_page_buf() uses the file-controlled pg_hdr->size directly as the
byte count for zg_read() into fixed stack buffers of PAGE_SIZE.
A crafted LKCD dump with pg_hdr->size > PAGE_SIZE overflows the buffer
and smashes the stack frame. A size of 0 for a raw page silently
produces uninitialised data.
Enforce page header size constraints following crash-utility's logic:
- Compressed or Raw pages with size > PAGE_SIZE are invalid;
exit with an error.
- Raw pages with size 0 contain no data in the file; fill the
output buffer with zeros without reading.
- Compressed pages with size 0 are caught by the uncompress() return
code check.
- Raw pages with size != PAGE_SIZE are invalid; exit with an error.
Check the return code of uncompress() and exit with an error if
decompression fails, rather than silently proceeding with an incomplete
output buffer.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Declare binary data symbols as arrays to correctly represent
linker-provided symbols of unknown size. This resolves compiler warnings
about reading 22-24 bytes from a 1-byte region when including stage*
loaders.
DEBUG: In function ‘memcpy’,
DEBUG: inlined from ‘boot_init_eckd_ldl_stage0’ at boot.c:181:2,
DEBUG: inlined from ‘install_svdump_eckd_ldl’ at install.c:891:2,
DEBUG: inlined from ‘install_dump’ at install.c:1221:9,
DEBUG: inlined from ‘main’ at zipl.c:185:9:
DEBUG: /usr/include/bits/string_fortified.h:29:10: warning: ‘__builtin_memcpy’ reading 22 bytes from a region of size 1 [-Wstringop-overread]
DEBUG: 29 | return __builtin___memcpy_chk (__dest, __src, __len,
DEBUG: | ^
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Ensure that the path to a dump image specified in the NGDump meta file
of a dump device points to a valid location within the dump device.
Especially, disallow escaping from a dump device with a dump image path
using references to '..' or symbolic links pointing outside of the dump
device.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace the popen() call to the external tool sha256sum with OpenSSL's
SHA256 digest algorithm to compute the checksum of a dump image
to improve security of NGDump.
The call to popen() is inherently insecure because a malicious user
controlling a dump device could manipulate the latter and let the user
applying zgetdump to the dump device execute arbitrary shell code.
Furthermore, getting rid of process and shell spawning performed by
popen() shall improve performance of calculation of dump image
checksums.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the file descriptor opened in zg_open() before to obtain information
about the file. Theoretically, there is a tiny window for a race
condition between opening a file and obtaining its information with
stat(). A malicious user could use it to entice incorrect behavior
from zgetdump. Using the same file descriptor for both operations
prevents such situations.
Suggested-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The name of a private NGDump function does not require to have a unique
prefix to avoid naming conflicts with public functions of other C modules.
Furthermore, be consistent with private NGDump functions not having
the prefix 'ngdump_'.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
dfo_elf_init() allocates the output ELF header buffer based on
HDR_BASE_SIZE, per-CPU note sizes, and per-memory-chunk overhead,
but does not account for the vmcoreinfo note. notes_init() then
writes the full vmcoreinfo string into the buffer via nt_vmcoreinfo(),
overflowing the heap allocation for any dump with a vmcoreinfo blob
larger than what fits in HDR_BASE_SIZE. The following ABORT check
fires after the heap was already corrupted.
Fix by extracting the allocation size calculation into a new
hdr_alloc_size() function that explicitly accounts for all items
written into the header buffer.
Remove the opaque HDR_BASE_SIZE and HDR_PER_MEMC_SIZE macros.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
vmcoreinfo_item() copies a key's value string from the vmcoreinfo heap
blob into the caller's buffer using memcpy() without checking the source
length. The length is derived from the distance between the '=' separator
and the next '\n' (or '\0') in the blob, which is bounded only by the
total vmcoreinfo size. A crafted dump with a vmcoreinfo value >= 1024
bytes would overflow the buffer.
Additionally, the len parameter of vmcoreinfo_item() was declared UNUSED
and never checked.
Fix by computing val_len before the copy and returning -1 if val_len >= len.
Change len type from int to size_t, which is natural for a buffer size,
drops the need for a negativity guard, and makes the call site passing
sizeof(str) type-consistent.
Write directly into the caller's buf, instead of going through the
intermediate str[].
Replace two strchr() calls with a single strchrnul().
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 16-bit sec5_len field from the ADSR record was used directly as
the byte count for zg_read() and ebc_2_asc() into a pair of 1024-byte
stack buffers. A crafted VMDUMP file with sec5_len > 1024 would
overflow both buffers and write past the stack frame.
The overflow is only reachable when zgetdump is invoked with the -V
(verbose) flag, but that is a common diagnostic usage.
Section 5 contains a human-readable dump symptom string used only for
display purposes. Truncate sec5_len to sizeof(buf) - 1 so that
oversized values are silently clamped rather than causing an abort,
and the symptom string is still printed up to the buffer limit.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Building with ASAN=1 produces the following warning:
utils.c: In function 'sysfs_get_mkvps':
utils.c:416:9: warning: writing 8 bytes into a region of size 0
[-Wstringop-overflow=]
416 | memcpy(mk_reg->mkvp, &mkvp, sizeof(mkvp));
| ^
In file included from utils.c:32:
utils.h:51:17: note: at offset 4 into destination object 'mk_state'
of size 4
51 | int mk_state;
This is a false positive, field mk_reg->mkvp is defined as an array of
u8 with a length of 16 elements, thus it is 16 bytes in size, and thus
more than long enough to copy 8 bytes into it.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the BER encoded BITRSTRING field has a zero length, then skipping
the unused-bits byte that a BITRSTING normally contains will cause a
underflow and thus may cause an out of bounds read by the caller of
sk_ep11_parse_spki().
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check for the size of struct cca_rsa_pub_key_section, instead of
struct cca_ec_pub_key_section.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When EVP_PKEY_get0_EC_KEY(), EC_KEY_set_ex_data(), EVP_PKEY_get0_RSA()
or RSA_set_ex_data() fails, the function returns -EIO without freeing
the data struct or the data->key_blob that were allocated before.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Field spki_size is defined as size_t, so it can never be negative.
Before the check, sk_ep11_valid_ep11_blob() ensures that hdr->len is
never greater than key_token_length, so the subtraction can never
overflow the result, but it still can be zero.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For long-length field encoding, check if the number of length bytes
exceed the data size.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A malformed CCA key token with a zero size section can cause an endless
loop in sk_cca_get_pka_section().
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Array element key_value_structure.public_exponent[0] is written twice,
but key_value_structure.public_exponent[1] is not set, leading to a
wrong public exponent value (i.e. 0x01) in the key value structure.
CCA key generation will fail is this case.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Functions SK_CCA_generate_ec_key_pair(), SK_CCA_generate_ec_key_pair(),
SK_EP11_generate_ec_key_pair() and SK_EP11_generate_rsa_key_pair() are
supposed to allow parameter key_token to be NULL. In this case the
required buffer size is returned in key_token_length only.
This size query does not work because the parameter checking rejects
the call with a NULL key_token returning -EINVAL.
Currently the size query is not used by any known caller, but lets
correct it anyway.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The party info contained in the response might be of an arbitrary size.
Check for an overflow before allocating the party info buffer for the
combined request and response party info data. With a very large
response party info size, the combined size might overflow (i.e. wrap
around), causing a too small buffer being allocated and the following
memcpy's would cause an out of bounds write.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On large data sizes the calculation may cause an overflow, if done with
int type. Do the calculation with size_t instead to avoid an overflow.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the error checking to check the correct variables using the right
conditions.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Don't attempt to free the local function parameter 'signature', but the
memory where *signature points to.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function strtoull() silently accepts a leading '-' and returns a large
positive number (two's complement wrap). Reject this by checking for
the minus character.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function gmtime() might return NULL which would then be passed to
strftime(). Return an error in case gmtime() return NULL.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A deeply nested or pathologically large KMIP node tree crafted by a
malicious server can wrap the length calculation around to a small
value. Detect this and return an error in this case.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Functions kmip_node_get_structure_element_count() and
kmip_node_get_structure_element_by_tag_count() return an unsigned int,
but the error case returns -1. This leads to a wrap around actually
returning 0xffffffff which the caller might interpret as a very large
number of elements.
Return 0 in case of an error instead.
Also fix some callers to not unconditionally subtract -1 from the
returned value, but return an error if the returned value is zero.
These callers check the preconditions upfront, so the error case
won't be hit anyway.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Limit the value_len to not be larger than INT_MAX, because later on
BIO_read() is called with value_len and it uses the int type for
length parameter and return value.
This check also prevents the 'value_len + 1' from overflow, because
value_len is a size_t and this accepts larger values than int (even
on 32 bit architectures).
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When decoding a value that is exactly at the boundary of the available size
(i.e., *size == value_len), and the value length is not a multiple of the
TTLV block length, then *size wraps to a huge value when the pad_len is
subtracted.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If length is >= 0x80000000 (2 GB), length * 2 wraps around to a small
value, calloc allocates a too small buffer, then the loop writes
length * 2 bytes into it causing a heap buffer overflow.
Fix this by using a size_t for size calculation, and also checking
the length before multiplication (needed on 32 bit platforms).
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In C, operands of '<<' are subject to integer promotion. So the unsigned
char array elements are promoted to signed int and then shifted producing
signed overflow — undefined behaviour in C.
Fix this by first casting to uint32_t and then shift.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
KMIP STRUCTURE elements can be nested, which causes a recursion of
functions kmip_decode_ttlv(), kmip_decode_xml(), and kmip_decode_json().
A malformed KMIP response may thus cause stack exhaustion.
Limit the KMIP STRUCTURE nesting level to 32 levels. This is more than
enough for currently defined KMIP responses. The practically used
nesting level is 8 or 9, dependent on the type of KMIP response.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When creating or writing files, make sure that the file is not a
sysmlink. Such files created by libkmipclient are typically stored inside
the zkey repository and the owner and mode of them are changed to.
allow read/write for the owner user and the 'zkeyadm' group. It
would allow a symlink-following attack if the file being created are
symlinks. Make sure to open such files with the 'O_NOFOLLOW' flag.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When creating or writing files, make sure that the file is not a
sysmlink. Such files created by libekmfweb are typically stored inside
the zkey repository and the owner and mode of them are changed to.
allow read/write for the owner user and the 'zkeyadm' group. It
would allow a symlink-following attack if the file being created are
symlinks. Make sure to open such files with the 'O_NOFOLLOW' flag.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When creating or writing files, make sure that the file is not a
sysmlink. Such files created by libseckey are typically stored inside
the zkey repository and the owner and mode of them are changed to.
allow read/write for the owner user and the 'zkeyadm' group. It
would allow a symlink-following attack if the file being created are
symlinks. Make sure to open such files with the 'O_NOFOLLOW' flag.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Files in the zkey repository can be created by any member of the
'zkeyadm' group as well as 'root'. Such files are owned by the creator
and the 'zkeyadm' group, and allow read and write for the owner user
and owner group.
When creating or writing files inside the zkey repository, make sure
that the file is not a sysmlink. That way, only files within the zkey
repository are set to be read/write for the owner user and members of
the 'zkeyadm' group. Make sure to open such files with the 'O_NOFOLLOW'
flag, and use 'lstat()' to check for files and directories.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check the values that are incorporated into commands that might get
executed to not contain any characters that could be used for
shell-injection attacks.
Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Pin the supported filesystem type to ext4 to prevent the risk of auto fs
parsing bugs. Additionally mount the boot partition with more
restrictive options.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the sel-ebc-pvebc.service unit to execute the failure action when
the sics directory does not exist instead of getting skipped.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Return an error when the provided request data is smaller than the
expected request length. The previous condition used the wrong
comparison, which could lead to an out-of-bounds slice and panic.
Add a regression test.
Fixes: 34bef977e8 ("rust/pv: User-data signing and verifying")
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Perform certificate verification in two stages. First, verify the
certificate chain without CRL checks. Once the chain has been validated,
download the referenced CRLs and repeat the verification with CRL
checking enabled.
Fixes: c6f621d0dc ("rust: Add library for pv tools")
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
3-second timeout might be too short for slow networks therefore increase
it to 10s. In addition move this constant to a more prominent position
and add documentation.
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a dedicated HKD verification error for CRL downloads that exceed the
maximum file size of 10 MiB and cover the max_filesize behavior in the
helper tests and add tests for it.
This commit adds a new development/test dependency as it verifies that
the correct messages are being logged.
Fixes: c6f621d0dc ("rust: Add library for pv tools")
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adapt the script to generate the test certificates to use the prefix
'http://' for the CRL distribution points as otherwise the test would
fail with an upcoming change. Regenerate the certificates and adapt the
test case dist_points' accordingly as the distribution point has
changed.
Note: The files der.crt and der.crl are skipped as that would result in
binary changes which caues trouble with quilt. They are only used
by some basic tests read_crls and read_crts anyway
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix datetime.datetime.utcnow() deprecation and fix a TypeError.
File "create_certs.py", line 16, in createEcKeyPair
return ec.generate_private_key(curve=curve, backend=default_backend())
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: curve must be an EllipticCurve instance
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace the existing mocks with a trait-based test infrastructure. This
allows testing download_first_crl_from_x509() functionally while
avoiding actual network access, resulting in more comprehensive and
realistic test coverage.
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rename the module to the more common test module name tests and remove a
superfluous comment.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use a trait-based abstraction for CRL downloads so the download
implementation can be replaced more easily, for example in tests that
should avoid real network calls.
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The comment mentions certificate but it's a certificate revocation
list (CRL). In addition, use 1200 bytes as vector capacity as the
comment says 1200.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although most errors are ignored and the next CRL distribution point is
tried, log the errors as debug messages.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
strip_right() strips spaces beginning at the end of the string moving
to the beginning. However, it doesn't check whether it's at beginning
of the array, and would continue reading if the string only contains
spaces.
Fix this by adding the necessary check.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While iterating over the string, hmcdrv_path_copy() subtracts one byte
of the length to account for the NUL byte, but fails to account for
the '/' character it might add. Change the test to leave two bytes of
room.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add/use ->set_location() private method of struct component_footer
instead of checking component types every time when operating with
program components.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix add_component_file_range() to process components of all types
(not only of COMPONENT_TYPE_LOAD), similar to how it is going in
add_component_buffer().
Earlier components of COMPONENT_TYPE_SIGNATURE were processed only
by add_component_buffer(). Starting from 60bc1e3, signatures for
mirrors (i.e. base disks of #1 and larger ID) are processed also by
the function add_component_file_range(), which works incorrectly for
such type of components.
Fixes: 60bc1e38d0 ("zipl/src: Reuse data of buffer components in bootmap")
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Calculate the alignment value as maximum of physical block sizes of
disks participating in the mirrored setup. Earlier the alignment was
calculated as a physical block size of the first disk of a mirrored
setup.
Without this change, the assertion in disk_get_blocklist_from_file()
'assert(reg->offset % info->phy_block_size == 0)' is triggered in case
when blocksize of base disk #J > blocksize of base disk #I && (J>I).
To reproduce the problem, build a mixed mirrored setup with first SCSI
disk, second DASD disk and prepare it for IPL.
Fixes: 731f00202c ("zipl/src: Enable heterogeneous mirrors support")
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Change the format of zipl helpers output to support hybrid mirrors
(i.e. composed of disks of different types and geometry).
The new format imposes an additional requirement that any key-value
pair "targetbase=X:Y" titles a new section with a set of target
parmeters for the base disk identified by that pair.
Without this change, zipl reports "Inconsistent script output".
To reproduce the problem, build a mixed mirrored setup with first
SCSI disk and second DASD disk, and prepare it for IPL.
Fixes: 731f00202c ("zipl/src: Enable heterogeneous mirrors support")
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The test cases uses the ml_kem functions, therefore disable the
directive for tests.
$ cargo test
...
--> pv/src/openssl_extensions/ml_kem.rs:5:11
|
5 | #![expect(unused)]
| ^^^^^^
|
= note: `#[warn(unfulfilled_lint_expectations)]` on by default
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
After a master key change, it can happen that the PKEY_KBLOB2PROTK3 ioctl
returns EBUSY. This is a temporary situation and the operation will
succeed, once the firmware has completed some internal processing related
with the master key change. Delay 1 second and retry up to 10 times.
A similar retry loop was previously used for the AF_ALG-based handling,
but the retry logic was not included for the new ioctl-based handling.
Fixes: 7fffdcfe8c ("zkey: Remove the use of AF_ALG for calculating key verification patterns")
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move check_disk() call before user input to fail fast
on unsupported or unavailable devices (FBA, read-only,
in-use, raw-track mode).
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a HostKey enum (currently V1(PKey<Public>)) and introduce a
versioned Keyslot enum (V1(KeyslotV1)). Rename the existing Keyslot type
to KeyslotV1 to prepare for future format extensions.
Update pv, pvattest, pvimg, and pvsecret to use the new enums.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a Display implementation for SymKey that formats values as
`SymKey(<type>)`, delegating to key_type(). This provides a clearer
and stable human-readable representation for logs and CLI output.
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Return the Secure Execution header version in addition to tags. This
comes handy as soon as multiple Secure Execution header versions are
supported.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Split req.rs into multiple files so that additions can be done more
easily.
Assisted-by: IBM Bob:1.0.4
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add interfaces for creating an ML-KEM keypair and encapsulation and
decapsulation.
The public part of it can be used to encapsulate a shared secret in a
ciphertext. The latter can be decapsulated with the private part of the
keypair to recover the shared secret.
In terms of code, a keypair of type `PKey<Private>` can be generated
with `generate_ml_kem` specifying `KeyType::ML_KEM_512`,
`KeyType::ML_KEM_768`, or `KeyType::ML_KEM_1024`.
To encapsulate a shared secret, generate a `PkeyCtx<Public>` with
`PkeyCtx::new`, initialize it with `encapsulate_init`, and encapsulate
with `encapsulate_to_vec`.
To decapsulate the ciphertext to the shared secret, generate a
`PkeyCtx<Private>` with `PkeyCtx::new`, initialize it with
`decapsulate_init`, and decapsulate with `decapsulate_to_vec`.
Note that when https://github.com/rust-openssl/rust-openssl/pull/2532
is getting merged into `rust-openssl`, these changes will become
unnecessary.
Assisted-by: IBM Bob:1.0.4
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add more CCK tests to make sure that new changes do not introduce a
regression.
Assisted-by: IBM Bob:1.0.4
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function dinfo_get_uid_from_devnode() allocates memory for
readbuf but fails to free it in two code paths:
1. When the device name is truncated (error path)
2. At the successful function exit
Add the missing free(readbuf) calls to prevent memory leaks in
both paths.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Refactor the firmware verification client such that adding a new
request/response versions is simpler.
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When an unnamed counter is explicitly selected by numeric ID via
--counters (for example, --counters=218), show it even when --hide is
enabled.
Keep --hide effective for unnamed counters that were not explicitly
selected. To do that, evaluate the counter filter once per counter and
reuse the result to distinguish between a generic match and an explicit
numeric-ID match.
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce verbosity levels of zipl session and verbosity classes of
messages. This is used by the next patches in the series to suppress
information not corresponding the default output of zipl tool that
could be confusing for user.
Add a new option "--debug" of zipl tool to set up verbosity level 2
(and higher) of zipl session.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although the script is to be run with root privileges virt-resize starts
as user qemu under the hood which depending on image location may cause
permission errors. To fix this use `LIBGUESTFS_BACKEND=direct`.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Remove useless type conversion in uvdevice.rs
- Replace useless comparison in hostname.rs
- Replace unnecessary unwrap patterns in pvapconfig
- Use sort_by_key instead of sort_by in pvimg example
Command line used to get the findings:
$ clippy --all-features -- --cap-lints=warn
warning: useless conversion to the same type: `u64`
--> pv_core/src/uvdevice.rs:56:28
|
56 | rc = ioctl(raw_fd, cmd.try_into().unwrap(), cb.as_ptr_mut());
| ^^^^^^^^^^^^^^
|
= help: consider removing `.try_into()`
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion
= note: `#[warn(clippy::useless_conversion)]` on by default
warning: this comparison involving the minimum or maximum element for this type contains a case that is always true or always false
--> utils/src/hostname.rs:60:13
|
60 | assert!(isize::try_from(buf_len).unwrap() <= isize::MAX);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= help: because `isize::MAX` is the maximum value for this type, this comparison is always true
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#absurd_extreme_comparisons
= note: `#[warn(clippy::absurd_extreme_comparisons)]` on by default
warning: `utils` (lib) generated 1 warning
Checking pvebc v0.12.0 (/home/mhartmay/git/s390-tools/rust/pvebc)
warning: consider using `sort_unstable_by_key`
--> pvapconfig/src/ap.rs:177:9
|
177 | self.0.sort_unstable_by(|a, b| b.gen.cmp(&a.gen));
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_sort_by
= note: `#[warn(clippy::unnecessary_sort_by)]` on by default
help: try
|
177 - self.0.sort_unstable_by(|a, b| b.gen.cmp(&a.gen));
177 + self.0.sort_unstable_by_key(|b| std::cmp::Reverse(b.gen));
warning: called `unwrap_err` on `r` after checking its variant with `is_err`
--> pvapconfig/src/main.rs:55:29
|
54 | if $r.is_err() {
| -------------- help: try: `if let Err(<item>) = r`
55 | eprintln!("{}", $r.unwrap_err());
| ^^^^^^^^^^^^^^^
...
87 | on_error_print_and_exit!(r);
| --------------------------- in this macro invocation
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_unwrap
= note: this warning originates in the macro `on_error_print_and_exit` (in Nightly builds, run with -Z macro-backtrace for more info)
warning: this `repeat().take()` can be written more concisely
--> pvimg/src/se_img_comps/bootloader/ipl.rs:95:21
|
95 | let comps = iter::repeat(ipl_pb0_pv_comp::default())
| _____________________^
96 | | .take(num_comp)
| |___________________________^ help: consider using `repeat_n()` instead: `std::iter::repeat_n(ipl_pb0_pv_comp::default(), num_comp)`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_repeat_n
= note: `#[warn(clippy::manual_repeat_n)]` on by default
warning: this `repeat().take()` can be written more concisely
--> pvimg/src/se_img_comps/bootloader/ipl.rs:113:21
|
113 | let comps = iter::repeat(comp).take(num_comp).collect();
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: consider using `repeat_n()` instead: `std::iter::repeat_n(comp, num_comp)`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_repeat_n
Reviewed-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The current code is easier to read as the suggested fix by Clippy.
Therefore adding directives to allow the unwrap.
warning: called `unwrap` on `a1.info` after checking its variant with `is_some`
--> pvapconfig/src/ap.rs:195:36
|
192 | && a1.info.is_some()
| ----------------- the check is happening here
...
195 | let i1 = match a1.info.as_ref().unwrap() {
| ^^^^^^^^^^^^^^^^^^^^^^^^^
|
= help: try using `match`
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_unwrap
= note: `#[warn(clippy::unnecessary_unwrap)]` on by default
warning: called `unwrap` on `a2.info` after checking its variant with `is_some`
--> pvapconfig/src/ap.rs:199:36
|
193 | && a2.info.is_some()
| ----------------- the check is happening here
...
199 | let i2 = match a2.info.as_ref().unwrap() {
| ^^^^^^^^^^^^^^^^^^^^^^^^^
|
= help: try using `match`
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_unwrap
Suggested-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
$ cargo doc
...
warning: unclosed HTML tag `u8`
--> pvebc/src/ebc_utils.rs:25:43
|
25 | /// Read all data from a reader into a Vec<u8>
| ^^^^
|
= note: `#[warn(rustdoc::invalid_html_tags)]` on by default
help: try marking as source code
|
25 | /// Read all data from a reader into a `Vec<u8>`
| + +
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'paes' and 'phmac' kernel ciphers and the respective kernel modules
are no longer used for calculating the key verification pattern. Instead,
the 'pkey' kernel module and its sub modules is used now.
In case the 'pkey' kernel module is not available, an appropriate error
message is already printed by open_pkey_device() when opening the device.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Instead of using AF_ALG to calculate key verification patterns, transform
the key blob into a protected key and calculate the key verification
patterns with CAPCF calls.
The 'zkey-cryptsetup convert' command also calculates key verification
patterns from clear keys. Support this, too.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To be able to calculate the key verification pattern of a key blob without
the use of AF_ALG, the file descriptor of the /dev/pkey device needs to
be passed through to all functions that might need to calculate the key
verification pattern.
Also make sure that all commands that might need to calculate the key
verification pattern have 'need_pkey_device = 1' so that the device is
opened.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To be able to calculate the key verification pattern of a key blob without
the use of AF_ALG, the key blob needs to be transformed into a protected
key via the PKEY_KBLOB2PROTK3 ioctl.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When reading a properties file with a line containing a binary zero as first
character, an array access at index -1 is attempted, because strlen considers
this as an empty string (len = 0). The following array access 'line[len - 1]'
accesses the array at index -1.
Fix this by checking the line length and skip empty lines.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix a copy & paste error on handling the 'hmac(sha512)' integrity algorithm
with the 'convert' command.
Fixes: 97136585da ("zkey-cryptsetup: Support PHMAC integrity with convert command")
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Key files read by read_secure_key() may not be just a key blob, but it
might also contain an additional integrity key blob.
Correct the upper bounds checking and allow up to 3 key blobs to be read.
This allows for an AES-XTS key blob consisting of 2 key blobs plus an
integrity key blob concatenated to the encryption key blob.
Fixes: 771c794580 ("zkey-cryptsetup: Support PHMAC integrity with setkey command")
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix compile warnings like
warning: assignment discards 'const' qualifier from pointer target type
[-Wdiscarded-qualifiers]
by declaring the variables as const.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix compile warnings like
warning: assignment discards 'const' qualifier from pointer target type
[-Wdiscarded-qualifiers]
by declaring the variables as const.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix compile warnings like
warning: assignment discards 'const' qualifier from pointer target type
[-Wdiscarded-qualifiers]
by declaring the variables as const or cast appropriately.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix compile warnings like
warning: assignment discards 'const' qualifier from pointer target type
[-Wdiscarded-qualifiers]
by declaring the variables as const or cast appropriately.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The previous function, EVP_PKEY_meth_remove(), was deprecated in OpenSSL
3.0 and fully removed in OpenSSL 4.0. As a result, it fails detection of
OpenSSL 1.1+ if OpenSSL 4 is present.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/204
[seiden@linux.ibm.com: Add link to GH PR]
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For consistency reasons implement the --version option handling for the new
pvics tool.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/203
[seiden@linux.ibm.com: Add link to GH PR]
Signed-off-by: Dan Horák <dan@danny.cz>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Bump MSRV to 1.85.0 and upgrade all dependencies using 'cargo upgrade'
from cargo-edit. The bump to 1.85.0 is requiered to get at least openssl
version 0.10.79 including fixes for a couple security issues.
Link: https://crates.io/crates/cargo-edit
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This lint also covers dependencies that generate code i.e. derives.
Those dependencies might introduce non-ascii chars deliberately as e.g.
zerocopy 0.8.32+ does.
Remove it to avoid any confusing warnings regarding non-ascii chars.
Link: https://github.com/rust-lang/rust/issues/151025
[hoeppner@linux.ibm.com: Add link to reported issue]
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+ Sort and group the imports
+ Normalize and format comments (100 characters width)
Command used:
$ cargo +nightly fmt --
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With glibc 2.43 const-ness is preserved for standard library functions
and a compiler warning will be issued if this is violated.
pai parse_cpulist() receives user input via the parm function
parameter. The parameter is defined as 'const char *' and used as input
value for strchr(). The target pointer (cp) is defined as mutable
'char *' leading to violation of const correctness and this compiler
warning:
pai.c: In function ‘parse_cpulist’:
pai.c:907:20: warning: assignment discards ‘const’ qualifier from
pointer target type [-Wdiscarded-qualifiers]
907 | cp = strchr(parm, ':');
Since the user input is coming from optarg 'non-const char *', it is
unnecessary to have the function parameters carrying this data defined
as const.
Remove the unnecessary const definition in the function call chain to
fix the described issue.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Suggested-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Suggested-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Speed up the check of the option -m argument and improve
the error message. The argument number must be a power of 2 number
and this check is improved.
Furthermore split the error message and provide one message for
invalid characters and one error message for the argument
not being a power of 2 number.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Suggested-by: Eduard Stefes <eddy@linux.ibm.com>
Suggested-by: Juergen Christ <jchrist@linux.ibm.com>
Tested-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add functions to properly parse required and optional input/output
parameters that have to be combined into one.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
All pvattest subcommands use the command line option -i <input> and -o
<output> to specify file input and output respectively. pvsecret however
uses mostly positional arguments for <input> and <output> exclusively,
e.g. pvattest check input.bin output.yaml
$ pvsecret add secret.bin
This provides an inconsistent user interface within the Secure
Execution tools and may confuse users.
Add the -i and -o option to the subcommands if applicable.
Input/output can then be specified like so:
$ pvsecret add -i secret.bin
$ pvsecret list -o list.yaml
$ pvsecret verify -i FILE -o out.yaml
$ pvsecret retrieve -i ID -o id.yaml
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Most pvattest subcommands use the command line option -i <input> and -o
<output> to specify file input and output respectively. pvattest check
however only uses positional arguments for <input> and <output>, e.g.
$ pvattest check input.bin output.yaml
This provides an inconsistent user interface within the tool and may
confuse users.
Add the command -i and -o option to the check subcommand to bring it in
line with the rest of the tool.
$ pvattest check -i input.bin -o output.yaml
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Show -i & -o option and display them in the help output. Showing the
additional options to the user may provide a better experience. Users
may expect -i /-o options as other subcommands have them as well.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The error texts printed a hardcoded .0 instead of the actual value.
Fix this by using the proper string format arguments.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Fixes: 61c5d7d431 ("rust/pv: Attestation generation and verification support")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For guests that do not make use of the EBC feature the boot should not
be impacted by this module. This requires removing the boot.mount unit
because it will unconditionally create a dependency on a unit that
conflicts with that idea. The downside is that mounting of the boot
partition has to be done manually.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/202
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Include the required kernel modules unconditionally when this module is
installed into an initramfs.
The new .conf file contains a list of kernel modules that are loaded by
the systemd-modules-load.service systemd unit.
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set job->data.dump.no_compress (job->data.mvdump.force) only after
making sure that the job is 'dump' ('mvdump') respectively. Othrewise,
the second assignment can potentially corrupt the value that was set by
the first assignment.
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pvics (PV Image Customization Support) is a comprehensive tool for
converting existing qcow2 KVM guest images to IBM Secure Execution for
Linux (SEL) images with Early Boot Customization (EBC) support and
encrypted root filesystems.
The tool provides four main actions:
- list: Retrieve information about boot loader entries in a base image
- convert: Convert a base image to an EBC-ready SEL image
- encrypt: Encrypt the root filesystem and prepare EBC resources
- full: Perform both conversion and encryption in one operation
Assisted-by: IBM Bob:1.0.1
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add 95ibm-sel-ebc dracut module for secure boot-time customization of
SEL guests.
Introduce the IBM SEL EBC dracut module (95ibm-sel-ebc) that enables
Early Boot Customization for SEL guests during the initramfs phase.
The module implements a critical security architecture to prevent
injection attacks: all EBC resources (.asr and .pol files) are copied from
/boot/sics (which resides in the qcow2 image on the host filesystem) to
/run/ibm-sel-ebc (a tmpfs/RAM-backed directory). Since guest RAM is
protected by the Ultravisor, this prevents malicious hosts from modifying
EBC resources during boot.
Systemd units and their purposes:
- ibm-sel-ebc.target: Groups all EBC-related units
- boot.mount: Mounts /dev/disk/by-label/boot to /boot
- ibm-sel-ebc-ensure-sics.service: Fallback to create /boot/sics/ if boot
partition mount fails (supports Kata VM scenarios)
- ibm-sel-ebc-pvebc.service: Main unit that copies EBC resources to RAM,
invokes pvebc tool to verify integrity and add ASRs to UV, retrieves
LUKS passphrase from UV secret store
- ibm-sel-ebc-override-crypttab.service: Replaces /etc/crypttab with
prepared IBM SEL EBC crypttab, reloads systemd daemon, starts cryptsetup
service
- ibm-sel-ebc-paes-enforce.service: Verifies root filesystem uses PAES
encryption to prevent root filesystem substitution attacks
All units write logs to /boot/sics/log for debugging, accessible even if
root filesystem fails to mount. Units are triggered by rd.ibm-sel-ebc
kernel parameter and only execute in initramfs
(ConditionPathExists=/etc/initrd-release).
Assisted-by: IBM Bob:1.0.1
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add pvebc tool for parsing and verifying EBC Add-Secret-Request structures
Introduce pvebc, a CLI tool that parses and verifies the integrity of
Add-Secret-Request (ASR) structures used in Early Boot Customization for
SEL guests.
The tool processes an integrity-protected ASR structure consisting of:
- toc.asr: Meta secret that links to toc.pol via relative filepath and
SHA512 hash, integrity-protected by its AES GCM authentication tag
- toc.pol: Policy file containing AES GCM authentication tags (last 16
bytes) of all user-provided ASRs
- User ASRs: Individual Add-Secret-Requests containing encrypted secrets
This structure guarantees:
- Prevents ASR removal: toc.pol lists all expected ASR authentication tags
- Prevents ASR insertion: Unlisted ASRs are rejected
- Prevents ASR modification: AES GCM authentication tags provide
cryptographic integrity
- Prevents toc.pol tampering: toc.asr's integrity protection secures the
link
The tool verifies completeness by checking that all ASRs listed in toc.pol
are present and their AES GCM authentication tags match. This prevents
attackers from removing, inserting, or modifying ASRs during transport over
unsecured channels.
After verification, pvebc adds all ASRs to the Ultravisor (UV), which
decrypts them using the guest's secret key and makes them available to
the guest during early boot.
Assisted-by: IBM Bob:1.0.1
Acked-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add two new command-line options to pvsecret create for Early Boot
Customization (EBC) Table of Contents (TOC) support:
1. --policy FILE
Links an Add-Secret-Request (ASR) to a policy file by embedding a
PolicyReference in the ASR's user data field. The PolicyReference
contains the relative file path and SHA512 hash of the policy file,
enabling integrity verification of the policy. This option conflicts
with --user-data as both use the same user data field in the ASR
structure.
2. --toc-policy FILE
Appends the AES-GCM authentication tag (MAC tag - last 16 bytes of
the encrypted ASR) to the specified TOC policy file. This enables
the TOC policy to maintain a list of all ASR MAC tags for
completeness verification during boot. The TOC can verify that all
expected ASRs are present and unmodified by checking their MAC tags
against this list. This option also conflicts with --user-data.
Both options support the EBC multi-party workflow where an ISV/CSP builds
a generic SEL image and customers customize it with their own secrets. The
TOC mechanism ensures the integrity and completeness of all EBC resources
during the boot process.
Assisted-by: IBM Bob:1.0.1
Acked-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add EBC (Early Boot Customization) utility functions to pv_core library
for parsing and verifying Add-Secret-Request structures.
Introduce the core library functionality needed for EBC:
- Add ebc_utils module to pv_core with ASR parsing and verification
- Export ebc_utils in pv_core lib.rs
- Re-export ebc_utils in pv lib.rs for downstream consumers
- Update pvsecret Cargo.toml dependencies
The library provides the foundation for tools that work with
integrity-protected ASR structures used in SEL guest customization.
Assisted-by: IBM Bob:1.0.1
Acked-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_fmt now provides support for JSON Lines text format. Adapt certain
checks in the code and document the newly supported format in the man
page accordingly.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_fmt now provides support for JSON Lines text format.
Document the newly supported format in the man page accordingly.
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_fmt now provides support for JSON Lines text format.
Document the newly supported format in the man page accordingly.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_fmt now provides support for JSON Lines text format. Adapt certain
checks in the code and document the newly supported format in the man
page accordingly.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_fmt now provides support for JSON Lines text format. Adapt certain
checks in the code and document the newly supported format in the man
pages for lshwc and lspai accordingly.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_fmt now provides support for JSON Lines text format. Adapt certain
checks in the code and document the newly supported format in the man
page accordingly.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
JSON Lines text format (JSONL) [1] is a line-delimited JSON format where
objects are separated by the new line character (\n, LF) as opposed to
the JSON Sequence text format (json-seq) where JSON text is encapsulated
in an ASCII Record Separator (0x1E, RS) and ASCII Line Feed character
(0x0A, LF).
Whilst JSONL is also used for data streaming, this simpler format is
better suited for logging and works also well with traditional
line-oriented Unix tooling (e.g. grep or sed).
Add this format to util_fmt so that users have more choice and control
over formats that are required for their usecases.
Add helper functions that let the user determine whether a given format
type is JSON in general or a JSON streaming format (such as json-seq or
jsonl).
For better readability and more clarity use the helper function
util_fmt_is_json_stream() where the same decision is made for both
JSON streaming formats FMT_JSONSEQ and FMT_JSONL.
[1] https://jsonlines.org/
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Sending signal SIGINT/SIGTERM to a running pai process causes immediate
termination of that running process. This usually interrupts a
select() system call waiting for more input to read from the installed
events and its mapped memory buffers. As there is no signal handler
installed, a SIGINT or SIGTERM signal simply terminates the process,
sometimes leaving incomplete recorded output file paicryto.XXX
(where XXX is the CPU number).
Install a signal handler to intercept signal SIGINT or SIGTERM and run
one more data collection loop to read out pending data and close all
recording output files properly.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The associated type bound for Iterator::Item was unsatisfied for Self.
Fix this by requiring Sized for IntoEnumIterator.
Fixes: 1d2a89b387 ("pvimg: Improve the readability of Display output for control flags")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If pvsecret {add, list, retrieve} is executed with options on a non-s390
system the user gets misleading error messages as the options are not
defined.
> pvsecret add -i secret.bin
error: unexpected argument '-i' found
This may lead the user to think wrong arguments where chosen, which is
not entirely true as they are valid on s390. The more helpful error
message would be
error: Command only available on s390x
Which is already the case if no arguments are given.
Solve this by allowing non-s390 systems to parse the options:
> pvsecret add -i secret.bin
error: Command only available on s390x
Reported-by: Carlo Della Giusta <carlo.dellagiusta@suse.com>
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If pvattest perform is executed with options on a non-s390 system the
user gets misleading error messages as the options are not defined.
> pvattest perform -i attestation_request.bin -o attresp.bin
error: unexpected argument '-i' found
This may lead the user to think wrong arguments where chosen, which is
not entirely true as they are valid on s390. The more helpful error
message would be
error: Command only available on s390x
Which is already the case if no arguments are given.
Solve this by allowing non-s390 systems to parse the options:
> pvattest perform -i attestation_request.bin -o attresp.bin
error: Command only available on s390x
While at it ignore some unused code warnings in the exchange format code
that appear on non-s390 systems as not all code is used.
Reported-by: Carlo Della Giusta <carlo.dellagiusta@suse.com>
Fixes: 16610a211f ("rust: pvattest-Rust")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Force the autocompletion script generator to always write to a new
empty file, thus preventing the potential corruption of script contents.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Szabina Korbai <szkorbai@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With OpenSSL 4.0.0 function SSL_set1_host() is deprecated and should be
replaced by SSL_set1_ipaddr() and SSL_set1_dnsname().
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With OpenSSL 4.0.0 function X509_NAME_get_entry() returns a const pointer.
Make the local variable also const to avoid compile warnings like:
warning: assignment discards ‘const’ qualifier from pointer target type
[-Wdiscarded-qualifiers]
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With OpenSSL 4.0.0 function X509_NAME_get_entry() returns a const pointer.
Make the local variable also const to avoid compile warnings like:
warning: assignment discards ‘const’ qualifier from pointer target type
[-Wdiscarded-qualifiers]
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With OpenSSL 4.0.0 function X509_cmp_current_time() is deprecated and
should be replaced by X509_check_certificate_times().
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Generating and then including C source files from another C file can
lead to unexpected compilation errors in certain environments.
Switch the usage text generation from %_usage.c to %_usage.h. The
generated header provides the usage_text definition directly, and
chzdev.c and lszdev.c include the corresponding *_usage.h instead.
Update depfile prerequisites and the clean target to match the new
generated artifacts.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Consolidate the duplicated sed command sequences used to generate
*_usage.c files into a shared CSTR_SED definition and a single pattern
rule:
%_usage.c: %_usage.txt
This removes the copy/pasted rules for chzdev_usage.c and lszdev_usage.c
and keeps the Makefile easier to maintain.
Also drop the explicit chzdev.o/lszdev.o prerequisites on the generated
sources as dependencies are already tracked via the .*.o.d depfiles.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove the uname()/sscanf()-based kernel version gate (Linux < 2.6),
which is long obsolete and does not belong in user-space argument
validation.
While touching the code, replace the repeated warnx() + exit(1) pattern
with errx(EXIT_FAILURE, ...) in the option sanity checks to reduce
boilerplate and keep error paths consistent.
Behaviour is unchanged for supported environments; the version gate is
dropped because it is obsolete.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Use __packed instead of __attribute__ ((packed))
- Rename EBCtoASC to ebc_to_asc following naming conventions
- Consolidate multi-line error message into single line
No functional changes.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Normalize the man page source to UTF-8/US-ASCII and remove a mojibake
artifact that could not be represented cleanly.
Documentation only, no functional changes.
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Future updates might change the outcome of the resulting scripts and the
comments describing the script output would need to be updated every
time as well. It's not worth the effort.
Remove the comments that list script examples from the functions
generate_bash_autocomp() and generate_zsh_autocomp().
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For Bash, when compspecs are found the generated script is returned as
the full set of possible completions and default completions are
disabled [1]. This leads to the behaviour that command line arguments
are not completed, only options defined by the script.
Zsh has the same issue.
Fix the issue by always adding the bash defaults to the generated
script. For zsh the corresponding file completion is always added to the
end of the argument list and the -A "*" option is added to allow
completion after positional arguments.
[1] https://www.gnu.org/software/bash/manual/html_node/Programmable-Completion.html#Programmable-Completion-1
Fixes: 638cbbe332 ("libutil: Implement zsh and bash autocompletion")
Reported-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Szabina Korbai <szkorbai@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Apply coding style changes by reducing line breaks for a more compactly
generated script and add double quotes to fix ShellCheck findings.
Furthermore, remove the unused variable previous_word and use mapfile to
read the output of compgen into the COMPREPLY array to avoid unwanted
splitting and glob expansion.
Reviewed-by: Szabina Korbai <szkorbai@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When installing IPL on mirrored targets, zipl builds multiple program
tables (one such table per each mirror). If the option "--add-files"
was specified, then zipl uses the in-bootmap files, that was written
at the prevoius iteration (for the mirror ID #0) to build program
tables for mirrors with ID #1 (and larger). The in-bootmap files
already don't contain trailers. Despite this, the building process
cuts off the tail of trailer size, which results in corrupted boot
data.
This bug may result in crashing the kernel when booting from mirrors
with ID #1 (and larger) and manifests only if the boot components are
signed and the option "--add-files" is specified for the installation
session.
Don't count the trailer, when building program tables using in-bootmap
files written at the previous iteration.
Fixes: 431e4542ca ("zipl/src: Reuse data of file components in bootmap")
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New trace tags "sysuas*" added in kernel to trace zfcp sysfs unit add
store events.
Print the trace events under HBA with new record ID 6. The fields under
this tag are WWPN, FCP LUN and return value of the device having issues.
Example zfcpdbf output for unit add store events:
Timestamp : 2026-02-02-10:50:02:474983
Area : HBA
Subarea : 00
Level : 4
Exception : -
CPU ID : 0003
Caller : 0x000001d89a86bd0e
Record ID : 6
Tag : sysuas2
Description : sysuas2 HBA, Sysfs unit add store failure, unit add failed
Request ID : 0x00000000ffffffff
Request status : 0xffffffff
FSF cmnd : 0xffffffff
FSF sequence no: 0xffffffff
WWPN : 0x500507680b26c449
LUN : 0x01d0000000000000
Return Value : 0xfffffff4
Timestamp : 2026-02-02-10:50:02:475037
Area : HBA
Subarea : 00
Level : 4
Exception : -
CPU ID : 0003
Caller : 0x000001d89a86bd0e
Record ID : 6
Tag : sysuas2
Description : sysuas2 HBA, Sysfs unit add store failure, unit add failed
Request ID : 0x00000000ffffffff
Request status : 0xffffffff
FSF cmnd : 0xffffffff
FSF sequence no: 0xffffffff
WWPN : 0x500507680b26c449
LUN : 0x01d1000000000000
Return Value : 0xfffffff4
Signed-off-by: Chinmaya Kajagar <chinmayk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The stage3 linker script places .sb.trailer so that it must end at
COMMAND_LINE_EXTRA. The current script derives the start address from
SIZEOF(.sb.trailer) before the section is emitted:
. = COMMAND_LINE_EXTRA - SIZEOF(.sb.trailer);
With binutils older than 2.39 before commit 648f6099d4dc ("-z relro
relaxation and ld script SIZEOF") this can result in .sb.trailer being
placed at COMMAND_LINE_EXTRA instead, moving the trailer into the
following area and breaking the expected layout.
The trailer has a fixed size, so use an explicit constant for the
placement calculation and keep the ASSERT to verify the final section
size. This makes the placement deterministic again.
Fixes: a1126352ec ("zipl/boot: Improve linker scripts")
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improvements for lszcrypt and chzcrypt:
* lszcrypt -b and lszcrypt -d now check for default domain
available and gives a warning if the current default domain
is not in the usage_domain_mask of the AP bus.
* lszcrypt without any further device also checks for the
default domain and emits a warning string if the default
domain is not available.
* chzcrypt --default-domain emits a warning if the newly
set default domain is not enabled in the usage_domain_mask
of the AP bus.
Suggested-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The blkiomon warnings "bad trace magic 0" and "blkiomon: bad trace" are
benign startup artifacts caused by early pipeline reads before blktrace
produces a complete record. These messages do not affect processing and
valid reports are still generated. Filter them out so only real errors
trigger failures.
Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>
Reviewed-by: Nihar Panda <niharp@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Hyptop should be able to accept abbreviations of the long command line
options as getopt() is able to match them. Ex;
$ hyptop --batch-mode
$ hyptop --batch
$ hyptop --bat
From getopt(3) man page:
"""
Long option names may be abbreviated if the abbreviation is unique
or is an exact match for some defined option.
"""
After the introduction of commit c5695e43c4 ("hyptop/opts: Replace long
option formats for consistency") long command line options for hyptop
received additional definitions to support dash separated option formats.
Unfortunately these definitions were defined as new and unique options
and caused an ambiguity for getopt() when abbreviations matched both
definitions. Ex;
$ hyptop --batch
hyptop: option '--batch' is ambiguous;
possibilities: '--batch-mode' '--batch_mode'
Map both long option formats to the same short option to fix the
issue and restore the functionality.
Fixes: c5695e43c4 ("hyptop/opts: Replace long option formats for consistency")
Reported-by: Gorkem Kilinc <kilinc@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Hyptop's "--sort_field" command line option has always been documented
as "--sort", while the code _only_ explicitly has "--sort_field".
Specifying the shorter "--sort" happened to work due to an unnoticed
getopt() behavior.
From getopt(3) man page:
"""
Long option names may be abbreviated if the abbreviation is unique
or is an exact match for some defined option.
"""
With the addition of "--sort-field" as another unique identifier via
commit c5695e43c4 ("hyptop/opts: Replace long option formats for
consistency") "--sort" is no longer unique. getopt() won't be able to
use that as an abbreviation, since there is ambiguity between
"--sort_field" and new "--sort-field" as they are defined as separate
options.
Replace "--sort-field" and "--sort_field" with plain "--sort" to adhere
to the documented hyptop command line argument specification and resolve
the broken behavior.
Fixes: c5695e43c4 ("hyptop/opts: Replace long option formats for consistency")
Reported-by: Gorkem Kilinc <kilinc@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
An empty device list is not an error case, if `lszcrypt` is called
without a specific device list or device filter. Return with rc == 0 in
such cases.
Remove the message about the empty device list on stderr.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Kernel support for LCS devices was removed with commit 6cccb3bb0561
("s390/net: Remove LCS driver") in kernel v6.15. Remove the associated
lsznet support for the lcs device type.
Reviewed-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
znetcontrolunits provided two arrays and a search function that were
only used by lsznet. Since lsznet has it's own implementation of this
function now and the CU array was a duplicate of CU_TCPIP anyway, remove
znetcontrolunits as it serves no purpose.
Reviewed-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lsznet sources znetcontrolunits to use search_cu() and set the variable
cu_idx. lsznet's own function search_cu_tcpip() is doing the same thing
as search_cu() without setting cu_idx.
Declare and move cu_idx to the global variable CU_IDX and consolidate
the functions by letting search_cu_tcpip() set CU_IDX. Call
search_cu_tcpip() instead of search_cu() and replace cu_idx with CU_IDX
accordingly. search_cu() is removed and the CU_DEVDRV array is moved to
lsznet.
Reviewed-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With SECURE_BOOT_DISABLED always set in add_dump_program() no signature
entries for a dump kernel are written. This might lead to security
violation error from the IPL Loader on the systems with secure boot support
on the attempt to boot the dump kernel:
MLOLOA6269321F A security violation error was encountered when loading from device <device>
MLOLOA62693212 Audit: No signed components found for program 0 loaded from device <device>
Propagate '--secure' zipl option to add_dump_program() in order to sign
relevant components upon dump program installation and thus support
secure boot execution for List-directed dump kernels.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Kernel support for LCS devices was removed with commit 6cccb3bb0561
("s390/net: Remove LCS driver") in kernel v6.15. Remove the associated
zdev support for the lcs device type.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The Virtual Tape Server (VTS) only supports 3490 tape devices. Remove
all other older device types from the man pages.
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Data compaction is only supported by 3490 tape devices. For Virtual Tape
Server (VTS) this is the only supported device. Reading device
characteristics and checking the type is unnecessary.
Remove the corresponding code and simply enable data compaction.
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Load Display (LDD) X'9F' is still accepted by the Virtual Tape Server
(VTS) but does not perform any action. Remove code that still uses this
command in tape2dump.c.
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There is only one supported tape device type left. A filter command line
option doesn't make any sense anymore.
Remove the functionality and documentation of the --type option.
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The device models 3480 and 3590 are no longer supported by the tape
device driver. Remove them from the device list
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The tape390_display tool was used to send text to the display of tape
storage server. The corresponding command is still accepted by the
Virtual Tape Server (VTS) but no action is performed. The tool is
useless, remove it.
The tape390_crypt tool was used to manage encryption for tape devices.
However, only 3590/3592 models did support encryption. Support for these
models is removed from the Kernel as there is no support for these tape
models in general anymore. The tool is not required anymore, remove it.
Note: VTS uses encryption transparantly for its virtualized 3490 models.
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The magic number used in the dump header for all stage2 dumps (including
tape dump) is DF_S390_MAGIC_EXT since commit ff475d9c7d0a ("zipl: Extend
DASD stand-alone dumpers to drop zero pages").
Adjust dfi_s390tape code accordingly.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add documentation for the JSON structure outputted by 'pvimg info
--format=json ...'.
Created with assistance from IBM Bob AI.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new '--print-schema <FORMAT>' option to the 'pvimg info' command
that prints the schema, if available, describing the given output
format. For example, 'pvimg info --print-schema json' prints the JSON
schema for the 'pvimg info' command output.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add '--show-secrets' flag to 'pvimg info' to make secret output explicit
and avoid accidental disclosure.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Auto-detect default format for 'pvimg info' command. If stdout is a
terminal, use 'text', otherwise 'json'.
Adapt the tests accordingly.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add human-readable output format to 'pvimg info' command. The format
'text:normal' shows only basic information about the Secure Execution
header, but skips the keys and other binary data; the format 'text:full'
shows everything.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The Display implementation should produce human-readable output. Convert
the flags into a descriptive flag list to improve readability.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the s390-tools JSON meta data for the JSON output of 'pvimg info' to
make the JSON output more stable and to provide an stable API.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce S390ToolsMetaData struct, it can be used to generate the
s390-tools specific JSON metadata.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve error messages for errors when reading the SE header protection
key or when the decryption/verification of the SE header has failed.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add two JSON output variants: pretty and minify. The desired variant can
be selected via '--format json:pretty' and '--format json:minify'. Using
'--format json' without a variant defaults to pretty.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a warning to notify the user when the Secure Execution (SE) header
is present but its integrity and authenticity has not been verified.
This makes the lack of validation explicit and helps avoid unintended
use of untrusted data.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve the documentation of flags and secured components.
Created with assistance from IBM Bob AI.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update pvattest and pvsecret mapnages and README.md, as for example the
'pvsecret create update-cck' was not documented.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev uses util_readlink() now and there are no users left
for misc_readlink() anymore. Remove it.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Avoid code duplication and inconsistent error handling by replacing
readlink() with util_readlink(), which is used project-wide to
standardize readlink() usage.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Avoid code duplication and inconsistent error handling by replacing
readlink() with util_readlink(), which is used project-wide to
standardize readlink() usage.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Avoid code duplication and inconsistent error handling by replacing
readlink() with util_readlink(), which is used project-wide to
standardize readlink() usage.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Avoid code duplication and inconsistent error handling by replacing
readlink() with util_readlink(), which is used project-wide to
standardize readlink() usage.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Avoid code duplication and inconsistent error handling by replacing
readlink() with util_readlink(), which is used project-wide to
standardize readlink() usage.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace the readlink() branch with readlinkat() and normalize
parameters: use AT_FDCWD with filename when relname is NULL. This
removes duplicate code paths while preserving behavior, including the
growth loop and size limits. readlinkat() is a superset of readlink().
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce util_readlinkat() to read symbolic links relative to a
directory file descriptor, and util_readlink() as a convenience wrapper
using AT_FDCWD.
util_readlink() delegates to util_readlinkat() instead of duplicating
logic, ensuring a single implementation for both interfaces.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Convert comment encoding from ISO-8859-1 to UTF-8 to avoid encoding
mismatches and simplify future maintenance.
Align the libvtoc comments with the change introduced in the kernel
by commit 8f2bc80c6ef8 ("s390: ebcdic: convert comments to UTF-8").
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add util_startswith to util_str to check if a string starts with the
given prefix and returns a pointer to the rest of the string,
or NULL if it does not.
Signed-off-by: Wisdom Erhimwionsobo <werh29@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chreipl passes additional boot parameters via the firmware scp_data
sysfs attribute. This mechanism is shared by multiple re-IPL types (FCP,
NVMe, and ECKD) and they all have the same scp_data size limit. The
BOOTPARMS_FCP_MAX name is therefore misleading.
Rename BOOTPARMS_FCP_MAX to BOOTPARMS_SCPDATA_MAX and update all callers
to make the intent clear and avoid implying this limit is FCP-only.
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chreipl accepts --bootparms for list-directed IPL, but for ECKD re-IPL the
value was never committed to sysfs, so the requested boot parameters did
not take effect.
Write the boot parameters to the firmware scp_data attribute when
configuring an ECKD re-IPL target. Also validate that the ECKD re-IPL
sysfs interface exists and enforce the maximum supported boot parameter
length up front.
Fixes: 7c24855ba1 ("ipl_tools: add support for list-directed IPL from ECKD DASD")
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some environments do not expose the /sys/firmware/reipl/*/clear attribute
(e.g. z/VM guests without "Load Normal" support). lsreipl currently tries to
read the attribute unconditionally for ECKD re-IPL and emits a confusing
"Could not read file .../clear" error when it is missing.
Re-IPL type: eckd
Device: 0.0.6d74
bootprog: 0
br_chr: auto
Bootparm: ""
Loadparm: ""
Could not read file /sys/firmware/reipl/eckd/clear: No such file or directory
clear: (null)
Secure boot: 0
Only print the "clear" field when the corresponding sysfs attribute is
present, avoiding the spurious error output.
Fixes: 7c24855ba1 ("ipl_tools: add support for list-directed IPL from ECKD DASD")
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
stage3 still contains a legacy fallback path that transfers control to
the new kernel via LPSW 0 when diag 0x308 is not available.
The current start_kernel() inline asm issues "diag %[code],%[code],0x308"
without enforcing the required even/odd register pairing for the first
operand. With recent distro toolchains (e.g. GCC 15.x as shipped by Fedora
43 and Ubuntu 25.10), register allocation picks an odd register for the
first diag operand in start_kernel(), which triggers a specification
exception. That exception is then caught by the program-check handler
and stage3 silently takes the fallback, booting the kernel via LPSW 0
instead of performing diag308 LOAD_NORMAL_RESET.
All supported environments are expected to provide diag308, and the rest
of the code already relies on it. Drop start_kernel() and the obsolete
LPSW fallback and always reset into the new kernel via the properly
coded diag308() helper. Mark start() as __noreturn.
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
warning: unresolved link to `GuestSecret::retrievable`
--> pv/src/uvsecret/guest_secret.rs:56:37
|
56 | /// Create Retrievables using [`GuestSecret::retrievable`]
| ^^^^^^^^^^^^^^^^^^^^^^^^ the enum `GuestSecret` has no variant or associated item named `retrievable`
|
= note: `#[warn(rustdoc::broken_intra_doc_links)]` on by default
warning: unresolved link to `GuestSecret::RetrievableKey::name`
--> pv/src/uvsecret/guest_secret.rs:63:30
|
63 | /// SHA256 hash of [`GuestSecret::RetrievableKey::name`]
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the enum `GuestSecret` has no variant or associated item named `RetrievableKey`
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
CoreOS uses VARIANT_ID instead of a unique ID in /etc/os-release.
Extend distro detection to identify RHCOS, other CoreOS variants
may be added later if needed.
RHCOS is showing in HMC as RHEL, because `system_level' is:
```
[core@cosa-devsh ~]$ cat /sys/firmware/cpi/system_level
0x010906023a050e00
```
But should be:
```
[core@cosa-devsh ~]$ cat /sys/firmware/cpi/system_level
0x070906023a050e00
```
Issue: https://jsw.ibm.com/browse/OCPVIP-1471
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/199
Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix incorrect handling of tape devices leading to inability of
creating dumps on them.
Make the check for tape device go first, to not miss it on irrelevant
errors
Reported-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the subchannel type read from sysfs does not match the requested
type, the allocated path is not freed before continuing to the next
loop iteration. This causes a memory leak as reported by valgrind.
Free the path before continuing.
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
At present, the hsci tool creates HiperSockets Converged Interface
(HSCI) with MTU of 1500 bytes regardless of the values of MTU for the
external and HiperSockets interface from which it is formed. This can
degrade performance or worse, affect network connectivity through the
converged interface.
Update the tool to automatically set MTU of HSCI as the lower of the
MTU values of external and HiperSockets interface.
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce the new state 'unauthorized' to the three already existing
states disabled, enabled, and unsupported to CPU-MF counters.
CPU-MF counters are only available on LPARs.
The intent is to differentiate whether a system simply does not support
the CPU-MF counters like a z/VM guest or if they are supported like on
LPAR but have to be authorized via HMC/SE.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a new command line flag ("--format") to specify the output
format. Valid options are "pairs" for shell-compatible key
value pairs, "csv" for CSV, "json" for a formatted JSON document, and
"json-seq" for a stream of JSON text sequences as per RFC7464[1].
[1]: https://datatracker.ietf.org/doc/html/rfc7464
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Change the default firmware hash verification to its final location.
For the old one, there is a redirection in place for the foreseeable
future.
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Acked-by: Brendon Drew <bdrew@us.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The sysfs field 'depth' for AP queues now shows the real depth
and not the depth -1 as it is reported by the TAPQ instruction.
lszcrypt did under the hood already this +1 but now this increment
is done by the kernel and thus not needed in lszcrypt any more.
Suggested-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The structure perf_event_attr sometimes gets new members appended
at the end of the structure. Then the size of the structure increases.
This may lead to the situation where sizeof(struct perf_event_attr)
calculated at the pai program compile time during s390-tools build
differs from the one used to build application programs on the target
system.
The report files written by various tools write the contents of the
perf_event_attr structure followed by indivual samples to a binary file.
The second member perf_event_attr::size contains the size of that
structure in bytes.
Use that perf_event_attr::size from the target system to scan the
report files given as command line argument. This ensure the correct
size of structure perf_event_attr is used.
Output before:
Current situation: The pai program uses a perf_event_attr structure
which contains 8 bytes less than the one used on the target system.
The first sample header (8 bytes) then actually refers to the last
eight bytes of structure perf_event_attr, which are all zeroes. This
is an invalid sample entry and the program terminates with error.
# pai -r -V painnpa.0004043; echo $?
painnpa.0004043 size:1344
[0x000088] type 0 misc 0 size 0
1
Output after:
Use the correct size of structure perf_event_attr, which was read
from be binary file, written by the tools compiled on the target system:
# pai -r -V painnpa.0004043; echo $?
painnpa.0004043 size:1344
size perf_event_attr mismatch 136/144
[0x000090] type 9 misc 1 size 58 0x13537f71715 18 event 6144 \
sample pid 4043/4043 15:0x8a,16:0x88,22:0x112,25:0xc0
...
0
Also show an debug message when verbose mode is turned on.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
According to the valgrind man-page, "the behaviour of realloc() with a
size of zero is implementation defined in C17 and undefined in C23."
The current glibc implementation frees the specified buffer, returns
NULL and doesn't set errno. While this behavior is unlikely to change
in the near future, code relying on it may not be compatible with other
libc implementations. Also this realloc() use is flagged as an error in
valgrind runs, making valgrind output less usable.
Fix this by explicitly adding code to cover the realloc(buffer, 0) case
in util_realloc(). Also change libutil users of realloc() to use
util_realloc() instead.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add mkfs.ext4 to zipl dependency list. It is required to prepare
a NGDump dump partition.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add kernel module phmac_s390 to the initramfs hook and dracut config file
to ensure that the PHMAC cipher is available during early boot, in case
the root disk is integrity protected via PHMAC.
Also load phmac_s390 via modules-load.d to ensure that the PHMAC ciphers
are available.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the convert command also checks the integrity key part of the
volume key, and then uses the secure integrity key, and sets the
verification pattern to the verification-pattern token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the reencipher command also reenciphers the integrity key part
of the volume key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the setkey command also checks the integrity key part of the
volume key, and then sets the key into a new key slot, and sets the
verification pattern to the verification-pattern token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the setvp command also adds the verification pattern of the
integrity key into the token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then also validate the integrity key and print its validation
status.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the verification-pattern token as well as the reencipher-token
contain the verification pattern of the integrity key as well.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use 'u8 *' instead of 'char *' for pointers to key blobs everywhere.
This saves a lot of casts.
The libcryptsetup API still uses 'char *' as pointer type for volume keys,
so a few casts are required when passing those pointers to libcryptsetup
API functions.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The commands 'zkey cryptsetup' generates commands for formatting and
opening volumes of type PLAIN and LUKS2.
For LUKS2, if there exists an HMAC key that is associated to the same
volume as the AES key, generate a 'cryptsetup luksFormat' command for
combined encryption and integrity protection. This uses the '--integrity'
and '--integrity-key-size' options of the 'cryptsetup luksFormat'
command to specify the integrity settings.
The volume key specified with '--master-key-file' must contain the
encryption key and the integrity key concatenated to each other. The
size of the volume key specified with '--key-size' however must be the
size of the encryption key only, in bits. The 'cryptsetup luksFormat'
command will internally read the whole file, use the first part as
encryption key, and the second part as integrity key. The size of the
second part must be specified with the '--integrity-key-size'.
Note: This requires 'wrapped integrity key' support in the cryptsetup
package, as well as in the dm-crypt kernel module.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The commands 'zkey integritytab' generates /etc/integritytab entries for
volumes of type INTEGRITY.
The 'zkey integritysetup' generates integritysetup commands for formatting
and opening volumes of type INTEGRITY.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The commands 'zkey crypttab' and 'zkey cryptsetup' should only operate on
AES-type keys, but not on HMAC keys.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
You can only set a sector size for an HMAC key of a volume of type
INTEGTRITY. For combined integrity protection with encryption, the
sector size of a LUKS2 volume must be set on the AES key, but can
not be set on the HMAC key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For combined integrity protected with encryption, a LUKS2 volume can be
associated to exactly one AES type key and also to exactly one HMAC type
key.
For other volume types, a volume can only be associated to exactly one
key, either an AES type key, or an HMAC type key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although HMAC keys can be associated to volumes of type 'LUKS2', the dummy
passphrase can only be set to AES-type keys, i.e. to keys that encrypt the
volume.
Reject trying to set a dummy passphrase for an HMAC key with a volume type
of 'LUKS2'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Keys of type PVSECRET-HMAC can be associated to volumes of volume type
'INTEGTRITY' or 'LUKS2'.
Volumes of type 'INTEGTRITY' are set up for standalone dm-integrity via
the 'integritysetup' tool. Volumes of type 'LUKS2' are setup for combined
encryption and integrity using the 'cryptsetup' tool using the integrity
option.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Similar as for AES keys, a verification pattern is calculated from an HMAC
key by MACing an all zero message of 64 bytes. The first 32 bytes of the
result is the verification pattern.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the definitions and utility functions for the PVSECRET-HMAC key type.
A PVSECRET-HMAC key token contains the secret id of a protected
virtualization secret. It does not contain the key material, just a
reference to the key in the ultravisor.
When such a key token is used to perform HMAC operations later on, the
PHMAC kernel cipher will obtain the protected key belonging to this secret
id with the help of the pkey kernel module.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For supporting integrity protected volumes with dm-integrity,
cryptsetup of version 2.8.2 or later is required.
Make cryptsetup of version 2.8.2 a build requirement for zkey, not
only for zkey-cryptsetup. Although zkey could be built with an older
cryptsetup version, the commands that it generates might not work
with older cryptsetup versions.
This makes the compile switch HAVE_LUKS2_SUPPORT superfluous, since
cryptsetup v2.8.2 always includes LUKS2 support. Remove the ifdefs
from the code and update the man pages to not mention LUKS2 support.
Also, starting with cryptsetup version 2.5.0 the luksFormat command
accepts option '--volume-key-file' to specify the volume key file
instead of --master-key-file'. Thus, use '--volume-key-file' in
cryptsetup commands generated by zkey.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix two issues in boot menu input parsing:
1. ebcdic_strtoul returns unsigned long but the value was stored in an int.
2. ebcdic_strtoul could overflow if @value exceeds ULONG_MAX.
Both problems are easy to trigger by entering an excessively large value
in the boot menu, which can lead to unsigned long overflow and memory
corruption.
Use a checked addition to prevent overflow and change menu_read() return
type to unsigned long.
Suggested-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
asm/types.h may be included after the guard. This happens eg. when
compiling with musl libc. When including the header directly the
include is always there and the fallback __vector128 is not needed
anymore.
The guard was introduced by commit 11bdab2629 ("include/boot/s390.h:
add guard for `struct __vector128`")
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/193
Signed-off-by: Sertonix <sertonix@posteo.net>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a tool that can be used to verify if a given IBM host-key document is
valid. This uses the same logic (and code) as the image/request tools
for IBM Secure Execution, pvimg, pvattest, and pvsecret.
This tool basically just does the first step of the above tools; but without
creating any request or image.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This new macro allows (rust) tools reporting the s390-tools version
string via clap functionalities, instead of implementing that on their
own. That clap interface requires a string and not a void function that
prints the version string. Define a macro that provides this string.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Enhance the ziomon man page to document support for persistent SCSI device
symlinks under /dev/disk/ subdirectories (by-id, by-path, by-uuid, etc.).
The DESCRIPTION section now clarifies that multipath devices and/or device
symlinks resolve to their underlying regular block devices for monitoring.
Updated EXAMPLES to include a scenario demonstrating usage with a device
symlink alongside regular and multipath devices.
Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>
Reviewed-by: M Nikhil <nikh1092@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Some (rust) tools may not provide man pages. In absence of a man file
the install process currently fails. Solve this by expanding the glob
using Make logic instead of sh logic.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix two off-by-one errors:
+ One caused an out-of-bounds read when the loadparm value was 63
+ The other made a boot entry unselectable.
Currently, these bugs have no practical impact because:
1. The memory area beyond __stage2_params.config[63] is empty.
2. BOOT_MENU_ENTRIES is set to 63, which exceeds the number of boot menu
entries that can be written to disk.
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add functionality for generating autocompletion scripts,
allowing for tab completion of tool options for bash and zsh.
This functionality relies on reading the available options
from the util_opt struct at runtime.
The script generation happens on the build system.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Szabina Korbai <szkorbai@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When a loadparm is presented by the user it's not checked whether it's
too large. Add this missing check to fix an out-of-bounds read.
The problem did not show up because the area behind the buffer is empty.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Currently, 'sclp_setup(SCLP_INIT)' fails if no SCLP line-mode console is
available. As a result 'menu_param()' is never called, even though it is
required to retrieve the 'loadparm' value.
However, reading the loadparm via SCLP remains useful even when a SCLP
line-mode console is absent, because this value determines which boot
entry should be selected. Therefore, the boot process should continue by
retrieving the loadparm without requiring an SCLP line-mode console.
It's safe to continue without a SCLP console as 'printf' and
'menu_param' tolerates the absence of a SCLP line-mode console.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/196
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Remove extern keyword from function signatures in header files.
Function signatures in headers are already extern implicitly.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When machine parseable format is specified via hyptop --format csv
the summary row for csv does not have any indicator or and a blank
system name. Avoid this confusion by adding "SUM" as system name.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fields without a valid value are normally excluded from formatted output
of hyptop. Add "--all" option to force hyptop to display those fields
with null values.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Hyptop uses underscore("_") in between words for options, this breaks
consistency. Use hyphens ("-") in between words in options moving
forward. Underscore formats are still supported for compatibility.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use the common helpers in lib/util_time instead of using hardcoded
values for time calculations.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Introduce util_time as a place for time related macros, definitions,
and functions that are commonly used. Add NSEC_PER_USEC, NSEC_PER_MSEC,
USEC_PER_SEC and NSEC_PER_SEC definitions that are used for time
conversion calculations as a start. Add time conversion helper functions.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Physical machine information does not include any monotonically
increasing time field like other per CPU information blocks. This
Prevents the percentage calculation for the physical information fields
as the divisor(time_delta) is missing;
field% = (value_current - value_previous) / time_delta
To circumvent that, use the current partition's per CPU online time
values to calculate the time_delta. Integrate time_delta as a new
field(phys_delta_us) specific to the physical systems.
Explicitly CPU0 online time is used, since CPU0 is always online
and cannot be deconfigured on s390x. Its online-time deltas would
match those of the physical CPUs.
Since a new field has to be used for physical systems a new
column in the table also has to be created but instead map the
physical system field to the corresponding regular system fields
for a nicer table view.
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Introduce a new row to represent the underlying physical machine
and the physical information hyptop gathers from diag.
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Many distros and buildsystems use '-Wl,--as-needed' default-wise anyway.
For example, Ubuntu, Fedora, and Meson default to '-Wl,--as-needed'.
Considering some of the projects that use/support Meson, e.g. util-linux,
systemd, libvirt, or git, are all built with '-Wl,--as-needed' as well.
So add '-Wl,--as-needed' to DEFAULT_LDFLAGS to also default to that.
Note that with '-Wl,--as-needed' the order of flags, objects, and libraries
matters for the link step. The link rule in common.mak already has the
correct order, so using '-Wl,--as-needed' will not hurt.
%: %.o
$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The check_dep macro allows to pass additional compiler & linker
options as 5th argument. This argument might contain shared
libraries to link against (i.e. -lsomething). To ensure that
the check_dep macro always attempts to link to these libraries
'-Wl,--no-as-needed' is needed.
At least on Ubuntu '-Wl,--as-needed' is the default, and with
that, the library might get skipped if it is not really needed
by the program built by the check_dep macro. Furthermore, with
'-Wl,--as-needed' the order of the arguments matters, and thus
a library specified in the 5th argument is at the wrong position,
which leads to link errors and thus the check_dep macro will
report that the dependency is not fulfilled, although it might
be fulfilled.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add an additional trigger to the zdev-generated 41-ap.rules file. This
trigger will check the bindings_complete_count value during coldplug
replay of the ap bus, which allows the udev rule to handle the case
where zcrypt has already fired the BINDINGS==complete with
COMPLETECOUNT==1 before the udev rule was accessible (example: before
rootfs has been mounted). Without this, it's possible for the rule to
never fire despite the initial bindings having completed.
While it was always possible for zcrypt to be forced onto initrd, it
becomes far more likely with changes like 14c977768 ("zkey/dracut: Add
a dracut config file for zkey").
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove unused header files from these sources.
This simplifies maintenance and slightly reduces compile time.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Drop unused headers from the internal s390-tools library. These headers
were only indirectly pulling in stdlib.h, which is now included
explicitly to support memory deallocation via free().
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove ctype.h and errno.h since they are not referenced in this
file.
Add err.h to explicitly declare the dependency on warnx().
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove lib/util_base.h and errno.h since they are not referenced in this
file.
Add err.h to explicitly declare the dependency on err() and warn().
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For s390-tools util_strlcpy() would be a safer replacement. However,
no code is changed, only .checkpatch.conf is updated to avoid false
positives in userspace.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a .clang-tidy file to provide consistent code quality checks
across the project.
The configuration is not integrated into .pre-commit-config.yaml because
it depends on a recently generated compile_commands.json file.
Example usage:
clang-tidy --fix-errors **/*.[ch]
Note: Running clang-tidy should be considered optional, not enforced.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Ignore the removal of nonexistent $image file. This removes the
following error message:
$ mk-s390image /var/lib/libvirt/images/hades/vmlinux-s390x out.img
...
rm: cannot remove 'out.img': No such file or directory
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If an input file is not readable return a proper error message indicating
this.
Before:
$ mk-s390image /var/lib/libvirt/images/hades/vmlinux-s390x out.img
mk-s390image: Unrecognized file format for /var/lib/libvirt/images/hades/vmlinux-s390x
After:
$ mk-s390image /var/lib/libvirt/images/hades/vmlinux-s390x out.img
mk-s390image: File /var/lib/libvirt/images/hades/vmlinux-s390x cannot be read, no read permission
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since Linux commit 5ecb2da660ab ("s390: support command lines longer
than 896 bytes") the s390x kernel supports longer command lines than 896
bytes. The indication of the maximum size is stored in a new field at
address 0x10430, older kernels without the support store a value of 0
there so in that case fallback to the old maximum length of 896.
In addition, use the checked size as limit to copy in the 'dd' call.
This prevents Linux kernel corruption in case the parmline has changed
in between.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/194
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Most of the fixes were auto-generated using the following command:
$ shellcheck --format=diff mk-s390image | git apply -
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Using the base dir only, will ensure to get all needed info independent of
configuration and future changes.
├── dasd
│ ├── devices
│ └── statistics
├── net
│ ├── anycast6
│ ├── arp
│ ├── bonding
│ ├── dev
│ ├── dev_mcast
│ ├── dev_snmp6
│ │ ├── encbdf0
│ │ └── lo
│ ├── sockstat
│ ├── sockstat6
│ ├── softnet_stat
│ ├── stat
│ │ ├── arp_cache
│ │ ├── ndisc_cache
│ │ ├── nf_conntrack
│ │ └── rt_cache
│ ├── vlan
The change in size and collection speed can be ignored.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use 'none' as default io scheduler for virtio-blk devices. Performance
improvements for multi-queue setups and to reduce CPU consumption.
Signed-off-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Performance measurements turned out that in certain situations the
paging/swap logic turns on the rotational feature for block devices. In the
past, this feature has been disabled for DASD devices. FCP and NVMe devices
are considered non-rotational by default (or exposed by the storage server).
Because those are the backing devices on Linux on Z/LinuxONE instances,
ensure that virtio-blk devices are always non-rotational.
Signed-off-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Output all text input sections into one text section and map all input
sections .bss.* .text.*, .rodata.*, and .data.* as it's done by the
default linker script [1]. In addition, make the linker script easier to
read by replacing the magic value of 32 with 'SIZEOF(.sb.trailer)'.
[1] Check the output of 'ld --verbose'.
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although stage2.head is not directly used in stage2, it is required by
other stages. To ensure it is retained during link-time
optimization (LTO), explicitly mark it as used. This improves code
readability and prevents LTO from mistakenly removing it.
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rename .exec into .elf because they are ELF files, no reason to use a
different file extension.
This change improves the shell's autocompletion of tools such as
'readelf'.
Acked-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function kmip_connection_tls_verify_server() erroneously always returns
zero, even if an error is detected inside the function. Fix this by
returning the return code value at the end of the function.
Found by clang static code analyzer.
Fixes: 56fecf1832 ("libkmipclient: Add KMIP client shared library")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
No functional changes to the file content.
Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Collect Control-Program Identification (CPI) data of the KVM
guests. The CPI data contains system name, system type,
system level and sysplex name of the guests. It also provides
the timestamp in which these data were colleceted from the
guests.
Note:
CPI information for SEL guests require explicit enablement.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The key check value (KCV) is the first 3 bytes of the ENC-ZERO key
verification pattern of a key. ENC-ZERO encrypts an all zero block with
the key using AES-ECB and returns the result truncated to 3 bytes as
key check value.
Report the KCV of a KMS generated key as part of its label. This is
especially useful for AES-XTS keys, where the KCV is reported on each
of the 2 individual AES keys that an AES-XTS key is built of. It allows
users to compare the KCV displayed by zkey with the KCV displayed by
the key management system where the key was generated on. If the KCV
value is the same, then the key values are the same, too.
The key verification pattern reported by zkey is also an ENC-ZERO
key check value, but for AES-XTS keys it is built by encrypting
the all zero block with AES-XTS, which produces a KCV for the complete
AES-XTS key, but does not allow to check the individual key parts.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When registering a zkey client at the EKMFWeb server, validate the
certificate if it's public key matches with the identity key of
the zkey client.
Only allow registration when the certificate matches. This helps to
prevent users from erroneously registering a wrong or outdated
certificate for a zkey client.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function ekmf_validate_cert() checks if the public key contained in a x509
certificate matches the public key of the identity key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A KMS login may prompt the user for its credentials. Users may abort that
prompt by Cntl-C. Do not make any permanent changes to a key before the
KMS login, because those changes can not be undone when the user has
aborted during KMS login, leaving the key in a potentially inconsistent
state.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lscss.c: In function 'is_sch_vfio':
lscss.c:392:20: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
392 | if (strcmp(basename(driver_path), "vfio_ccw") == 0)
device.c: In function 'device_read_active_attrib':
device.c:426:45: error: implicit declaration of function 'basename'; did you mean 'rename'? [-Wimplicit-function-declaration]
426 | value = misc_strdup(basename(link));
| ^~~~~~~~
| rename
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/192
[hoeppner@linux.ibm.com: Sort includes]
Signed-off-by: L. E. Segovia <amy@amyspark.me>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
NetworkManager stores new network profiles in keyfile format in the
/etc/NetworkManager/system-connections/ directory.
/etc/network/interfaces might be replaced by /etc/netplan on some systems
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The definition NO_PIE_CFLAGS has only two users and specifies only a
single compiler flag. There is no point having this definition anymore.
Remove the definition and specify -fno-pie directly for the two users.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit c5a91199e3 ("zipl: Always build and link without PIE.")
introduced -fno-pie (for compilation) and -no-pie (for linking) for
zipl. At the time the linker was still used directly before commit
5e46632767 ("zipl: Use the compiler for linking instead of ld")
eventually switched to calling the compiler for the linking step.
During that adaption -static was introduced to the linker flags. -no-pie
was carried over as well. However -static implies -no-pie and it is
therefore not required. For GCC see also man 1 gcc (-static) [1]. Whilst
not explicitly documented, Clang shows the same behaviour. Clang also
complains when -static and -no-pie are specified in the linker step at
the same time with the following warning:
clang: warning: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument]
Since -no-pie is not required, remove it and get rid of the warning.
[1] https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html#index-static
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The command line options -fno-pie/-no-pie are required by boot loaders
as they have strict layout requirements. A check was implemented using
-dumpspecs to evaluate the compiler support as older compilers didn't
support the no-pie command line options.
However, -dumpspecs is a GCC specific option and the check will
therefore always fail for Clang. The objective is to enable Clang
compilation support for s390-tools in the long-run.
Since support for -fno-pie/-no-pie in GCC was introduced 2015 with
version 6.1.0 and in Clang 2010 with version 3.0.0, general support can
be assumed.
Simply remove the support check and get rid of another obstacle that's
in the way for full Clang support.
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'clang' compiler generates a section with the name '".loader_parms"'
and gcc '.loader_parms' if the double quotes are used. Fix this by
removing the superfluous double quotes, this results in a section with
the name '.loader_parms' for both clang and gcc.
Reported-by: Richie Buturla <richie@linux.ibm.com>
Reviewed-by: Euan Bourke <euan@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev provides dracut logic for configuring devices early during boot via
kernel command line parameters rd.dasd and rd.zfcp. A copy of resulting
configuration directives is made available to the booted Linux using
chzdev's export function.
The use of command line option --all in this export step results in
chzdev loading all kernel modules required by supported types, even if
no device of that type exists on the booted system, or if no zdev kernel
parameter was specified.
Loading unused kernel modules during boot increases memory usage,
prolongs boot time, and expands the kernel's attack surface
unnecessarily.
Fix this by replacing command line option --all with --configured to
instruct chzdev to export only data for devices with a persistent
configuration, while not loading any kernel modules.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On SEL guests, the default configuration does not permit the
Control-Program Identifiation (CPI) data to be sent by the cpi
service, resulting in a failure message in systemctl/log output
on start of the cpi service.
This is not a failure because it is expected behavior and the
cpi service is a one-shot service whose function is already
performed when the exit code is returned. Prevent the error log
by filtering the associated exit code in systemd.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Modify the symbolic name of the exit code 6 to
EXIT_NOTCONFIGURED, which is according to the Linux Standard Base
(LSB) specification.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cargo update -p openssl -p curl -p usafe-libyaml
By default users of the libs will use the version tagged in the
lockfile. Let make things easier for them and update the lock entries
with versins that have some CVEs fixed.
Note that this does not affect code shipped by distros as they ignore the
lockfile.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command-line option --counters "AAA,BBB,...,ZZZ" to specify a
comma-separated list of counter names to display. Counter names must
match exactly, ignoring case. All counters not listed are excluded
from output.
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move ctr_in_list() from cpumf/lspai.c to a shared location to enable
reuse in other binaries that require counter list filtering.
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The code within 'menu_param()' previously assumed that a read from sclp
will never fail.
If 'sclp_param()' fails then 'endptr' is never initialised and
'loadparm' is compared with 'endptr' which is undefined behvaiour.
If a sclp read fails, an undefined 'endptr' is never accessed, and upon
a failed read, will return a new error code 'SCLP_ERROR' instead of
returning 'NUMBER_FOUND' which is incorrect logic wise.
Remove compare conditions and assignments of 0 in 'value', as 'value'
is initialised with 0 ('DEFAULT_MENU_ENTRY') and cannot be non zero,
only in the case where a number is found and we go to boot.
Logic:
Check if we got a number and boot from it.
If 'PRINT_PROMPT', break out to menu print logic.
If an 'SCLP_ERROR' occurs, print an error message and boot the default
since 'value' is initialised with 'DEFAULT_MENU_ENTRY'.
If 'NOTHING_FOUND', check if the menu is disabled. If disabled, go to
default boot. Otherwise break out to print logic.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Richie Buturla <richie@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use snprintf() instead of sprintf() to avoid buffer overflow.
Also change the integer type from signed to unsigned.
Error:
dasdinfo.c: In function 'dinfo_create_devnode':
dasdinfo.c:297:52: warning: '%04d' directive writing between 4 and 11
bytes into a region of size 5 [-Wformat-overflow=]
297 | sprintf(filename, "dasdinfo%04d", retry);
| ^~~~
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The util_base.h header is no longer required in dasdinfo.c and can be
safely removed to reduce unnecessary dependencies.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The sysfs path is now constructed dynamically in an allocated buffer to
avoid potential buffer overflows. The default is '/sys', until the
SYSFS_ROOT environment variable is defined.
These modifications significantly improve testability by allowing sysfs
read and write operations to be redirected to an alternative file path,
which enables testing without affecting the active system state.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Including string.h is incorrect as it doesn't provide the required
function prototype for strncasecmp() used in this file. Note that
the missing function prototype doesn't cause a compilation error
at the moment as the declaration is provided indirectly.
Use strings.h to provide the declaration for strncasecmp() directly,
avoiding unnecessary include dependencies and improving clarity.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The variable filename was freed inside the loop and then incorrectly
used in the subsequent warnx() call. Replacing it with directory
reflects the indented context and avoids use after free.
Fixes: f25aaf32b8 ("zkey: Add support for key management system plugins")
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line option --counters XXX,YYY to specify a comma
separated list of counter names to be displayed. The counter names
have to match exactly beside case sensitivity.
All counters not listed in the list specified by the --counters option
are not shown.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Co-developed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a command line flag '-a' to include the counter set values
from each individual CPU. Up to now only the total sum from
all CPUs was printed.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flag -d to display the counter value in form of
a delta value. This format shows the increase of that counter value
compared to the previous value.
The first line is the base for the delta calculation and always
shows 'Total'. The remaining lines show 'Delta' in the third
column.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flag -s to display the counter name in an
abbreviated form. The abbreviated form is a character for the
PAI counter set followed by a number.
PAI crypto counter set is abbreviated to 'C'.
PAI NNPA counter set is abbreviated to 'N'.
The number refers to the defined counter number ranging from
1 to X.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flags -x and -X to print counter values in
hexadecimal format with leading 0x prefix (-X) and without (-x).
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flags -i (read interval) and -l (loops) to
show the counter values for the specified number of iterations.
The CPUs to read the counter values from can be specified
on the command line. If none are specified, all online CPUs
are used.
For example the command '# lspai -l 2 -i 10 -t nnpa'
displays all PAI NNPA counter values two times with 10 second
interval.
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Co-developed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Relocate remove_whitespace() from zdsfs to libutil/util_str.c, renaming
it to util_str_rm_whitespace() to make the helper available
project-wide.
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Relocated the perf_event_open logic into a shared helper to eliminate
redundant implementations across multiple files. Enhances consistency,
reduces maintenance overhead, and lowers structural complexity.
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix a potential compile error when symbol
EKMF_SUPPORTS_RSA_PSS_CERTIFICATES is defined. With this symbol support
for RSA-PSS can be enabled for the EKMFWeb plugin. Currently this symbol
is never defined.
Fixes: c570f51f5f ("zkey-ekmfweb: Generate certificate or CSR with identity key")
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Currently a certificate or certificate signing request generated by the
zkey EKMFWeb library erroneously always uses RSA-PSS as signing algorithm,
although EKMFWeb does not support RSA-PSS certificates in all versions.
This bug was introduced with the rework to use libseckey for secure
key crypto operations.
Fixes: 26c34a49b1 ("libekmfweb: Make use of the new libseckey")
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add support for '--image-key'. This new option can be used to select the
components encryption key (e.g. kernel, initrd, and kernel command
line). Previously, this was only available as an experimental
option ('--x-comp-key').
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Normally, secure keys generated by zkey are intentionally export
restricted. Export restricted keys can not be wrapped with a key
encrypting key (KEK).
However, keys that are generated inside a Secure Execution for Linux
guest that shall also be used outside of the Secure Execution for Linux
guest can only be transported to outside the Secure Execution for Linux
guest by wrapping them with a KEK and unwrapping them outside of the
Secure Execution for Linux guest. For that such keys must be exportable.
Add an option to generate and import exportable secure keys, which then
can be wrapped, and thus transported to outside of a Secure Execution for
Linux guest.
This applies to keys of type 'CCA-AESCIPHER' and 'EP11-AES'. Keys of type
'CCA-AESDATA' are always exportable, and can not be export restricted.
For keys of type 'EP11-AES' additionally allow to set the
'wrap-with-trusted' attribute. This restricts the key so that it only can
be wrapped with a trusted key encrypting key.
For keys of type 'EP11-AES' to be exportable, the access control point
(ACP) XCP_CPB_ALLOW_COMBINED_EXTRACT must be 'ON' on all APQNs used. This
access control point is only supported on newer EP11 firmware levels. If
the access control point is 'OFF' or not supported by the EP11 firmware,
then the IOCTL to generate the key fails with a generic error
(Input/output error - EIO). The zkey tool prints an appropriate error
message in that case.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
While parsing the rd.dasd kernel parameter, the dracut module
currently creates two separate udev rules for a single DASD — one
for ECKD type and one for FBA type. Because the kernel parameter
alone does not provide enough information to reliably determine the
DASD type, this dual configuration can lead to inconsistencies.
Update the logic to determine the DASD type dynamically by parsing
the modalias of available devices. If a device is not present during
boot, both udev rules will be generated.
Also add --no-module-load to the chzdev functions, because during this
time, we do not want chzdev to load the dasd module. The goal here is
to generate the right udev-rules only.
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
During autoconfig, DPM systems currently configures DASD devices twice:
once for dasd-eckd and once for dasd-fba. Because the firmware
configuration file does not provide the DASD type, this can lead
to inconsistent and redundant configurations.
For example, lszdev may show two devices with the same ID:
TYPE ID ON PERS NAMES
dasd-eckd 0.0.f001 yes auto dasda
dasd-fba 0.0.f001 no auto
However, only dasd-eckd is actually present on the machine, and
the dasd-fba entry is incorrect.
Modify this configuration logic to determine the DASD type dynamically
by parsing the modalias for each device-ID, and configures only the
correct dasd-type. The resulting lszdev output accurately reflects
the actual DASD devices present.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When called with a device parameter, chzdev tries to load the kernel
module of the corresponding device type. This might not be desired in
certain situations like early initial RAM-disk processing.
To support this use cases, add a new command-line option
--no-module-load to prevent the loading of any kernel module by chzdev.
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
module_load_suppress() currently ignores the state parameter. Modify
it to respect the state parameter, so that the module load suppress
can be both enabled or disabled.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The 'temp_area' buffer was not zeroed out for a retry in case of an
invalid input to select a boot menu entry.
Before:
zIPL v2.38.0-build-20250822 interactive boot menu
0. default (1TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
1. 1TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
2. 2TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
3. 3TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
Note: VM users please use '#cp vi vmsg <input>'
Please choose (default will boot in 3 seconds):111
Error: undefined configuration
Please choose:1
Error: undefined configuration
After:
zIPL v2.38.0-build-20250822 interactive boot menu
0. default (1TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
1. 1TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
2. 2TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
3. 3TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
Note: VM users please use '#cp vi vmsg <input>'
Please choose (default will boot in 3 seconds):111
Error: undefined configuration
Please choose:1
Booting 1TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT...
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix a design mistake leading to IPL programs corruption.
Use a matrix of component ranges to locate the added components in the
body of bootmap file instead of an array.
Earlier an array of NR_PROGRAM_COMPONENTS was used, which is incorrect
Now a matrix of (NR_PROGRAM_COMPONENTS X BOOT_MENU_ENTRIES) is used.
Don't duplicate environment block for each menu entry. Instead, reuse
the one that was added when processing the first menu entry.
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use exists and rename instead of renameat2 which is only available in the
linux implementation of libc. To enable compilation of pvsecret on macos
the rust wrapper function renameat2 which calls the libc renameat2 function
is replaced with rust native std::fs::exists ad std::fs::rename functions
because macos' implementation of libc does not have the renameat2 function.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Apply previously introduced generic infrastructure to add an
environment block as a "buffer component".
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Don't duplicate data of components added via add_component_buffer()
and friends to bootmap file. Instead, reuse data that were previously
added when preparing a program table for the first mirror to create
metadata (block lists, program tables, etc) specific for other mirrors.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
If the option '--add-files' is specified, don't duplicate data of
components added via add_component_file() and friends to bootmap
file for each mirror. Instead, reuse the data that were added when
preparing a program table for the first mirror to create metadata
(block lists, program tables, etc) specific for other mirrors.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Drop limitations on identical target parameters of base disks per
logical device;
Fix verbose zipl output to include geometry of each mirror and
component load addresses that would be used when booting from each
mirror.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Replace struct install_set with a new type containing multiple
program tables and program components. Refactor the code accordingly.
When retrieving device INFO, for each mirror complete a respective
structure disk_info in the INFO.BASE array.
When building a bootmap, for each mirror create a separate program
table (or a pair of tables in case of DASD - for CCW-TYPE IPL and
for LD-IPL), using respective components in the arrays INFO.BASE and
BIS.MIRRORS
Make data of program components added via get_component_buffer() and
get_component_file() be duplicated per each mirror.
Make boot record on each mirror point out to a respective program
table in the bootmap (when booting from different mirrors, different
program tables in the bootmap are used).
This patch doesn't make functional changes. However, test cases
comparing boot meta-data dumps of different mirrors may fail (since
boot records on different mirrors now refer different copies of boot
data). This will be fixed by the next patches in the series which
allow boot data to be reused.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Replace struct disk_info with new 2 types.
Old type:
struct disk_info {
A; /* logical device info */
B; /* basedisk info */
};
New types:
struct disk_info {
B; /* basedisk info */
};
and
struct device_info {
A; /* logical device info */
struct disk_info C [MAX_TARGETS]; /* array of base disks */
};
Here A (logical device info) is the following:
dev_t device; /* logical device for bootmap creation */
char *name; /* name of logical device as reetrieved from
"/proc/partitions" */
char *drv_name; /* name of the driver managing the logical
device as retrieved from "/proc/devices",
or evaluated */
int fs_block_size;
Refactor the code respectively, to use only the first element of
the array C, so that this patch represents an equivalent transform.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a man page note to clarify that BPS value scaling only applies to
human-readable output format.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add options to select power-of-two based IEC units such as KiB/s
(1024 B/s) for scaling throughput values in human readable reports.
Option Scaling factor
================================
--scale ki 1024
--scale mi 1048576
--scale gi 1073741824
--scale auto-iec IEC units
Reviewed-by: Jimmy Brisson <jbrisson@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
chpstat uses power-of-two based IEC units such as KiB/s (1024 B/s) when
scaling throughput values in human readable reports. A user interpreting
these numbers can easily be confused by chpstat's default column header
("B/s") to assume that numbers are scaled using power-of-ten based SI
units such as kB/s (1000 B/s).
In addition, users that have worked with similar z/OS tooling to display
channel path activity are used to SI-based scaling, which increases the
chance of chpstat reports being misinterpreted.
To reduce this confusion, use SI units for throughput scaling:
Option Old factor New factor
==========================================
--scale k 1024 1000
--scale m 1048576 1000000
--scale g 1073741824 1000000000
--scale auto IEC units SI units
Note that machine-readable format produced via option --format is not
affected by scaling.
Reviewed-by: Jimmy Brison <jbrisson@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In tabular output, chpstat adds an additional space between columns
of different groups (e.g. between READ and WRITE data). Currently this
is done by increasing the column width of the first column in a group.
Depending on the value displayed in this first column of a group, the
spacing may vanish, and under certain circumstances, the precision of
auto-scaled *_PART columns may be higher than the precision of the
related *_TOTAL columns, resulting in a confusing view.
Example:
DPU READ(B/s) WRITE(B/s)
ID PART TOTAL PART TOTAL
6 10.7M 10.7M 10.8M 10.8M
6 0.00 11.3K 0.00 0.00
^^ ^^
Fix this by consistently adding padding between column groups without
increasing the column width of the first column of a group. Also ensure
the same width for *_PART and *_TOTAL columns.
Reviewed-by: Jimmy Brisson <jbrisson@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix segmentation fault when trying to process not supported dm-targets
Release allocated memory in error paths
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use 'LDLIBS' to specify the libraries that the tool is linked against.
If it is specified as a dependency, the build system may attempt to
build it and fail.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Match "chccwdev --online" example's description with its function
and improve "--safeoffline" example's wording.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use 'PVIMG_PKGDATADIR' as it is used by the 'pvimg_pkg_data' macro rule.
The problem only shows up if someone changes 'PVIMG_PKGDATADIR' to
something different than the default.
Fixes: f4cf4ae6eb ("rust: Add a new tool called 'pvimg'")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The cpictl utility sends control-program identification data
from protected virtualization guests to hosts by default.
This behaviour leaks the below potentially sensitive
information to untrusted hosts.
- system_type
- system_level
- sysplex_name
- system_name
To prevent this behaviour, enhance the cpictl utility to stop
setting CPI information on protected virtualization guests by
default. If the user chooses to set the CPI information, it
could be set by one of the below options
- use the command line option --permit-cpi
- set the environment variable CPI_PERMIT_ON_PVGUEST to 1 to
control the CPI service behaviour during boot
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rework command type selection and timeout trigger.
Add log entry when the timeout stopps a command or a non "zero" rc happens.
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <SIGLEN@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lsiucvallow is just a symlink to chiucvallow for 'chiucvallow --list'.
Only a man page for chiucvallow is provided though. A corresponding man
page for lsiucvallow could be expected by the user. Certain linter such
as linitan warn about the missing man page, too.
Install lsiucvallow.8 as a symlink to chiucvallow.8 to make the
documentation of these tools more accessible.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With version 1.23 groff/troff disabled the non-portable font CW and
started to complain about a missing CW font when previewing some of the
man pages, with messages like
$ man --warnings cpumf/man/pai.8 > /dev/null
troff:<standard input>:244: warning: cannot select font 'CW'
Use CR to replace CW.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/187
[hoeppner@linux.ibm.com: Adapt commit message]
Signed-off-by: Dan Horák <dan@danny.cz>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix two edge cases for generating and interpreting plaintext secrets:
1. The maximum payload size was two bytes to long. The space for the
length header was forgotten to take into account.
2. One of the checks for if the plaintext secret has a size was too
strict.
Fixes: fd024387d7 ("rust/pv: Retrievable secrets support")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
cpictl tool supports options which start with - or -- alone. Getopt
command verifies options which start with - or -- alone. When an
option that does not start with - or -- is provided, the tool commits
the changes and does not report error as shown below.
$ ./cpictl abc
Inside cpi_commit function
Report error and do not commit for invalid options.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Introduce a new command-line option --format FORMAT to control the output
format of lshwc. Supported formats include CSV, JSON, JSON-SEQ, and key-value
PAIRS. The output is now generated using the shared util_fmt infrastructure,
enabling consistent and machine-readable output.
This change also includes:
- Label generation for counters
- Integration of util_fmt for structured formatting
- Updated man page with documentation for the new option
- Updated man page with JSON output structure documentation
- Add option (-q) to force quoting all elements.
Reference: https://www.ietf.org/rfc/rfc4180.txt
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add support for IBM z17 machine types 9175 and 9176 CPU Measurement
facility basic, problem, crypto and extended counter sets.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Move the check_hostkeydoc script to scripts. This eliminates the last file
in the genprotimg directory. Additionally, add a deprecation warning to
that script. Every pv tool can verify the chain itself using the pv
library.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a workaround for OpenSSL version that do not include the upstream
fix [1]. The missing fix results in an OpenSSL error when it tries to
download the CRL provided by DigiCert. The workaround is to identify
this situation and then fallback to download the CRL using 'curl'
instead.
[1] cdbe47bf3c
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This patch modifies the default behavior of CSV header generation:
header cells are no longer enclosed in double quotes unless the
FMT_QUOTEALL flag is explicitly set. According to RFC 4180, quoting is
only required when a cell contains control characters, commas, or double
quotes.
The goal of this change is to produce cleaner and more readable CSV
output by default, and to avoid unnecessary quoting in header rows. It
also simplifies algorithms that rely on FMT_UTIL and improves
compatibility with downstream tools expecting unquoted headers.
Tools that expect unquoted headers include:
* SQL tools: Headers optional, usually unquoted
* R (read.csv): Uses header=TRUE, no quotes needed
* Pandas: Assumes headers, quoting not required
* Excel: Detects headers; quotes only for special chars
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
On s390 architecture a newly hotplugged CPU, should only stay offline if
it is on deconfigured state, otherwise it should automatically become
online. Introduce a new udev rule to enforce this behavior. This rule
should always be installed.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
DPU-related data fields dpu_num_cores, dpu_channel_exec_time_cpc, and
dpu_exec_time_cpc are missing from machine-readable output for CMG 5
channel-paths.
Fix this by adding them to the corresponding output routines.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chpstat reports incorrect DPU utilization values for CMG 4 and 5
channel-paths. Calculated values are too high due to counters being
interpreted as units of seconds while they are reported in units of
timer ticks. Also, a zero partition channel-path utilization value
(DPU PART) is incorrectly displayed as unavailable (-).
Fix this by using the correct timer unit in DPU utilization
calculations and making sure that zero DPU PART values are reported
correctly.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support for managing virtual I/O ccw (virtio-ccw) devices in
lszdev/chzdev.
New zdev device type virtio. Each virtio device type (blk, net,
gpu, vsock, etc.) is represented by a unique subtype of the virtio
base type.
If the virtio device type is recognized, then it will show up as
virtio-blk or virtio-net, or whatever the virtio device type is.
Otherwise, it will just show up as virtio-ccw.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/29
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adding a new tool (tamper_pvimg) for helping to test if the expected
RC and RRC values are received for several different reasons when
DIAG 308 subcode does not complete successfully. The reasons can include
issues related to host key hash, SE header, ALD/PDL/TLD mistmatch, etc.
This tool can read the SE image and manipulate one of the SE header
fields so that the SE image will fail to enter secure mode during the
stage3a booting process. The stage3a bootloader should receive UVC
command code id, RC and RRC values corresponding to the SE header
field that was manipulated. These values will be checked for
consistency in the tests for correctness of DIAG 308 subcode 10 RCs
and RRCs.
[hoeppner@linux.ibm.com: shortened commit subject]
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Signed-off-by: Steffen Eiden <sediden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Converting several variables to public and exporting some structures
for use in SE header tampering tool.
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When DIAG 308 subcode 10 is specified, and the configuration fails to enter
the secure mode, then the stage3a bootloader reads the DIAG response code,
UV RC, RRC and command id from bit positions 48-63, 32-47, 16-31, and
0-15 of the general register R1 + 1.
The bootloader now prints the error codes to help pinpoint the error cause.
For some cases that are reported to occur often the bootloader also prints
the cause when possible or prints hints to help understand the cause.
QEMU patch "DIAG 308: extend subcode 10 to return UVC cmd id, RC and RRC
values upon failure to enter secure mode" (commit-id: )
is needed with this patch.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Ensure that the pkey sub-modules are also loaded, as well as the paes
cipher.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Provide a dracut config file that ensures that the required drivers and
executables, as well as the zkey repository is included into the initramfs.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zkey tool might be configured to use plugins. Include the plugins also
into the initramfs, otherwise zkey might not be usable at early boot time,
when it is configure to use a plugin.
Update the list of driver to include, pkey_sysfs does not exist, its built
into the pkey base driver.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adding podman commands to dbginfo.sh, which is a successor for docker.
We reduce standard details for docker (it can be collected on demand).
Inlcuding /etc/containers for registry and container engine configuration.
Suggested-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jörn Siglen <SIGLEN@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create a symbolic link to the 'pvimg-create' manpage of for 'genprotimg'
during the manpage installation. This helps the users to migrate to
'pvimg create'.
Suggested-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Describe the breaking changes to genprotimg in the notes section. This
helps the users to adapt to the new behavior.
Fixes: f4cf4ae6eb (rust: Add a new tool called 'pvimg')
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently zpcictl silently accepts incorrect command line options while
it should be displaying an error message for invalid ones. There is a
check for the case when no arguments are supplied, but invalid arguments
or only specifying a device without an action does not display an error
nor give a failure exit code.
Fix this by changing parse_cmdline() to return a boolean indicating if
any arguments were supplied while exiting with an error and message when
invalid options are detected.
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Re-enciphering an EP11 secure key may fail with an error message like:
"zkey-cryptsetup: Failed to re-encipher the secure volume key for device
'<device>'"
or
"zkey: Failed to re-encipher '<key>' from CURRENT to NEW master key"
or similar.
The verbose messages show the following debug message:
"Command XCP_ADM_REENCRYPT failed. rc = 0x20"
This is due to uninitialized variables, which might cause the EP11 admin
request to contain garbage data, causing it to fail with CKR_DATA_INVALID
(0x20).
Fixes: 0be7efc956 ("zkey: Add support for re-enciphering EP11 secure keys")
Fixes: 4e2ebe0370 ("libseckey: Fix re-enciphering of EP11 secure key")
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev's initramfs hook does not add directives for enabling the root
device to the initrd if the root device is only configured in the
active configuration. As a result, a reboot using the new initrd fails
because the root device cannot be found.
This situation can occur for example when the zdev initramfs hook is
called from within an installer, where devices are only enabled in the
active configuration.
Address this situation by considering both the active and persistent
configuration of the root device during initramfs configuration. In case
the device is configured in both configurations, the persistent
configuration takes precedence.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ultravisor supports a new secret type in `add-secret` to update
the customer communication key (CCK). Support this new secret
type (0x16).
[seiden@linux.ibm.com: Constify CCK Header struct usage]
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The CCK will be able to be updated by an ultravisor call. For security
reasons, this feature must be enabled at Secure Execution header
creation time.
Because this makes it possible to dump without having set a CCK
earlier, the requirement to specify a CCK when creating an image with
guest dump support is extended to also allow for CCK update instead.
Change a CLI test for this that was a duplicate anyway.
[seiden@linux.ibm.com: Allow --cck & --enable-cck-update simultaneously]
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With the recent upgrade to zerocopy 0.8 it is now possible to create
those structs at compile time. This removes the use of a magic array
constant.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This enables some const constructors, Dataful Enums,
Dynamically Sized Types and much more.
v0.8 introduces breaking changes including, but not limited to:
- Rename AsBytes to IntoBytes
- Fine-grain (derive) Traits that need to be implemented on top.
- Rename FromZeroes to FromZeros
for which this patch takes care of as well.
Also a direct FromZeros derive is no longer necessary. As it is touched
anyways, remove it where appropriate.
See: https://github.com/google/zerocopy/discussions/1680
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Denies the addition of secrets with an ID that is already stored in the
secret store. This can be overruled by using the force option.
This is considered a breaking change as adding duplicated IDs was
possible without the '--force' option before.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case of missing dfi_cpu_info in the dump, obtain the number of online
cpus of the dumped system based on the number of present entries in the
lowcore_ptr array (if vmcoreinfo is available).
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix is_device_mapper() predicate to not base on checking a hardcoded
major number (253), which not always correct, since on some systems
dm-devices have different majors".
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Warn a user that there are multiple secrets in the secret store with the
same secret id, but retrieve one of them anyways.
This helps users to notice issues before they happen, as retrieve may
not retrieve the expected secret due to duplicated IDs.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Warn a user that the secret-id to be added is already in the secret
store, but add it anyways.
This helps users to notice issues before they happen, as retrieve may
not retrieve the expected secret due to duplicated IDs.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In certain situations util_file_read_fd_buf() might return a larger
buffer than printable characters were read (e.g. a file was padded with
zeros). This can lead to util_file_read_fd() returning NULL with a freed
buffer even though a certain amount of printable characters were read.
This behaviour causes a regression introduced with commit 9efd1df31d
("ipl_tools: Refactor read helper using util_file_read_text_file()") in
ipl_tools were the scp_data sysfs attribute is padded with 0 to fit an 8
byte alignment required by the architecture.
Fix this by comparing the size read with the actual string length and
use the smaller value for further processing.
Fixes: 9efd1df31d ("ipl_tools: Refactor read helper using util_file_read_text_file()")
Tested-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Invert the polarization of the successful state. The checks are
considered to be successful if there are no issues. Therefore, test for
an empty issue list and not for a non-empty.
Fixes: 697dcc0f6b ("rust/pvattest: Add check command")
Reported-by: Reinhard Buendgen <buendgen@de.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support for complex dm- over md-devices.
It includes an important particular use case in distro installation
process, when a linear dm-target is built on the top of software
RAID1:
dasda 94:0 0 20.6G 0 disk
\_dasda1 94:1 0 20G 0 part
\_md127 9:127 0 20G 0 raid1
\_rhel_a46lp05-root00 253:5 0 20G 0 lvm /
dasdb 94:4 0 20.6G 0 disk
\_dasdb1 94:5 0 20G 0 part
\_md127 9:127 0 20G 0 raid1
\_rhel_a46lp05-root00 253:5 0 20G 0 lvm /
\ # zipl_helper.device-mapper /
Expected result:
targetbase=94:0
targettype=CDL
targetgeometry=30051,15,12
targetblocksize=4096
targetoffset=4632
targetbase=94:4
targettype=CDL
targetgeometry=30051,15,12
targetblocksize=4096
targetoffset=4632
Actual result (incorrect):
targetbase=9:127
targettype=SCSI
targetblocksize=4096
targetoffset=256
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_path_sysfs() to form a fully qualified sysfs file name
for files S390_CPUMF_CF, S390_CPUMF_CFDIAG, S390_CPUMF_SF,
S390_SYSFS_PAI_CRYPTO and S390_SYSFS_PAI_EXT.
No functional change.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer CCA versions might report the version string with CSUACFV or CSUACFQ
with keyword STATCCA using a different indicator character after the
version information. Ignore the indication character and the remaining
data entirely. Only the version information as such is of interest.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Eliminated redundant code to improve clarity and maintainability.
Replaced with existing utility functions from the library.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function declarations in header files are implicitly extern, making
the explicit use of extern unnecessary. Removing it simplifies the
code without changing semantics and behavior.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a unit test for flag parsing.
In order to ease this test, add derive Eq to ControlFlags and
Msb0Flags64. For the same test, add derive Default to
CreateBootImageArgs and the structs used in it. The latter can be
limited to only derive when testing to avoid confusion with any
user-level default.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a command line flag to specify run time of lshwc command in
terms of days, hours, minutes and seconds. The command line flag
is named -t and has a number as argument followed by one of the
letters 's' for seconds (default), 'm' for minutes, 'h' for hours
and 'd' for days. Default is seconds when no trailing letter is
detected.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The build_arch field in s390 DASD dump header has originally been used to
indicate whether the dump tool has been built on s390 or s390x system.
Since no other architectures but s390x are supported for Linux on z, do
not process build_arch attribute. Bail out if any build architecture other
than ARCH_64 has been detected in s390_ext or s390mv_ext DASD dump header.
Remove build architecture line from 'zgetdump -i' output:
Build arch.........: s390x (64 bit)
The man file for zgetdump is updated accordingly.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Initialize dump and dump-tool architecture to DFI_ARCH_64 at the start
of dfi_init() and dt_init() respectively.
- Bail out if any dump architecture other than ARCH_64 has been detected
in s390_ext or s390mv_ext DASD dump header.
- Remove redundant dfi_arch_set() and dt_arch_set() functions.
- Get rid of l.arch local variables in dfi* and dt* source files and
drop dfi_arch() function.
- Drop the usage of DFI_ARCH_32 and compeletely remove DFI_ARCH_UNKNOWN.
- Drop special register and lowcore processing functions used
for DFI_ARCH_32.
- Drop df_s390_from_dfi_arch() and df_s390_to_dfi_arch() funcitons.
- Update the man file for zgetdump.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since DASD standalone dumper does not support non-extended s390
multi-volume dumps for years, drop zgetdump support of non-extended s390_mv
DASD dumps and dump-tools:
- Merge dfi_s390mv_ext and dt_s390mv_ext with related dfi_s390mv and
dt_s390mv counterparts.
- Update DFI and DT vectors of supported dump formats and dump-tools
removing dfi_s390mv and dt_s390mv entries and keeping dt_s390mv_ext and
dfi_s390mv_ext ones for s390_mv extended dump and dump-tool accordingly.
- Remove dfi_s390mv.c and dt_s390mv.c sources and update the Makefile.
- Make dfi_s390mv_ext_init() and dfi_s390mv_info() static.
- Remove magic number relevant to non-extended s390_mv DASD dumper.
- Completely drop DASD dumper version 5 case in df_s390_dumper_read().
Note: Since non-extended s390 multi-volume dumps can reside on DASD
partitions only and cannot be produced via DFO interface, we can drop this
dump format entirely.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since DASD standalone dumper does not support non-extended s390 dump
format for years, drop zgetdump support of non-extended s390 single volume
DASD dump-tool:
- Merge dt_390sv_ext.c and dt_s390sv.c counterparts.
- Update DT vector of supported dump tools removing dt_s390sv entry and
keeping dt_s390sv_ext entry for s390 single volume extended dump tool.
- Remove dt_s390sv.c source and update the Makefile accordingly.
- Remove magic constants relevant to non-extended s390 single volume DASD
dumper.
- Drop s390 single volume DASD dumper version 5 in df_s390_dumper_read().
Note: We still need support of non-extended s390 dump format since such
output dump files can be produced by 'zgetdump -f s390' via dfo_s390. Thus,
both dfi_s390 and dfi_s390_ext DFI vector entries remain in order to
process s390 dumps files as well as s390_ext dumps on the DASD partition.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Drop support of obsolete dump and dump-tool versions (single-volume DASD,
FBA and Tape) in order to simplify zgetdump logic:
- CCW dumpers written in assembler instructions as well as stage2 dumpers
of size less than 0x3000 (STAGE2_DUMPER_SIZE_V1 or STAGE2_DUMPER_SIZE_V2)
haven't been used for years. Remove its traces completely as a cleanup.
Keep the last version (version 5) of non-extended DASD dumper as well as
newer extended DASD dumpers.
- Rename STAGE2_DUMPER_SIZE_V3 and STAGE2_DUMPER_SIZE_ZLIB constants.
- Drop support of non-extended s390 dumps of version < 5. Dump files
of s390 format version 5 can be still produced by zgetdump (dfo_s390).
- Drop excessive dump version checking in df_s390_cpu_info_add() and
df_s390_hdr_add() considering that obsolete s390 dumps of version lower
than 5 no longer supported.
- Use cpu_cnt field in s390 dump header instead of the s390 dump version to
indicate no cpu info available (DFI_CPU_CONTENT_NONE) for dfo_s390.
- Make df_s390_dumper_read() return error code upon unknown dumper
version/magic detection.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace read_str() helper in ipl_tools/system.c with
util_file_read_text_file() to enhance maintainability and reduce
code duplication.
Additionally, allocate the buffer dynamically instead of using
fixed-size buffer to prevent potential overflows and data loss.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Optimize dependency management by reducing header inclusions. This
reduces hidden dependencies, improves modularity, and enhances
compilation performance.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Optimize dependency management by limiting header inclusions to
implementation files where possible. This reduces hidden dependencies,
improves modularity, and enhances compilation performance.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a flag to display the counter value in form of a delta
value. This format shows the increase of that counter value
in comparison to the previous readout.
The first line is the base for the delta calculation and always
shows 'Total'. The remaining lines show 'Delta' in the third
column.
# ./lshwc -d -i 3 -l 5 -x -s :p
Date,Time,CPU,P32,P33
2024-11-27,15:45:55,Total,d7b,172
2024-11-27,15:45:58,Delta,2be403,2d58bb
2024-11-27,15:46:01,Delta,43e3b,22c41
2024-11-27,15:46:04,Delta,58e3a,35319
2024-11-27,15:46:07,Delta,5080e,2b81c
#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the directory specified by the shell environment variable TMPDIR
for temporary objects creation and ngdump job simulation. If TMPDIR is
not set, then use "/tmp" for the mentioned purposes;
While running ngdump job in 'dry-run' mode:
. Don't format/mount the target dump device. Instead, create the
bootmap file and the meta-file at the temporary mount point without
mounting anything to it. Thus, the mentioned files to be acrually
created in the "proxy" file system owning the temporary mount point;
. Retrieve base disk info from the read-only dump device and
complete that info with the block size of the proxy file system;
Separate the steps on retrieving/setting file system block size
into a dedicated procedure;
Use definitions instead of hardcoded file names;
Fix a bug in an error path (accessing freed memory);
Make misc_open_simulate() and misc_open_exclusive() static;
Update man pages with the requirements on the system environment
(resources) for ngdump job being executed in dry-run mode;
Provide hints for user (in stderr) in case when ngdump job in dry-run
mode failed due to inappropriate system environment.
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce misc_open_simulate() to mark individual files as "opened
for write simulation".
Introduce misc_open_device() to open a file either in "usual", or
in "simulation" mode, depending on the passed argument
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a write simulation operation, which doesn't write actual
data and just updates the current position in the file.
This allows to emulate block lists for files located on raw devices
(not formatted with a file system). This is used by the next patches
in the series to implement '--dry-run' zipl option for dumps of all
types (not only ngdumps).
Introduce a 'misc file descriptor', which allows to mark individual
files as "opened in a simulation mode".
Whenever bulding a bootmap file, use either real write, or write
simulation depending on the mode set in the 'misc file descriptor'.
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Cpuplugd checks for system polarization before adjusting cpu hotplug
states. Currently, if the sysfs attribute for polarization is not
present cpuplugd does not make any adjustments. Add a new polarization
type PLR_NONE to reflect systems with no polarization state and allow
cpuplugd to adjust cpu hotplugging.
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Free all buffers allocated with malloc before program exit.
Handle memory leak in libcpumf_cpuset().
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allocate the memory required to save the per CPU CPUMF counter value
at the beginning of program execution when the involved number of
CPUs is known. This a bit faster then checking for memory allocation
each time a counter value is retrieved.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line option -H to hide counter value numbers from counters
which are not defined in a counter set. They are usually all zero and
are of no interest.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add option -s or --short to display the header using a short
counter name. With this option the counter symbol names, which can be
very long as in IDCW_ON_DRAWER_DRAWER_HIT are replaced by a shorter
name. That name consists of an abbrevation for the counter set
this counter belongs to and the counter number in that set.
The abbrevations are:
B --> Basic counter set
P --> Problem state counter set
C --> Crypto counter set
E --> Extended counter set
M --> MT_Diagnostic counter set
U --> Undefined counter.
Display E165 for counter name IDCW_ON_DRAWER_DRAWER_HIT
which is counter number 165 from the extended counter set.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move defines from a source file lscpumf.c to the header
file in the include directory to be reused in a follow on
patch. Also reshuffle the list of defines in proper
sequence of increasing numbers.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get a summary of chrony ntp info.
Add config directories for audit and selinux.
Get dmesg log from crash directories.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For the parts of pvapconfig::ap to be moved to pv_core, use
pv_core::Result<a>, i.e. Result<a, pv_core::Error>, instead of
Result<a, String>.
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move assembling APQN struct out of gather_apqns and print non-fatal
warnings afterwards. Allows for moving Apqn to pv_core including this
TryFrom.
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
ApqnInfo is to be moved to pv_core. Move warnings about missing
master/wrapping keys to gather_apqns to avoid stderr output in library
code.
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove sysfs_{read,write}_{i32,string} in favor of pv_core tools,
which support error contexts, making longer error handlings unnecessary.
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Like read_file, this is a function that reads from a file with error
handling conveniences, but that reads to a trimmed string instead of a
byte vector.
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move pvapconfig::helper::u8_to_hexstring to pv_core::utils::encode_hex.
Discard pvapconfig::helper::hexstring_to_u8 in favor of
pv_core::utils::decode_hex.
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There are a couple place with incorrectly used font escape sequences.
$ man --warnings -E UTF-8 -l -Tutf8 -Z rust/pvsecret/man/pvsecret.1
troff:<standard input>:107: warning: cannot select font 'F'
troff:<standard input>:107: warning: cannot select font 'E'
$ man --warnings -E UTF-8 -l -Tutf8 -Z rust/pvsecret/man/pvsecret-verify.1
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:131: warning: cannot select font 'F'
Use the correct escape sequences and regenerate the man pages.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The pvattest man pages are generated mostly from the rust doc entries
within the tool. Some escape sequences and whatis-entries are incorrect
as found by different linter:
$ man --warnings -E UTF-8 -l -Tutf8 -Z ./rust/pvattest/man/pvattest-create.1
troff:<standard input>:23: warning: macro 'create'' not defined
$ lexgrog -w -m rust/pvattest/man/pvattest-verify.1
rust/pvattest/man/pvattest-verify.1: parse failed
Fix this by regenerating the man pages with correct escape sequences and
whatis-entries.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Older versions of pandoc (<3.1.7) can sometimes produce incorrect man
page macros [1][2]. The chreipl-fcp-mpath man page had a few of those:
$ man --warnings -E UTF-8 -l -Tutf8 -Z chreipl-fcp-mpath/chreipl-fcp-mpath.7
troff:<standard input>:5: warning: cannot select font 'CB'
troff:<standard input>:160: warning: cannot select font 'C'
troff:<standard input>:174: warning: cannot select font 'C'
troff:<standard input>:183: warning: cannot select font 'C'
Regenerate the man page using pandoc 3.1.11 to fix those issues.
[1] https://github.com/jgm/pandoc/issues/9020
[2] https://github.com/bin-cli/bin-cli/issues/44
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The vmur man page uses the .SP macro a lot. This is not a valid macro
and it is not defined anywhere.
$ man --warnings -E UTF-8 -l -Tutf8 -Z vmur/vmur.8
troff:<standard input>:92: warning: macro 'SP' not defined
Remove it entirely as the initial intention is unclear and the rendered
man page doesn't change.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The .CL macro was copied from another man page but it is not defined in
the opticsmon man page:
$ man --warnings -E UTF-8 -l -Tutf8 -Z opticsmon/opticsmon.8
troff:<standard input>:70: warning: macro 'CL' not defined
Add the missing definition to fix this.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The SITE-ID parameter in the --site section is supposed to be formatted
as italic. Instead of .I .ID is used leading to misinterpretation and
the mentioning of the parameter missing in the rendered man page.
Found via:
$ man --warnings -E UTF-8 -l -Tutf8 -Z zdev/man/lszdev.8
troff:<standard input>:455: warning: macro 'ID' not defined
Use .I correctly to fix the issue.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The lsqeth man page uses the font change sequence \f without a
parameter, which is not allow:
$ man --warnings -E UTF-8 -l -Tutf8 -Z zconf/qeth/lsqeth.8
troff:<standard input>:13: error: a space character is not allowed in an escape sequence parameter
troff:<standard input>:13: error: a space character is not allowed in an escape sequence parameter
troff:<standard input>:13: error: a space character is not allowed in an escape sequence parameter
troff:<standard input>:13: error: a space character is not allowed in an escape sequence parameter
troff:<standard input>:13: error: a newline character is not allowed in an escape sequence parameter
Fix it by using proper espace sequence to format the specific parts of
the text correctly. This also brings the synopsis a bit more in line
with other qeth tools.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For the --available option the description contains a line starting with
". If", which is intended to be a punctuation and start of a new
sentence but is misinterpreted by groff as a macro. As a result, the
rendered paragraph is incorrectly displayed.
$ man --warnings -E UTF-8 -l -Tutf8 -Z rust/cpacfinfo/man/cpacfinfo.1
troff:<standard input>:128: warning: macro 'If' not defined
Even though it's not consistent with the rest of the man page, use the
font change escape sequence and surround the specific bold formatted
parts to fix this issue and correctly display the sentence.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A single paragraph opening .TP macro at the end of the man page is
causing errors found with:
$ man --warnings -E UTF-8 -l -Tutf8 -Z zconf/zcrypt/zcryptstats.8
troff: error: automatically ending diversion 'an-div' on exit
It also causes the footer of the man page not rendering correctly.
Remove the macro. While at it, remove whitespace damage as well.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
s390 is able to provide memory topology information of the current CEC
via a new userspace-kernel interface. zmemtopo is a tool to convert the
raw data into human readable form.
Usage: zmemtopo [OPTIONS]
Display CEC memory topology of allocated memory increments.
OUTPUT FORMAT OPTIONS
-l, --level NESTING_LEVEL Set the topology display depth to NESTING_LEVEL
-f, --full Display tree view with padded elements
-r, --reverse Reverse tree view hierarchy direction
-t, --table Use table view to display topology
-s, --sort FIELD Sort view by field
(nr, lpar, size)
-i, --ascii Use only ASCII characters
GENERAL OPTIONS
-h, --help Print this help, then exit
-v, --version Print version information, then exit
Upon calling zmemtopo displays available topology level's structure
and memory increments defined on each topology location.
Ex:
$ zmemtopo
LPAR/LEVEL SIZE
LPAR003 8G
└LEVEL4_0 8G
├LEVEL3_0 2G
├LEVEL3_1 2G
├LEVEL3_2 2G
└LEVEL3_3 2G
LPAR005 8G
└LEVEL4_1 8G
├LEVEL3_0 2G
├LEVEL3_1 2G
├LEVEL3_2 2G
└LEVEL3_3 2G
LPAR006 8G
└LEVEL4_3 8G
...
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The actual secure boot state ensures that a Linux instance has loaded
only trusted, signed software. During boot component signatures are
verified. If secure boot is enabled, unsigned or unverifiable components
prevent booting. Since Secure Boot on IBM Z is always triggered by the
hypervisor, its state is merely observable by the active system.
Secure boot: 1 - Linux booted secure (only trusted sources)
Secure boot: 0 - Booted from any source without verification
$ dmesg -t | grep Secure-IPL
setup: Linux is running with Secure-IPL enabled
$ cat /sys/kernel/security/lockdown
none [integrity] confidentiality
$ lsreipl
Re-IPL type: fcp
WWPN: 0x500507630710572c
LUN: 0x4022409600000000
Device: 0.0.1908
bootprog: 0
br_lba: 0
Loadparm: ""
Bootparms: ""
Secure boot: 1
References:
* https://www.ibm.com/docs/en/linux-on-systems?topic=using-verifying-secure-boot
* https://www.ibm.com/docs/en/linux-on-systems?topic=introduction-requirements
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The default sysfs path is always set to '/sys' unless the SYSFS_ROOT
environment variable is defined.
To address security concerns, secure_getenv() is used within
util_path_sysfs() to protect against malicious values in SYSFS_ROOT.
Additionally, constructing the sysfs path dynamically in an allocated
buffer, rather than using a fixed-size buffer, helps prevent potential
buffer overflows.
These modifications also significantly improve testability by allowing
sysfs read and write operations to be redirected to an alternative file
path, which enables testing without affecting the active system state.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function is no longer required since the removal of the PHYSDEVPATH
entry in /sys/block/%s/uevent with commit 39aba963d937 ("driver core:
remove CONFIG_SYSFS_DEPRECATED_V2 but keep it for block devices") in
2010.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The default sysfs path is always set to '/sys' unless the SYSFS_ROOT
environment variable is defined.
To address security concerns, secure_getenv() is used within
util_path_sysfs() to protect against malicious values in SYSFS_ROOT.
Additionally, constructing the sysfs path dynamically in an allocated
buffer, rather than using a fixed-size buffer, helps prevent potential
buffer overflows.
These modifications also significantly improve testability by allowing
sysfs read operations to be redirected to an alternative file path,
which enables testing without affecting the active system state.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The default sysfs path is always set to '/sys' unless the SYSFS_ROOT
environment variable is defined.
To address security concerns, secure_getenv() is used within
util_path_sysfs() to protect against malicious values in SYSFS_ROOT.
Additionally, constructing the sysfs path dynamically in an allocated
buffer, rather than using a fixed-size buffer, helps prevent potential
buffer overflows.
These modifications also significantly improve testability by allowing
sysfs read operations to be redirected to an alternative file path,
which enables testing without affecting the active system state.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix typo in comment also helps to prevent pre-commit hook issues, w/o
functional changes or changes in behavior.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove unnecessary empty lines to prevent pre-commit hook issues, w/o
functional changes or changes in behavior.
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'convert' command converts a LUKS2 volume that uses a clear volume key
and the 'aes' cipher to use a secure volume key and the 'paes' cipher.
Optionally, the volume can use the integrity option with LUKS2 using a
clear key integrity key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Starting with cryptsetup version 2.5.0 the luksFormat command accepts
option '--volume-key-file' to specify the volume key file. Option
'--master-key-file' is still accepted as an alias to '--volume-key-file'.
Follow this pattern with the zkey-cryptsetup tool and also accept both
options '--volume-key-file' and '--master-key-file'. The short option
form stays '-m' for compatibility reasons (cryptsetup does not have a
short option for that).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Messages from libcryptsetup for logging level CRYPT_LOG_DEBUG
may or may not include an EOL, dependent on the cryptsetup version:
Between libcryptsetup version 2.1 and 2.2 debug messages do not
include an EOL character, but since 2.2 they do.
Append an EOL only if the message does not already end with EOL.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The key supplied in the plain bytes file with 'pvsecret create retrievable'
with type 'hmac-sha' is they key 'K_0' as of FIPS-198-1, i.e. the key 'K'
after any necessary pre-processing. The pre-processing must be performed
by the user prior to creating the retrievable secret.
Describe in detail how that pre-processing must be performed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add installation targets for bash and zsh autocompletions for the PV
related tools. Do not use them by default.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zpwr displays power readings of a partition and central processing
complex (CPC) from power information block (pib). pib is retrieved by
issuing diag324 ioctl to /dev/diag device.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The script scsi_logging_level was made available in sg3_utils 2007 [1]
copied from s390-tools. The last functional change in s390-tools was
made 2006.
The sg3_utils version saw at least some improvements over the years.
Providing otherwise identical tools can lead to unnecessary conflicts.
Delete the script from s390-tools and let sg3_utils provide it.
[1] 7502647d46
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/184
Acked-by: Nihar Panda <niharp@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the padding of keys that are smaller than the architected slot for
the retrievable key. Previously the keys where appended with zeros.
However, processing software expects a left-padding.
Affected key types:
* Ed448
* SecP521
While at it, fix documentation in the retrievable key struct.
Fixes: fd024387d7 ("rust/pv: Retrievable secrets support")
Acked-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use STAGE2_DUMPER_SIZE_MV size for eckd_mv dumper v2
in df_s390_dumper_read() to verify the dump tool.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update eckd2dump linker script to remove stage2 space constraints and
avoid linker section overlaps when using 'unfortunate' compiler
version & flags combination.
Since Multi-volume dumper size changes, we also update the dump-tool version
number for 'zgetdump' to distinguish.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/171
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The tooling already supports the PAI counters to the respective CPACF
functions introduced with MSA 10 and MSA 11 but the manpage did not
reflect that until now. The list of pai counters is moved to a new
section called APPENDIX to not block any important information with the
list.
Additionally a few double space after end of sentences are removed.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cpacfstatsd can be run successfully on z/VM and KVM mashines, but the
service unit did not allow that. A user would have to start the
cpacfstats daemon by hand every time until now.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Define the network devices as global variable with closer selection
to avoid repeated calls with undefined interfaces.
Relable the OSA part of networks.
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This fixes problems when users search for '--comm-key' in the help
message.
Fixes: 5b6d7a467d ("rust/pvimg: Add '--cck <FILE>' command line option and make '--comm-key' an alias")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix whatis-entries in the lshwc, lspai, and pai manpages by inlining the
tool name. The following command line can be used to test a local
manpage:
$ lexgrog -w -m cpumf/man/lshwc.8
cpumf/man/lshwc.8: "lshwc - extract CPU Measurement Facilities counter sets"
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Keys of type PVSECRET-AES can also be verified via the pkey IOCTL
PKEY_VERIFYKEY2, but the card and domain fields must be zero, because such
a key does not use a crypto card. Also XTS keys of type PVSRCRET-AES are
not represented by 2 concatenated keys but by just one key of type
PVSECRET-AES. Thus, special handling is required for XTS keys.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Keys of type PVSECRET-AES can not be reenciphered using 'zkey reencipher'
or 'zkey-cryptsetup reencipher'. Reject that with a proper error message.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Keys of type PVSECRET-AES can not be generated using 'zkey generate'.
Furthermore, APQNs can not be associated with keys of type PVSECRET-AES
via 'zkey change'. Reject that with a proper error message.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The 'pvsecrets import' command imports a protected virtualization secret
into the zkey key repository. Like other key import or key generation
commands, additional information can be associated with the imported key,
such as a textual description, the volume to encrypt with together with
the volume type, the sector size, and a dummy passphrase. You can not
associate a set of APQNs, since a protected virtualization secret does
not need or use a crypto card.
This command only works when running in a secure execution guest.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add the definitions and utility functions for the PVSECRETS-AES key type.
A PVSECRETS-AES key token contains the secret id of a protected
virtualization secret. It does not contain the key material, just a
reference to the key in the ultravisor.
When such a key token is used to perform crypto operations later on, the
PAES kernel cipher will obtain the protected key belonging to this secret
id with the help of the pkey kernel module.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The 'pvsecrets list' command lists the available protected virtualization
secrets. By default, only those pvsecret types are listed, that can be used
with zkey. If option '--all/-a' is specified, then all pvsecret types are
listed. Nevertheless, pvsecret types not supported by zkey can not be used
with zkey.
This command only works when running in a secure execution guest.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add functions to interface with the ultravisor device (/dev/uv) when
running in a secure execution guest to retrieve a list of available
secrets.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Before this change:
$ lexgrog -w -m man/pvimg-create.1
man/pvimg-create.1: parse failed
After this change:
$ lexgrog -w -m man/pvimg-create.1
man/pvimg-create.1: "pvimg-create - Create an IBM Secure Execution image"
In addition, pvimg is highlighted in the manpage description section.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since there have been breaking changes, let's fix them. Fortunately,
there was only one problem to fix.
Command line used:
$ cargo upgrade --incompatible -p 'thiserror'
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Secret IDs identify a secret in the store. Tooling (pvsecret) calculates
them by hashing a user-defined string. With this patch it is now
possible to skip the hash step and directly use the input string as the
ID. Up to the first 31 bytes of the input ASCII-string are used. The last byte
is the NUL char. During list pvsecret tries to interpret the secret
as ASCII string and if possible displays the ASCII characters alongside
the hex number.
Also, use the Upper/Lower Hex formatters for the hexstring formatting of
SecretId. Display will, additionally show the ASCII representation if
applicable.
While at it, use Self wherever possible.
Acked-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make use of the enhanced list secrets UAPI for the uvdevice in the latest kernel
version. This allows fetching secret lists with more than 85 entries via
reserving more userspace memory in the IOCTL argument.
While at it, move the errno readout next to the ioctl-syscall.
Acked-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve the secret list implementation. Use structs+{As,From}Bytes
instead of arbitrary seeks and reads/writes to parse the secret list.
Acked-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While at it, add a file global #[allow(dead_code)].
The file is a rustified copy of linux/arch/s390/include/uapi/asm/uvdevice.h
and there might be things that are not needed here but are defined in that header.
Acked-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move the script to 'genprotimg/samples/check_hostkeydoc' and create a
symlink at 'rust/pvimg/tools/check_hostkeydoc' in order to keep
compatibility with existing documentation. The problem with the original
fix was that the github.com website does not follow symbolic links.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rename '--key' into '--hdr-key' and use '--key' as an (non-visible)
alias for '--hdr-key' in order to keep the command line backwards
compatible. The chances of someone using '--key' are very low, as this
version has not yet been released by any OS distribution.
This change makes the command line options for the different subcommands
more consistent and therefore easier to use.
Suggested-by: Reinhard Bündgen <buendgen@de.ibm.com>
Acked-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A Secure Execution header V1 can be at maximum two pages large, optional
items are not supported, and the size of the encrypted part cannot be
larger than the total size of the Secure Execution header add this as
Deku assertions and additional conditions to the code. In addition, add
a check for the number of key slots.
Fixes: f4cf4ae6eb ("rust: Add a new tool called 'pvimg'")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix memory leak of @template_raw. The documentation of CString::into_raw
reads:
"Consumes the CString and transfers ownership of the string to a C
caller.
...
Failure to call CString::from_raw will lead to a memory leak." [1]
Let's fix the memory leak by always calling `CString::from_raw` and
therefore reclaim the ownership.
[1] https://doc.rust-lang.org/std/ffi/struct.CString.html#method.into_raw
Fixes: e56acf4f14 ("pv_core: add `TemporaryDirectory`")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On kernels without support for the new "measurement_chars_full" CHPID
sysfs attribute, chpstat displays invalid utilization numbers (nan/inf).
This is due to an invalid buffer address calculation when reading the
old "measurement_chars" attribute.
Fix this by using the correct buffer address calculation.
Fixes: 026ecbafea ("chpstat: Add support for full CMCB")
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add '--hdr-key <FILE>' as a command line option to the 'pvimg create'
command. This key can then be used later to decrypt the Secure Execution
header of a Secure Execution image, e.g. 'pvimg info --key <FILE>
--format json <SE_IMG>'. While updating the manpages, add missing hyphen
escapes in the manpages.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case when target parameters are specified by user, the check
that a file locates on a specified device, compares a logical
device with a base disk, which is incorrect.
Fix the check to compare base disks (a specified one with the base
disk determined by disk_get_info() procedure called w/o any user
hints).
Fixes: c0f02d2f68 ("zipl/src: Fix problems when target parameters are specified by user")
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Steps to reproduce the problem:
\# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 5G 0 loop
|-loop0p1 253:15 0 128M 0 part
`-loop0p2 253:16 0 4.9G 0 part /mnt
\# ./zipl_helper.device-mapper 253:16
Expected result:
targetbase=7:0
targettype=SCSI
targetblocksize=4096
targetoffset=32784
Actual result:
targetbase=253:16
targettype=SCSI
targetblocksize=4096
targetoffset=32784
The problem is in a missed step which resolves the uppermost
logical dm-device to a physical device. Reproducible only for loop
devices.
Add missing step to correctly resolve to a physical device.
Fixes: 670bf3e870 ("zipl: refactor zipl_helper.device-mapper")
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix possible 'range start index 16 out of range for slice of length 0'
error by adding a check of the slice data length.
Fixes: f4cf4ae6eb ("rust: Add a new tool called 'pvimg'")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add '--cck <FILE>' as an command line option and make '--comm-key' an
alias of it. This makes the command line more similar to the other
Secure Execution related PV-tools (e.g. pvattest and pvsecret).
Suggested-by: Reinhard Bündgen <buendgen@de.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With runtime attestation it might be useful to have non-encrypted Secure
Execution images. This patch adds the support for this to the 'pvimg
create' and 'genprotimg' commands.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Finding a PCI device given the name of a netdev seems generally useful
so pull this out into a new zpci_find_by_netdev() function in libzpci
and use this to simplify on_link_change() removing the need for
backwards goto.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When on_link_change() gets called with a netdev that would be monitored
but hasn't entered zpci_list yet, reloads is 1 after the loops and
a reload occurs. Then the netdev is found in the list and reloads
becomes -1 which incorrectly triggers more reloads until underflow.
Fix this by returning once the device is found. Also just check for
reloads being larger than zero.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create a symbolic link to the new location of the 'check_hostkeydoc'
script in order to keep compatibility with existing documentation.
Reported-by: Stephan Hartig <hartig@de.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The output of ziorep_utilization tool currently contains reports for both
the physical and the virtual adapter. As binding of physical and virtual
adapter reports together can be confusing for evaluation of results, introduce
--fcp-device tool parameter for reports separation. This parameter was
introduced to mark virtual adapter report as it represents utilization report
of FCP devices.
So, if --fcp-device was specified by the user, virtual adapter report is
printed. Otherwise physical adapter report is printed.
Parameter --fcp-device has no influence on CSV format report printing.
Refactor also print_reports() function for both reports for better
--fcp-device parameter handling.
Add clarification messages on how to use --fcp-device parameter.
Delete empty separator line between former two reports.
Add description of --fcp-device parameter to man pages.
Add examples for using of ziorep_utilization tool to man pages.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Sakshi Singh <005c7w@linux.ibm.com>
Reviewed-by: M Nikhil <nikh1092@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In ziorep_utilization tool physical adapter report represents PCHID
scope, rather than CHPID. PCHID column is added as a very first column of
physical adapter report for non-CSV format report.
Old version of physical adapter report with CHPID column only
looks like:
...
CHP|adapter in %-|--bus in %---|--cpu in %---|
ID min max avg min max avg min max avg
2020-05-14 14:00:41
60 0 0 0.0 1 1 1.0 0 0 0.0
61 0 0 0.0 1 1 1.0 0 0 0.0
...
New version of physical adapter report with additional PCHID column
looks like:
...
PCH |CHP|adapter in %-|--bus in %---|--cpu in %---|
ID ID min max avg min max avg min max avg
2020-05-14 14:00:41
01c0 60 0 0 0.0 1 1 1.0 0 0 0.0
01c1 61 0 0 0.0 1 1 1.0 0 0 0.0
...
For CSV-format report PCHID column is appended to the end of each record line.
For older kernel releases, where PCHID sysfs entry is not available, replace
PCHID column value with "n/a".
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Sakshi Singh <005c7w@linux.ibm.com>
Reviewed-by: M Nikhil <nikh1092@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add an ability for ziorep_config tool to extract PCHID additional adapter
parameter from .config file. With this patch device_info structure will have
pchid field, which can be used by different printers classes. Also add
function for querying PCHID by using of devno for providing reports. Translate
"n/a" field from .config file record into invalid PCHID number.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Sakshi Singh <005c7w@linux.ibm.com>
Reviewed-by: M Nikhil <nikh1092@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ziomon_fcpconf saves a lot of information about adapter into .cfg file.
With this patch ziorep_config tool will extract PCHID additional adapter
parameter from .cfg file and put it into .config file for future evaluation by
ziorep_* tools group.
This patch also adds notification for cases, when chid sysfs entry does not
exist for specified CHPID, for example for old kernels.
Before patch application typical line example from .config file looked like:
... 253:0 /dev/sde 8388672 8:64 Disk
After application of the patch typical line example from .config file
looks like:
... 253:0 /dev/sde 8388672 8:64 Disk 01c0
On older distros, which do not contain pchid sysfs entry, typical line
example from .config file looks like:
... 253:0 /dev/sde 8388672 8:64 Disk n/a
As PCHID value of FCP adapter can now be extracted from .config file,
add PCHID field to report of ziorep_config tool.
If there was no PCHID sysfs entry on the system, print following message into
ziorep_config command output:
...
PCHID: there is no PCHID entry in data source
...
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Sakshi Singh <005c7w@linux.ibm.com>
Reviewed-by: M Nikhil <nikh1092@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add device bus-ID to ziorep_traffic output for better distinguishing
of paths in setups, which have paths in the same pathgroup with same
WWPN and LUN.
Output without device bus-ID column:
$ ziorep_traffic log
WWPN LUN ...
...
2019-10-21 11:44:38
0x50050763071bc5e3:0x4006404f00000000 ...
0x50050763071bc5e3:0x4006404f00000000 ...
Output with device bus-ID column:
$ ziorep_traffic log
DEVBUSID WWPN LUN ...
...
2019-10-21 11:44:38
0.0.1980:0x50050763071bc5e3:0x4006404f00000000 ...
0.0.19c0:0x50050763071bc5e3:0x4006404f00000000 ...
After patch application device bus-ID can also be seen in detailed
(with -D option) output and in CSV output format (with -x option).
Also adjust output headings correspondingly.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Sakshi Singh <005c7w@linux.ibm.com>
Reviewed-by: M Nikhil <nikh1092@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The optics monitoring tool opticsmon implements the user-space portion
of reporting optics data to the SE. Its basic functionality is to
collect optical module information equivalent to "ethtool --module-info"
for PCI Physical Functions and forwards this data to the SE using the
new SCLP Write Event Data Action Qualifier 3.
For the part of finding all PFs we need to look at all PCI
functions and determine which ones are PFs and what netdevs they
correspond to. This is a generally useful functionality so this part as
well as the SCLP issuing code go into a new libzpci library which also
includes a standalone example for listing PCI functions and their s390x
specific attributes. Medium term we plan to add this functionality to
lszdev.
For the opticsmon tool itself there are 2 basic operating modes:
* One-shot Mode: Without parameters opticsmon collects optical module
data and prints a summary of the netdevice in JSON format. With
--module-data it also includes a base64 encoded raw dump equivalent to
ethtool --module-info <netdev> raw on.
* Monitor Mode: With the --monitor flag opticsmon runs continuously
usually started via a systemd unit and collects new optical module
data on a time interval (default 24h) or when the operational state
("/sys/class/net/<netdev/operstate") changes. The tool listens for
changes via netlink so no polling on sysfs is necessary
Note: Both modes will *NOT* issues SCLPs without adding the
--send-report flag but will output a JSON summary for each data
collection so can be tested without firmware impact.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add zpci_is_vf() helper based on the /sys/bus/pci/devices/<dev>/vfn
attribute which is non-zero for VFs unlike the common code VF number
which starts at 0.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The upcoming optics monitoring tool will have to issue SCLP Write Event
data just like zpcictl so pull that functionality out and into libzpci.
While at it decouple getting SMART data from the actual SCLP handling.
No change in behavior intended.
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The SCLP report currently always uses the maximum length even if no
extra data is proved at all. Instead use the actual length of either
just the timestamp and err_log_id or additionally the length of sdata.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This introduces libzpci which is a library intended to handle s390x
specific PCI attributes and peculiarities. As a first step it introduces
code to list PCI devices on s390x including an initial set of s390x
specific attributes like FID, PFT, UID etc. It also collects information
on network device associated with a particular PCI function. The
included example serves as a demonstration of using libzpci to list PCI
devices.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Without including stdio.h before util_file.h tye FILE type will not be
known leading to a build failure. Fix this by including stdio.h.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The '--help-all' and '--help-experimental' flags are now considered
deprecated, but should still be available for backward compatibility.
Fixes: f4cf4ae6eb ("rust: Add a new tool called 'pvimg'")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Removes the C implementation of genprotimg and use the Rust
implementation instead.
Adapt the README.md accordingly.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support for enabling/disabling the backup keys and HMAC-PCKMO key
encryption function plaintext control flags in the Secure Execution
header.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add metadata about the image to the Secure Execution image. This helps
to identify where the Secure Execution header is located in the image
and therefore it's less prone to errors to locate the header.
This patch adds the support for it to 'pvimg' as well as to the
'pvsecret' and 'pvattest' tools.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new tool called 'pvimg' that can be used to create and inspect
Secure Execution images. It has several subcommands:
+ create: create an IBM Secure Execution image (genprotimg compatible
sytnax) and C-'genprotimg' is going to be replaced by a
symlink to this subcommand.
+ test: test various aspects of an existing Secure Execution image
+ info: print information about an existing Secure Execution
image (experimental API!)
+ version: print version and exit
As mentioned above, the 'genprotimg' tool is now a symbolic link to the
'pvimg create' subcommand and the CLI is backward compatible with the
original genprotimg CLI, with the following exceptions:
- '-v' increases the verbosity instead of showing the version
- '-V' is now deprecated in favor of '-v'
- an existing output file is no longer silently overwritten, but there
is a new flag '--overwrite' to get the original behavior
- experimental options are no longer described in the help
- the commands '--cert ...' and '--root-ca' are now mutually exclusive
- to '--no-verify'
- there is now a component check, e.g. it checks if the specified
Linux kernel looks like a raw binary s390x kernel. These checks can be
disabled by using the new command line flag '--no-component-check'
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Hardcode the location and size of the BSS section of stage3a to 0xc000
and 0x1000. This change is made in preparation for storing the Secure
Execution image metadata at the address of the BSS section of stage3a.
The idea behind this is that since there is no ELF loader involved, the
stage3a loader will memset it's BSS section and therefore the Secure
Execution image metadata to 0. This way, it's avoided having any
leftover metadata after running the stage3a loader.
In addition, add .bss.* as input sections for the .bss section.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change is done in preparation for the Rust port of genprotimg.
While at it, format the code using `clang-format`.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new Rust port of genprotimg will have the name 'pvimg' as it has
more functionalities than the original genprotimg tool. As preparation
add a Secure Execution header library and an example how to use it. The
example can be used by the KVM-Unit-Tests for creating the Secure
Execution headers needed by the tests [1].
[1] See dc4f7106f3
more information how to use.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A manpage auto-generation tool can use this trait to get the exit codes
and their documentation of a program.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Refactor `seek_se_hdr_start` so it can be reused. While at it, improve
the documentation of it and format the code.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Command used:
$ cargo +nightly clippy
...
warning: doc list item without indentation
--> pvapconfig/src/ap.rs:71:5
|
71 | /// This may take some time and even loop forever if there
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the ordering of the parameters in 'TryFrom<Confidential<Vec<u8> for
Confidential<[u8; N>'. While at it, convert 'LengthMismatch' error to a
named struct.
Fixes: 7608cf2de4 ("rust/confidential: Add `From` and `Into` for confidential byes arrays/vectors")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the following error:
$ make CROSS_COMPILE=s390x-linux-gnu- HOST_ARCH=s390x
../../../common.mak:117: *** Please specify CROSS_COMPILE=... and try it again!. Stop.
$ make --version
GNU Make 4.4.1
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add column 'UTIL DATA' that indicates the percentage of channel-path
data bandwidth currently in use. Since channel-paths are bidirectional,
this column represents the maximum of read or write bandwidth
utilization.
Also use this new column in place of 'UTIL BUS' for CMG 4 and 5 default
views since the bus utilization no longer provides a relevant value for
DPU-based channel-path types.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New machine models introduce CHPIDs with two new CMG types 4 and 5.
Add support for decoding the associated channel-measurement data.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer kernels provide the full, unfiltered Channel-Measurements
Characteristics Block (CMCB) via a new sysfs attribute named
"measurement_chars_full".
Add support for reading the full CMCB data if available in preparation
of new tool functions that will make use of this data.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The utilization visualization column does not provide meaningful data
when using structured output. Omit it when an output format has been
specified on the command line.
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a new command line flag ("--format") to specify the output
format in batch mode. Valid options are "pairs" for shell-compatible key
value pairs, "csv" for CSV, "json" for a formatted JSON document, and
"json-seq" for a stream of JSON text sequences as per RFC7464[1].
[1]: https://datatracker.ietf.org/doc/html/rfc7464
Note: Specifying the --format flag implies the --batch_mode flag.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The separator line is written as part of the input processing step and
is better be moved to the place where the table is actually written.
Same goes for the terminating '\n' which is performed as the final step
while updating the terminal in batch mode.
While at it, use the designated print functions over raw printf().
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For structured output (i.e. JSON), some type information of the columns
is required, at least the ability to distinguish values that are strings
and possibly need to be quoted. Unfortunately at the time column values
are formatted this information is lost.
The column types are specified implicitly during the unit conversion of
the raw value. For example, online time is stored as a u64 value but is
converted into a "d:h:m" string.
Introduce a private flag per column that signifies if that column is to
be formatted as a string. This flag will be set in the appropriate unit
conversion function.
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This type helps to perform atomic operations by writing to a temporary
file and renaming it to the actual filename when the
`AtomicFile::finish` function is called. If the `AtomicFile::finish`
function is never called, the temporary file is automatically removed
when it goes out of scope. It utilizes the `renameat2` [1] libc function
and its semantics.
[1] https://man7.org/linux/man-pages/man2/renameat.2.html
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename "Authenticated Encryption with Associated Data" (AEAD)
encryption/decryption functions and change the result type. This makes
the functions easier extendable. In addition, it's now possible to use
the functions as following:
`encrypt(decrypt(data)) == decrypt(encrypt(data) == data`
Add more AES and SHA related constants and use them whenever possible.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename `Aes256*` to `Aes256Gcm*` and add a deprecated constant with the
old name for backward compatibility. Adapt existing code to use the new
enum variant.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Combine linker scripts for single volume and multi-volume ECKD dumpers
to avoid duplicating. Use C preprocessor to define conditional symbols.
Cleanup the generic stage2 linker script(stage2.lds). Since it is still
used for FBA and TAPE dumpers (fba2dump and tape2dump) the .stage2dump.tail
section should be preserved.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Move MVDUMP_TOOL_SIZE contsant to loaders_layout.h and rename it
to STAGE2_DUMPER_SIZE_MV.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Write the secret metadata into the same directory as the generated
secret request. Before, the metadata was accidentally written into the
working directory.
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Check if the SE-guests machine firmware is in an IBM approved state.
The machine firmware version can be obtained via setting a flag in the
attestation request.
The opaque 320 byte value from firmware is forwarded to an IBM server
that verifies the firmware value and confirms if the machine is in an
IBM approved firmware state.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a check to verify the hash over the Secret Store in the guest UV
storage. During 'create' the user can request that hash via a flag. During
'check' the user specifies the Add Secret requests and check whether the store is
locked. If the calculated hash over this state matches the one reported
by attestation, this check is successful.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a new command: check. This allows users to perform policy checks on
the Attestation result.
The host-key hashes, and the user-data can be tested for certain values.
While at it fix some typos and enable CSV parsing for the Additional-data flags.
Example:
```
pvattest check attestresp checkresult -k hkd0.crt,hkd1.crt
--host-key-check AttKeyCheck
```
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add additional data for the Attestation request. The secret store hash
measures all added secrets and the state of the store (locked or not)
with a single hash. The hash is computed by concatenating all add-secret
request tags (16 bytes each) and a byte stating the locked state (1 for
locked, 0 for not locked). The firmware state is an opaque state
description of the systems firmware status to be interpreted by an IBM
service. Add request flags and fields in the additional data structure.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add an unrecognized field to the AdditionalData struct that contains any
data that is not known by the library. Generalize the intention of the
additional data read function and make extensions to Additional data
easier. Add tests for serialization.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename 'ATT_ADD_HASH_SIZE' to 'PHKH_SIZE'. The new name describes the
value better. It is the size of the Public Host-Key Hash and not the
size of a generic additional-data item.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the new `cargo clippy` and `cargo doc` findings that were triggered
with the recent policy addition.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
With the recent changes in the pkey kernel module to split it up into
sub-modules, as well as the addition to support Secure Execution
retrievable secrets, an update to the list of modules to copy to
initrd is required.
Besides the pkey module itself, all its sub-modules must be copied.
Furthermore, sub-module pkey_uv requires the uvdevice modules, so copy
this, too.
While at it, remove the old drivers zcrypt_cex2a and zcrypt_pcixcc,
those are not provided anymore since at least 2 years.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Sync all install targets implementations. Some did quote the target
directories some don't. Remove all quotations. This fixes wrong install
locations of install paths that have a '~'. With quotes '~' is
interpreted literally instead of using the home dir.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Enables API users to get the request tag of an Add-Secret request.
This enables them to check for attestation policies.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Allows API users to inspect the value of additional data to use it as
part of a policy check.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This struct is not exported. Prevent any accidental exports by reducing
the visibility to pub(crate).
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename the previous "default" `new` constructor [1] to `with_prefix` and
add a new default `new` constructor that takes no argument is therefore
easier to use.
In addition, improve the overall documentation, add more tests, and
examples to the code.
[1] https://doc.rust-lang.org/nomicon/constructors.html
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use the `enum_dispatch` macro for providing the `From` and `TryInto`
functionalities. In addition, it makes dynamic dispatching using enums
much easier.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Implement `From<SymKeyType> for Nid`. This makes it easier to implement
generalized functions.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This is currently the only key type supported, therefore rename the
function to make this clear. In addition, improve the documentation of
the function as function is now exported.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The library is used by multiple PV related tools, not only for managing
the guest secret store.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Make EcPubKeyCoord available, after renaming it from EcdhPubkeyCoord.
This enables API users to calculate the hash of a public host-key and
compare it to a hash from attestation.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Create one implementation for the verbose option to be used by all
tools. While at it, add a quiet option to decrease the verbosity.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Newer s390 kernels provide the new sysfs /sys/firmware/dump/dump_area_size
attribute which specifies the exact size of machine's dump area size.
Use this value if it is present but fall back to the previous and
slightly improved way of computation of dump area size to support
also older s390 kernels w/o the new sysfs attribute. This has
the advantage that util_arch_hsa_maxsize() has no longer to be adapted
with every introduction of yet another machine type in the future.
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The linear search in the nested loop over SCSI devices and over the indexed
array is still time consuming. So replace the indexed array with an
associative array. Build the array once outside of the nested loop by using
pathname expansion and extracting key and value from each item. Within
the SCSI device loop, an array entry is removed by means of the key without
linear search.
This commit is separate from the previous one so it is possible to revert
this one in case associative arrays would not be available and still get
the speed improvement from the indexed array in the previous commit.
Before:
$ time ~/git/s390-tools/zconf/lszfcp -De | wc -l
1036
real 0m17.605s
user 0m17.159s
sys 0m0.308s
After:
$ time ~/git/s390-tools/zconf/lszfcp -De | wc -l
1036
real 0m0.207s
user 0m0.175s
sys 0m0.032s
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Apparently the repeated string concatenation and word splitting was
much slower.
While at it, also remember in $ZFCP_UNIT_PATH whether the loop over
ZFCP_UNIT_ARRAY already found a zfcp_unit and re-use the path string to
replace the previous file glob construct generating the zfcp_unit path by
means of pathname expansion. This only works for the extended output case.
Before:
$ time lszfcp -De | wc -l
1036
real 2m15.387s
user 2m9.323s
sys 0m5.130s
After:
$ time ~/git/s390-tools/zconf/lszfcp -De | wc -l
1036
real 0m17.605s
user 0m17.159s
sys 0m0.308s
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Just go ahead and read the sysfs attribute directly as the syscalls are
needed anyway.
If necessary stderr could be redirected to /dev/null in the future,
but there was no case so far where the attribute did not exist.
This does not make a runtime difference when running on sysfs. Change it
anyway to avoid somebody searching for speed improvement options stumbling
over it again.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
It's not on the hot path as the glob match is done only once.
But there is no point in matching anything but SCSI devices
such as "fc_transport" and "subsystem"
just to have an additional child process filter it once more.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
A simple built-in parameter expansion removing the matching prefix
pattern (everything up to and including the last slash) is sufficient to
strip the path from the basename.
Speeds up "lszfcp -D" significantly.
Before:
$ time ~/git/s390-tools/zconf/lszfcp -D | wc -l
1028
real 0m5.322s
user 0m0.300s
sys 0m4.907s
After:
$ time ~/git/s390-tools/zconf/lszfcp -D | wc -l
1028
real 0m0.602s
user 0m0.100s
sys 0m0.492s
Above measurements are from the fast in-memory sysfs. The improvements are
likely amplified when running "lszfcp --sysfs ..." on collected debug data
in a regular file system.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
An online CCW device, which is available and not defunct and not failed,
can have an undesired fc_host port_state, which is not Online and does not
have the special case Linkdown. Indicate such unexpected state.
Complements
v2.9.0 commit 4036e80b26 ("lszfcp: add new output marker for non-good FCP
devices (hosts)")
v2.9.0 commit be7b854969 ("lszfcp: also mark FCP devices (hosts) that are
not available")
v2.18.0 commit 45e3f016f4 ("lszfcp: add linkdown case to host marker of
extended output")
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Switch from atoi() to existing parse_int() helper function for parsing
the integer --cmg argument to better handle invalid values such as
numbers followed by an unsupported suffix (e.g. 1x).
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
At the moment the memory range of processed vmdump always corresponds to
the highest defined byte (q v storage) obtained from Address Space
Information Block ignoring memory ranges specified in CP vmdump command.
This might lead to the invalid dump size calculation upon conversion to
s390 format.
Use Requested Range Table from ASIZBK to identify actual memory ranges
being dumped. Consider the end of the highest memory range as a vmdump
upper limit (dump memory size). In case no range table entries present
fall back to the original method using 'storage_size_def_store' value.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This patch adds support for zipl targets over partitions of md-devices.
With this patch it is possible to specify a zipl target over any
partition of an md-device, so that all the physical disks participating
in the mirrored setup will be prepared for IPL.
Unlike a whole md-device which has major number 9, its partitions
have major numbers 259 and the driver name is identified as 'blkext'
in '/proc/devices'. Handle this case in set_driver_name(): call ioctl()
to make sure that device is an md-partition.
Drop re-definition of some macros.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add "zhypinfo" as an overview on Hypervisor structure in runtime.out
Get an overview of all block devices in front of the detailed outputs
using "lsblk" into runtime.out
Starting OpenSSL3.0 "openssl engine" is deprecated and needs replacement by:
"openssl list --providers" (keep "engine" for older versions)
Suggested-by: Christian Rund <Christian.Rund@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Define and set the minimal supported Rust version (MSRV) to 1.75.0. This
is the (current) minimal supported version over all supported distros
that use rust in s390-tools.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
String is more or less a Vec<u8> with some extra invariants (i.e. only
UFF-8 chars). Zeroroize is implemented by calling the Vec<u8>
implementation. The zero byte is a valid UTF-8 symbol. The String
invariant is uphold by the clearing code.
Also, implement a into_inner function for clone-able inner types.
This allows converting confidential types into no-confidential types.
As Drop is implemented this requires a clone (see E0509).
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Generalize the `Confidential` impl over Vec<T> and [COUNT; T] instead of
specializing T to u8.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Migrate Confidential to pv_core crate. This has no impact on the public
API of pv as the migrated symbols are reexported.
This enables pv_core to manage confidential data as well.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The size of an EC-secp521r1 signature can be up to 139 bytes (if ASN1
encoded). There is no lower bound, although sizes lower than 137 are
very unlikely but possible.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The new cpacfinfo command provides information about CPACF, such as which CPACF functions are installed, and make use of the new MSA 13 Query Authentication Information function.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add extra trace logs for vmdump processing.
Log number of Index Pages, Bit-Key Pages and actual stored pages in the
vmdump.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new format option to HexSlice to print every byte with a separated
space in between. Additionally the old format option 'alternate'
together with the new one results in another new format which prints
every byte separated by a space AND every byte has a leading '0x'.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Co-developed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
It's uncommon and prone to error to silently stop decoding/parsing a
hex-string if there is an invalid character. Therefore, add a new
function `decode_hex` which fixes this behavior and use it in the code.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make it possible to convert internal key format to OpenSSL public key
format and vice versa. E.g. this can be useful when reading UV data
structures.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This makes it possible to reuse the constant. In addition, change the
type from i32 to usize since the value describes a size.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The size of an AES key depends on the mode of operation, so add this
information at least in the comments, as the API cannot be changed as it
is already published.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use Self instead of the struct name whenever possible.
Automagically replace struct name with Self:
`cargo clippy --fix -- -W clippy::use_self`
This streamlines the code.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a queue is removed from a SE guest which was in a state other
than "usable" (for example "unbound") the state displayed by lszcrypt
switches to "usable" until the queue device is finally removed by the
AP bus scan running every 30s.
This intermediate state is caused by reading 0x00000000 on the
underlying /sys/devices/cardxx/xx.yyyy/ap_functions. lszcrypt only
extracts the BS bits from this value and maps these both bits to
string output
0: "usable"
1: "bound"
2: "unbound"
3: "illicit"
totally ignoring the fact that there is no AP function at all.
Now the code checks for a valid ap_functions value first, before
actually extracting and displaying the SE state. In case the
ap_functions reads as 0x00000000 lszcrypt now displays the string
"invalid".
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
According to vmdump format, each bit of the Index page represents a Bit-Key
page and indicates if that Bit-Key page exists.
Due to the bug in vmdump64big_init() only 4096 bits of the Index Page were
processed instead of 32768. Thus for vmdumps of guests with defined storage
above 64G we could have invalid memory_start_record calculated. This ruins
the VMDUMP mem chunk read callback function.
One of the problem symptoms reported was missing UTS data in
'zgetdump -i' output caused by inability to locate OS_INFO in the dump.
Fixes: 067dd5c7ef ("zdump: Add vmdump dfi for vmdump format to elf format")
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer rust std libary code checks if a fd is already closes and panics.
Test code created a file with fd=17 and relied that test code never
touched the file. This cannot be done anymore. Just use the working dir
as backing file.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`sizeof` was added into the prelude in rustc 1.80.
This triggers a lint-warning for `unused_qualifications` if rustc 1.80+
is used. Fix this warning by using a use statement to stay compatible
for <1.80.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The RCs 30, 31, 32 may be caused by a malicious host or host bug.
Make this clear and advise to stop the SE-guest.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When checking CDL formatted DASD for installed dump-tool (zgetdump -d),
we might stumble upon an 'empty' boot record pointer in the volume label
filled with bytes of 0x40 (EBCDIC spaces). This leads to the following
seek error reported:
# zgetdump -d /dev/dasdb
zgetdump: Could not seek "/dev/dasdb" (Invalid argument)
Check for empty boot record and return proper error code by
ngdump_get_eckd_part_num() in order to end up with a regular
"No dump tool found" message.
Fixes: f3bcd94524 ("zdump: Add zgetdump -d support for ECKD ldipl-dump")
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes a segfault when the option '--dry-run' is specified for
device-based dumps (for which the bootmap file is created on a RAW
device, not formatted with a file system).
The actual status is that the option '--dry-run' for device-based
dumps is not implemented. The implementation is evaluated as not
trivial: In contrast with filesystem-based dumps, it is not possible
to simply make do with rename/unlink of temporary created bootmap.
The fixup returns error on any not file system based dumps being
created with the option '--dry-run'.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Drop a pair of duplicated assignmets
Replace the parameter 'struct job_data' with 'struct job_dump_data'
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move all checks from check_dump_device_late() to disk_is_approproate()
and drop check_dump_device_late() entirely
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the function check_dump_device_late() drop the case of
(info->device != target_info->device) which never happens. Indeed,
the @info created in check_dump_device_late() coincides with the
@target_info previously created by
prepare_build_program_table_{file, device}.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since the following kernel commit:
"32db401965f1 s390/mm: Pin identity mapping base to zero"
we can have zero identity_base value in os_info. This makes zgetdump
check for non-VR kernel in vm_info_get() incorrect what leads to missing
data (e.g. UTS kernel version) in 'zgetdump -i' output.
Check for zero kaslr_offset value instead (like crash and makedumpfile
do) in order to identify non-VR kernel.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since memory chunks can overlap for vr-kernel dumps stored in elf
format (ngdump, zfcpdump), we need to consider this when converting to
s390 dump output format. For that sort DFI memory chunks by start
address and adjust dfo_s390 logic for identifying memory gaps.
Otherwise we might end up with bogus DFO memory chunks being created.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On vertical polarization, kernel can be adjusting CPU capacities
dynamically, and cpuplugd can interfere this with hotplug operations
causing performance degradation. To prevent this, check if system has
switched its polarization state, and act accordingly.
If system is on vertical polarization when daemon starts, no CPU hotplug
action is triggered. If system changes to vertical polarization during
daemon runtime, revert cpuhotplug adjustments and stop further CPU
hotplug actions. If system switches back to horizontal polarization
during runtime of the daemon, start evaluating CPU hotplug rules and
trigger adjustments.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Simplify the cpu management parts of cpuplugd code by introducing
functions from libutil and rework some logic to drop some assumptions
about how kernel assigns cpuids.
Right now cpuplugd assumes that the cpuids are always sequential and
there are no gaps in between, however kernel does not guarantee that.
Make cpuplugd compliant by traversing cpu sysfs entries instead.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes c0f02d2f6 which results in problems when preparing qcow2
images for IPL:
zipl -V --blsdir /tmp/tmp.kdPooQjoBh/boot//loader/entries/ --config /
Program terminated with signal SIGFPE, Arithmetic exception.
Don't use pointer to not initialized struct disk_info after failed
auto-detection of disk parameters. Make the check that the file
locates on the disk in the form of a separate procedure.
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Tested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When detecting disk type, the function disk_get_info() is called.
It can fail for various reasons (e.g. when the logial target is not
eligible for boot record installation).
Once disk_get_info() fails, don't proceed with type detection.
Return error instead. When applicable, mark the dump job with
"is_ngdump" flag to avoid extra type detection calls.
Acked-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes d6b702d57 which introduces a problem: SCSI dump
installation fails:
zipl -V -d /dev/mapper/mpathd1
Error: Invalid dump device: Could not read partition table
The reasons:
1) Wrong (logical) device is passed as a target base;
2) In case of 'source_script' the check to make sure that specified
target is over a partition isn't applicable any more after zipl
support of complex logical targets (e.g. mirrors).
The fixup passes the physical device as a target base (instead of
the logical one). Also the fixup removes invalid check from
check_dump_device_late() and instead adds a more generic check to
the helper script that data starts beyong the boot area.
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This option is experimental, but can still be useful.
While at it, sort the options alphabetically.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes 670bf3e8 which actually isn't an equivalent refactoring.
The generic dm-device resolution procedure was modified to not resolve
the topmost dm-device in the path. So that any calles who don't expect
it, should complete the resolutioin process by themselves. In case of
chreipl_helper such completion was missed. chreipl(8) utility doesn't
expect dm-devices at the output of chreipl_helper.device-mapper
Example:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 20G 0 disk
|-sda1 8:1 0 20G 0 part
`-mpathb 253:0 0 20G 0 mpath
`-mpathb1 253:2 0 20G 0 part /
sdb 8:16 0 20G 0 disk
|-sdb1 8:17 0 20G 0 part
`-mpathb 253:0 0 20G 0 mpath
`-mpathb1 253:2 0 20G 0 part /
Expected result:
8:16
Actual result:
253:0
As a result, the chreipl(8) "node" option stopped working.
The fixup adds the completion.
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The .note.package [1] section is not used by the zipl/genprotimg bootloaders,
therefore discard them via linker script.
This fix solves the error:
/usr/bin/ld: Heap section doesn't conform to the described memory layout
collect2: error: ld returned 1 exit status
make[4]: *** [Makefile:77: stage3a.elf] Error 1
make[4]: Leaving directory '/<>/genprotimg/boot'
make[3]: *** [Makefile:20: all-recursive] Error 1
make[3]: Leaving directory '/<>/genprotimg'
make[2]: *** [Makefile:56: genprotimg] Error 2
[1] https://systemd.io/ELF_PACKAGE_METADATA/
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/174
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/176
[seiden@linux.ibm.com: Add/edit fixes tags]
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce target operations (struct target_ops);
For each supported device-mapper target implement
. check_target_status()
. get_target_data()
Add support for new 'raid' device-mapper target, which is now default
in LVM.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a script to process mirrored zipl targets managed by Linux "md"
driver (AKA "software mirrors")
. In the file zipl_helper.device-mapper.c implement two handlers
identified by pairs (ZIPL_UTIL_ID, MD_DRIVER_ID) and
(CHREIPL_UTIL_ID, MD_DRIVER_ID) for the helpers zipl_helper.md
and chreipl_helper.md respectively
. zipl_helper.md: prints sets of target parameters (one such set
per mirror) for a specified logical zipl target managed by linux
"md" driver.
. chreipl_helper.md: for a specified logical zipl target managed
by linux "md" driver prints a random disk from the set of disks
participating in the mirrored setup.
. Add zipl_helper.md and chreipl_helper.md as symbolic links to
zipl_helper.device-mapper
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For "mirror" device-mapper targets:
. Check status of all the mirrors;
. Return error if some mirror contain failures;
. Align the sample output properly
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For "mirror" device-mapper targets:
. Don't assign a logical mirrored device as a zipl target base.
Instead, add one more branch in complete_physical_device() and
proceed (in that new branch) to the physical disk participating
in the mirrored target. This approach allowes to handle
heterogeneous mirrors properly;
. Provide a set of target parameters for each found physical disk
by calling dm_dev_to_zipl_params() recursively;
. Don't allow "nested mirrors" by checking/updating the
fail_on_mirror global;
. Remove the requirements on including block #0 to the mirrored
device-mapper setup (no more actual);
. Update comments.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This is used by the next patches in the series to support mirror
setups not including boot sectors (e.g. mirrors over partitions).
. Rework the core procedure of device resolution (by walking along
the device-mapper tree during logical device resolution) to be an
explicit sequence of pairs (level-lookup, goto-parent-level);
. Add an "extended" device to keep a track of file system offset
while ascending the device tree;
. Identify all possible results of a single level lookup;
. Rename target_entry to dmpath_entry;
. Make the main() function to look like a call of a handler
identified by a pair (driver-id, util-id) and found by the name
of the executable.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix mistake in @fs_offset calculation.
Since any logical dm-device can be built of partitions, @fs_offset
must not decrease while ascending the "device tree" during the
procedure of dm-device resolution (which always starts at the
formatted logical device, for which @fs_offset is 0).
This bug was not reproducible earlier because of restricted
functionality in a combination with side-effects. The fixup is
required however by the next patches in the series implementing
support of mirrored targets by zipl tool
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
. Modify disk_get_info() to process multiple sets of target parameters
provided by the helper script and store it in the array of "targets"
of the structure job_target_data;
. Besides the logical device, maintain an array of physical base disks
in the disk_info structure;
. Use the logical target device only to create bootmap (it is
automatically mirrored by the respective linux driver (dm, or md)
managing the mirrored target). In contrast, install bootstrap blocks
to each physical base disk individually, bypassing that driver;
. Report in verbose mode on which base disks the bootstrap
installation was performed;
. Use the following logic of setting @info->device (which is printed
as "Device...:" in verbose mode):
. source_auto - the target base disk is set;
. source_script - the target (logical) device is set;
. source_user - the device specified by user (via --targetbase
option), or config file is set.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add new command-line option --ipldev. When specified and IPL was done
from a supported device type, the IPL device is selected for the
requested tool operation.
Example to list IPL device information:
$ lszdev --ipldev
Example to create a persistent configuration for the IPL device:
$ chzdev --enable --persistent --ipldev
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reduce code complexity by adding a utility function for reading text
files based on a variable path.
Note: chzdev/lszdev tools apply special path-handling via command line
option --base to allow redirecting hard-coded paths therefore libutil's
util_file functions cannot easily be used.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Steps to reproduce: Prepare some disk for IPL, specifying its
parameters via zipl "target options", and an image IMAGE_NAME
located on another disk. Don't specify "-a" option.
Actual result: Installation succeeded (resulting in unbootable setup)
Expected result: "Error: Could not add image file 'IMAGE_NAME': File
is not on target device"
The problem is in incorrect evaluation of device number (dev_t)
of the base disk where the image is located by the function
add_component_file_range() in case when target parameters are
specified by user.
Fixup: Retrieve info of the underlying disk without any user hints,
passing zeroed structure job_target_data
This is an improved version of fb0b6263d that was reverted by
63ff07ba3 afterwards. The shortcoming of the original ( fb0b6263d )
fix: it fails to prepare for IPL mounted qcow2 images.
The difference from the original fix: when making sure that boot
files are located on the target disk: in case of failed auto-detection
of disk parameters skip the check with warnings instead of aborting
the whole installation session.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
MSA 10 and MSA 11 introduce new function codes containing Full XTS
functions for KM instruction and HMAC functions for KMAC instruction.
Additional Full XTS and HMAC for PCKMO instruction is introduced.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Perl logs warning message if a variable is not initialized.
get_device_data() set mp_dev with multipath device for a scsi disk device.
mp_dev remain uninitialized if there is no multipath device.
This can happen if a scsi device is not managed by dm multipath driver.
Warning message:
"Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 136"
Fix it by skipping the code dealing with mp_dev and continue with next
scsi device in the loop.
To reproduce, remove a scsi device from dm multipath.
$multipathd -k'del path sdh'
Then run `ziorep_config -D`.
Signed-off-by: Nihar Panda <niharp@linux.ibm.com>
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
We changed lscss for more detailed output.
Adding use of dasdview for a detailed view on DASD storage.
This data will be collected in a separate file, as many DASDs might flood
the runtime.out
Also updated man pages as a new step is added
Reviewed-by: Stefan Hberland <sth@linux.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ap.rs code is already prepared for possible support
for CCA mode APQNs for the Secure Execution environment.
However, this patch marks these fields and structs with
pragma allow(dead_code) to prevent warnings during cargo
build of pvapconfig.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new action type 'capabilities' for the 'get' event. This
will return a JSON list of events and actions that the callout
script recognizes and actually does something with. It omits
events like 'notify' and actions like 'list' that ap-check
currently ignores.
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
mdevctl introduces a new event type 'live' with action 'modify',
indicating that the specified configuration changes should be
made dynamically if possible. Use this as a trigger to perform
dynamic configuration changes to the specified vfio-ap device
if it is active.
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While unlikely, it is possible for a vfio-ap configuration JSON
to include the 'ap_config' attribute. In this case, process it
by overwriting the current list of adapters, domains and control
domains for the associated vfio-ap device struct.
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For a given vfio-ap mdev, determine whether or not the device will
need dynamic config operations. This boils down to whether or not
the device is currently active + whether or not the kernel is
detected to support dynamic config operations (via the
'ap_config' sysfs attribute).
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Anthony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The qeth-udev-rule execution logs a warning as below in the journalfs.
Failed to write ATTR{/sys/bus/ccwgroup/drivers/qeth/group}, \
ignoring: Invalid argument
This occurs because the udev rule for qeth devices is triggered by
multiple ccw devices and can be invoked in parallel. This can lead to a
situation where each of the three parallel-running udev rules tries to
group the devices simultaneously. As a result, only the first rule
succeeds, while the others fail with an -EINVAL error because the CCW
devices have already been grouped.
To prevent this, schedule a new change uevent for the base device, which
will verify the sysfs before attempting the grouping. The change event is
triggered by all three devices, ensuring that the actual write to the
attribute occurs only once and only when the sysfs attribute is ready.
Hence the add events on different devices are serialized to change event
on the base device, which then prevent duplicate concurrent grouping
attempts.
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function copy_table_entry_write() maps/unmaps /proc/vmcore for each
64kB of the file in order to write its content to a dump partition.
This requires a page allocation of order 2 in kernel (crst_table_alloc)
each time a mmap() syscall is performed and which cannot always be
fulfilled due to external memory fragmentation. And this in turn
results in a OOM kernel panic while writing /proc/vmcore content to
a dump partition. To make zfcpdump more robust in the face of such
problems with page allocations of order > 0, we use a simple file
read/write loop to transfer the content of /proc/vmcore to a dump
partition. This solution is less efficient (by not much) than the old
one with mmap() because it requires additional user space copy but
we trade off here efficiency for robustness which is more important
for zfcpdump.
We use a statically allocated buffer to read data into from /proc/vmcore
and write to a dump partition to avoid repeated use of the memory
mapping kernel path which would be required for a buffer allocated
dynamically at each entry of copy_table_entry_write().
Another possible and very convenient solution would be to use sendfile()
which would avoid any user space copies but, unfortunately, sendfile()
doesn't work with large /proc files.
Example of failed mmap() call for /proc/vmcore
==============================================
[ 26.568654] init invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=2, oom_score_adj=0
[ 26.568665] CPU: 0 PID: 1 Comm: init Not tainted 6.9.0-20240504.rc6.git0.9986ea583f39.300.fc39.s390x+zfcpdump #1
[ 26.568668] Hardware name: IBM 3931 A01 704 (LPAR)
[ 26.568669] Call Trace:
[ 26.568671] [<000003ffe03277c6>] dump_stack_lvl+0x76/0x98
[ 26.568676] [<000003ffe00f15c8>] dump_header+0x58/0x2d0
[ 26.568680] [<000003ffe00f219a>] out_of_memory+0x252/0x348
[ 26.568683] [<000003ffe0132f3e>] __alloc_pages_slowpath.constprop.0+0x65e/0x7c0
[ 26.568686] [<000003ffe01331a4>] __alloc_pages+0x104/0x128
[ 26.568688] [<000003ffe001ab46>] crst_table_alloc+0x2e/0xa0
[ 26.568693] [<000003ffe01164c4>] __pmd_alloc+0x24/0x160
[ 26.568696] [<000003ffe0116650>] pmd_alloc+0x50/0x68
[ 26.568698] [<000003ffe0117be4>] remap_pfn_range_notrack+0x194/0x310
[ 26.568701] [<000003ffe0117d7c>] remap_pfn_range+0x1c/0x28
[ 26.568703] [<000003ffe0015442>] remap_oldmem_pfn_range+0xb2/0x108
[ 26.568705] [<000003ffe01a0544>] mmap_vmcore+0x414/0x448
[ 26.568707] [<000003ffe01937c4>] proc_reg_mmap+0x84/0xa0
[ 26.568709] [<000003ffe011f264>] mmap_region+0x22c/0x6f8
[ 26.568711] [<000003ffe011fae8>] do_mmap+0x3b8/0x410
[ 26.568713] [<000003ffe01015cc>] vm_mmap_pgoff+0x9c/0xe8
[ 26.568715] [<000003ffe011d006>] ksys_mmap_pgoff+0x8e/0xb8
[ 26.568716] [<000003ffe011d0f4>] __s390x_sys_old_mmap+0x74/0x90
[ 26.568718] [<000003ffe0341a2a>] __do_syscall+0x1aa/0x220
[ 26.568720] [<000003ffe03478b0>] system_call+0x70/0x98
[ 26.568724] Mem-Info:
[ 26.568725] active_anon:1 inactive_anon:12 isolated_anon:0
active_file:83590 inactive_file:93939 isolated_file:0
unevictable:201 dirty:17845 writeback:4
slab_reclaimable:4259 slab_unreclaimable:1482
mapped:174 shmem:0 pagetables:810
sec_pagetables:0 bounce:0
kernel_misc_reclaimable:0
free:2694 free_pcp:105 free_cma:0
[ 26.568729] Node 0 active_anon:4kB inactive_anon:48kB active_file:334360kB inactive_file:375756kB unevictable:804kB isolated(anon):0kB isolated(file):0kB mapped:696kB dirty:71380kB writeback:16kB shmem:0kB writeback_tmp:0kB kernel_stack:544kB pagetables:3240kB sec_pagetables:0kB all_unreclaimable? no
[ 26.568732] DMA free:10776kB boost:0kB min:3496kB low:4368kB high:5240kB reserved_highatomic:0KB active_anon:4kB inactive_anon:48kB active_file:334360kB inactive_file:375756kB unevictable:804kB writepending:71360kB present:786428kB managed:764664kB mlocked:0kB bounce:0kB free_pcp:420kB local_pcp:420kB free_cma:0kB
[ 26.568735] lowmem_reserve[]: 0 0 0
[ 26.568738] DMA: 1069*4kB (UH) 757*8kB (UH) 11*16kB (H) 6*32kB (H) 1*64kB (H) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 10764kB
[ 26.568747] 177773 total pagecache pages
[ 26.568748] 196607 pages RAM
[ 26.568748] 0 pages HighMem/MovableOnly
[ 26.568749] 5441 pages reserved
[ 26.568749] Tasks state (memory values in pages):
[ 26.568750] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name
[ 26.568751] Out of memory and no killable processes...
[ 26.568752] Kernel panic - not syncing: System is deadlocked on memory
[ 26.568755] CPU: 0 PID: 1 Comm: init Not tainted 6.9.0-20240504.rc6.git0.9986ea583f39.300.fc39.s390x+zfcpdump #1
[ 26.568758] Hardware name: IBM 3931 A01 704 (LPAR)
[ 26.568759] Call Trace:
[ 26.568760] [<000003ffe03277c6>] dump_stack_lvl+0x76/0x98
[ 26.568763] [<000003ffe001f14e>] panic+0x10e/0x2e8
[ 26.568765] [<000003ffe00f21c8>] out_of_memory+0x280/0x348
[ 26.568768] [<000003ffe0132f3e>] __alloc_pages_slowpath.constprop.0+0x65e/0x7c0
[ 26.568771] [<000003ffe01331a4>] __alloc_pages+0x104/0x128
[ 26.568773] [<000003ffe001ab46>] crst_table_alloc+0x2e/0xa0
[ 26.568776] [<000003ffe01164c4>] __pmd_alloc+0x24/0x160
[ 26.568779] [<000003ffe0116650>] pmd_alloc+0x50/0x68
[ 26.568781] [<000003ffe0117be4>] remap_pfn_range_notrack+0x194/0x310
[ 26.568784] [<000003ffe0117d7c>] remap_pfn_range+0x1c/0x28
[ 26.568787] [<000003ffe0015442>] remap_oldmem_pfn_range+0xb2/0x108
[ 26.568789] [<000003ffe01a0544>] mmap_vmcore+0x414/0x448
[ 26.568791] [<000003ffe01937c4>] proc_reg_mmap+0x84/0xa0
[ 26.568793] [<000003ffe011f264>] mmap_region+0x22c/0x6f8
[ 26.568795] [<000003ffe011fae8>] do_mmap+0x3b8/0x410
[ 26.568797] [<000003ffe01015cc>] vm_mmap_pgoff+0x9c/0xe8
[ 26.568799] [<000003ffe011d006>] ksys_mmap_pgoff+0x8e/0xb8
[ 26.568801] [<000003ffe011d0f4>] __s390x_sys_old_mmap+0x74/0x90
[ 26.568803] [<000003ffe0341a2a>] __do_syscall+0x1aa/0x220
[ 26.568805] [<000003ffe03478b0>] system_call+0x70/0x98
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For vr-kernel dumps use the offsets stored in os_info entries for
virt to phys address conversion when dump virtual address is to be
read, (e.g. vmcoreinfo symbols) using similar method as implemented
in crash-utility.
It is mainly required for reading "init_uts_ns" symbol and, in case
of crashed kdump, "lowcore_ptr" symbol along with a pointers to the
lowcore of every CPU.
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Support vmcore based dumps (ngdump, zfcpdump) with uncoupled physical and
virtual addresses. For that we just remove p_paddr != p_vaddr sanity check
for elf load headers.
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Output generated using libutil's util_fmt_*() functions contains
meta-data such as hostname and time of invocation. When writing test
cases that compare expected and actual tool output, this run-time
variable information needs to be filtered out, resulting in increased
complexity.
To address this, add a global option to suppress meta-data output via
environment variable FMT_NOMETA. If set to '1', no meta-data will be
generated.
Example:
$ FMT_NOMETA=1 chpstat --format json
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The previous implementation did stop after the first download was
successful, even if it did not contain a CRL. This behavior renders a
second, third, ... link as backup location useless as the code ignores
them if the URI e.g. contains a error message. That results in not
having a CRL and probably a failed certificate verification.
Fix this by trying again if the download was successful but did not
contain a CRL
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In order to allow loop devices usage for DASD dump emulation in fvt-tests,
do not bail out on ZG_TYPE_DASD device type returned by zg_type() for
s390_ext dump.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
There are still a few scripts using the 'which' command to determine
either the full path or the mere existence of an executable.
Some of these scripts might run in minimal environments where 'which' is
not available due to dependency restriction. 'which' is also considered
unreliable for historical implementation details.
Use the POSIX defined [1] built-in 'command -v' instead to reduce
package dependencies and improve reliability.
[1] https://pubs.opengroup.org/onlinepubs/9699919799/
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The new parameter 'SCP_DATA' can be used to pass additional kernel cmdline
parameters to a stand-alone SCSI/NVMe/ECKD dumper for debugging purposes.
Configuration example
=====================
ON_PANIC=dump_reipl
DUMP_TYPE=fcp
DEVICE=0.0.4711
WWPN=0x5005076303004711
LUN=0x4711000000000000
BOOTPROG=0
BR_LBA=0
SCP_DATA="dump_debug=6 ignore_loglevel earlyprintk=sclp panic_print=3"
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When dump is copied to the filesystem in s390 format, follow on
'zgetdump -i' can fail with ioctl error:
# zgetdump /dev/dasdb1 -f s390 dump.s390
Format Info:
Source: s390_ext
Target: s390
Copying dump:
00000001 / 00008192 MB
00003688 / 00008192 MB
00006646 / 00008192 MB
00008192 / 00008192 MB
Success: Dump has been copied
# zgetdump -iVVVV dump.s390
zgetdump: Operation "BLKSSZGET" failed on "dump.s390" (Inappropriate ioctl for device)
Call ioctl(BLKSSZGET) only for s390_ext dump format (dump can be
stored on DASD partition only, not on the filesystem). For s390 format
a blocksize is not required for dump processing since s390 dump data is
not compressed.
Fixes: 271b809495 ("zdump/dfi_s390: Support reading compressed s390_ext dumps")
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
pvattest-C had a -a option for --arpk which the Rust implementation
missed.
Add this short option.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The commit fb0b6263d1 ("zipl/src: Fix problems when target parameters
are specified by user") breaks the case where the user has to provide
all target attributes via the zipl command line, because the target
device cannot be used to retrieve those attributes.
$ zipl -V --blsdir /tmp/tmp.xHmFUdgBCi/boot//loader/entries/ --config /tmp/tmp.dSv9MJ3svs
Looking for components in '/lib/s390-tools'
Using config file '/tmp/tmp.dSv9MJ3svs' (from command line)
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//50_normal.conf'
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//45_normal_swiotlb.conf'
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//40_pv.conf'
Using BLS config file '/tmp/tmp.xHmFUdgBCi/boot//loader/entries//30_pv_reboot.conf'
Secure boot support: yes
Target device information
Device..........................: 2b:00
Device name.....................: nbd0 *)
Device driver name..............: nbd
Type............................: disk device
Disk layout.....................: SCSI disk layout *)
Geometry - start................: 2048 *)
File system block size..........: 4096
Physical block size.............: 512 *)
Device size in physical blocks..: 2095071
*) Data provided by user.
Building bootmap in '/tmp/tmp.xHmFUdgBCi/boot/'
Building menu 'zipl-automatic-menu'
Adding #1: IPL section 'Normal Guest' (default)
initial ramdisk...: /tmp/tmp.xHmFUdgBCi/boot//ramdisk-s390x
kernel image......: /tmp/tmp.xHmFUdgBCi/boot//vmlinux-s390x
zIPL environment block content:
Error: Could not add image file '/tmp/tmp.xHmFUdgBCi/boot//vmlinux-s390x': Could not get disk geometry
This reverts commit fb0b6263d1.
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Having timestamps in gzip leads to lintian warning
'package-contains-timestamped-gzip' and will harm reproducible builds.
Gzip option '-n' avoids saving original file name and especially timestamps
by default.
Fixes: https://github.com/ibm-s390-linux/s390-tools/pull/169
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
[seiden@linux.ibm.com: Fix commit message]
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
File diff suppressed because it is too large
Load Diff
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
