New release s390-tools-2.38.0

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

.gitignore

@@ -77,9 +77,8 @@ libzds/libzds.a
 lsstp/lsstp
 mon_tools/mon_fsstatd
 mon_tools/mon_procd
+opticsmon/opticsmon
 osasnmpd/osasnmpd
-pvattest/src/pvattest
-pvattest/tools/exchange_info
 qetharp/qetharp
 qethqoat/qethqoat
 systemd/cpacfstatsd.service
@@ -138,4 +137,6 @@ zkey/kmip/libkmipclient.dep
 zkey/kmip/zkey-kmip.so
 zkey/zkey
 zkey/zkey-cryptsetup
+zmemtopo/zmemtopo
 zpcictl/zpcictl
+zpwr/zpwr

AUTHORS.md

@@ -11,6 +11,7 @@ List of all individuals having contributed content to s390-tools
 - Axel Wirbser
 - Balint Reczey
 - Benjamin Block
+- Bjoern Walk
 - Brian C. Lane
 - Carsten Otte
 - Christian Borntraeger
@@ -42,6 +43,7 @@ List of all individuals having contributed content to s390-tools
 - Frank Munzert
 - Frank Pavlic
 - Fritz Elfert
+- Gautam Gala
 - Gerald Schaefer
 - Gerhard Tonn
 - Graham Inggs
@@ -58,9 +60,11 @@ List of all individuals having contributed content to s390-tools
 - Horst Hummel
 - Ingo Franzki
 - Ingo Tuchscherer
+- Jakob Naucke
 - Jakub Čajka
 - Jan Glauber
 - Jan Höppner
+- Jan Polensky
 - Jan Willeke
 - Jason J. Herne
 - Javier Martinez Canillas
@@ -68,6 +72,7 @@ List of all individuals having contributed content to s390-tools
 - Jens Remus
 - Jochen Roehrig
 - Joern Siglen
+- Jörn Siglen
 - Juergen Christ
 - Julian Wiedmann
 - Karsten Graul
@@ -91,9 +96,11 @@ List of all individuals having contributed content to s390-tools
 - Michael Mueller
 - Mijo Safradin
 - Mikhail Zaslonko
+- Nihar Panda
 - Nikita Dubrovskii
 - Niklas Schnelle
 - Nikolay Gueorguiev
+- Peter Jin
 - Peter Oberparleiter
 - Peter Tiedemann
 - Philipp Kern
@@ -107,7 +114,10 @@ List of all individuals having contributed content to s390-tools
 - Sa Liu
 - Sascha Silbe
 - Sebastian Ott
+- Sertonix
 - Seshagiri N. Ippili
+- Shalini Chellathurai Saroja
+- Siglen
 - Simon Sturm
 - Stefan Bader
 - Stefan Haberland
@@ -117,6 +127,7 @@ List of all individuals having contributed content to s390-tools
 - Steffen Eiden
 - Steffen Maier
 - Steffen Thoss
+- Sumanth Korikkar
 - Susanne Wintenberger
 - Sven Schnelle
 - Sven Schuetz
@@ -133,6 +144,7 @@ List of all individuals having contributed content to s390-tools
 - Ursula Braun
 - Utz Bacher
 - Vance Morris
+- VasiliyS
 - Vasily Gorbik
 - Viktor Mihajlovski
 - Vineeth Vijayan

CHANGELOG.md

@@ -1,6 +1,134 @@
 Release history for s390-tools (MIT version)
 --------------------------------------------
 
+* __v2.38.0 (2025-06-25)__
+
+  For Linux kernel version: 6.14 / 6.15
+
+  Add new tools:
+  - udev: New rule to set newly hotplugged CPUs online
+  - zmemtopo: Display memory topology information
+  - zpwr: Display power readings of a partition and CPC
+
+  Removed tools / features:
+  - check_hostkeydoc: Remove installation target
+  - scsi_logging_level: Delete SCSI logging script (available in sg3_utils)
+  - zdump: Drop build_arch for s390 DASD dumps
+  - zdump: Drop non-extended multi-volume DASD dump support
+  - zdump: Drop support of 32-bit dump architecture
+  - zdump: Drop support of non-extended single volume DASD dumpers
+  - zdump: Drop support of obsolete dumps and dumpers
+
+  Changes of existing tools / libraries:
+  - Various man-pages fixes
+  - check_hostkeydoc: Add deprecation warning
+  - check_hostkeydoc: Move to scripts directory
+  - cpuplugd: Allow cpu hotplugging on systems without polarization
+  - dbginfo.sh: Add Ubuntu snap tool
+  - dbginfo.sh: Add missing config data and logs
+  - dbginfo.sh: Reworking the container section
+  - dbginfo.sh: Update for network commands
+  - dbginfo.sh: Updating info for disks and lvm
+  - libutil: Add machine type definition for machines 9175 and 9176
+  - lscpumf: Add support for IBM z17 counter sets
+  - lshwc: Add command line flag for run time
+  - lshwc: Add flags to display counter values in hex
+  - lshwc: Add output '--format' option
+  - lshwc: Add support for delta counter value display
+  - lspai: Add output '--format' option
+  - lsreipl: Add secure boot state to output
+  - lswhc: Add short names to lshwc output
+  - pv_tools: Add Bash and Zsh completions
+  - pvapconfig: Add '--unbind' option
+  - pvimg/boot: Print error messages from stage3a bootloader
+  - pvimg: Add support for CCK update
+  - pvsecret: Add support for CCK update
+  - pvsecret: Allow retrieving secrets by index & warn for duplicated entries
+  - pvsecret: Deny adding secrets with duplicated secret IDs
+  - zdev: Add support for virtio devices
+  - zipl: Enhance mirror support
+  - zipl: Implement '--dry-run' option for all dump jobs
+  - zipl_helper.device-mapper: Support mirrors over NVMe devices
+  - zkey/dracut: Add a dracut config file for zkey
+  - zkey/initramfs: Update initramfs hook to correct drivers and include zkey plugins
+  - zkey: Add support for converting a clear-key LUKS2 volume to use a secure key
+
+  Bug Fixes:
+  - chpstat: Add missing CMG 5 data fields
+  - chpstat: Fix DPU utilization calculation
+  - libutil/util_file: Handle over-read in util_file_read_fd()
+  - pvattest: Fix successful 'check' evaluation
+  - pvsecret: Fix some edge cases for plaintext keys
+  - zipl_helper.device-mapper: Fix imprecise is_device_mapper() predicate
+  - zkey: Fix EP11 secure key reencipher function
+  - zpcictl: Fix command line parsing for invalid options
+
+* __v2.37.0 (2025-02-07)__
+
+  For Linux kernel version: 6.13
+
+  Changes of existing tools:
+  - dbginfo.sh: Add details on CPU-measurement
+  - dbginfo.sh: Add new crypto command
+  - dbginfo.sh: Add overview commands and crypto update
+  - dbginfo.sh: Adding kdump info
+  - dbginfo.sh: Removing outdated email references
+  - dbginfo.sh: Rework network section
+  - dbginfo.sh: Update copyright 2nd year
+  - pvimg: Add '--(enable|disable)-image-encryption' flags to 'pvimg create'
+  - pvimg: Add '--cck <FILE>' command line option and make '--comm-key' an alias
+  - pvimg: Add '--hdr-key' command line option to 'pvimg create'
+  - pvimg: Rename '--key' into '--hdr-key' and use '--key' as an alias (for 'pvimg info')
+  - pvsecret: Add support for retrievable secrets
+  - ziorep_config: Add PCHID field to adapter report
+  - ziorep_traffic: Add DEVBUSID column to traffic report
+  - ziorep_utilization: Add --fcp-device parameter to print virtual adapter report
+  - ziorep_utilization: Add PCHID column to physical adapter report
+  - ziorep_utilization: Now prints only physical adapter report by default
+  - ziorep_utilization: Swap Bus-ID and CHPID columns in virtual adapter report
+  - zipl/boot: Increase section size for eckd_mv dumper
+  - zkey: Add support for listing and importing protected virtualization secrets
+
+  Bug Fixes:
+  - chpstat: Fix invalid utilization data on older kernels
+  - opticsmon: Fix runaway loop in on_link_change()
+  - zipl: Update inline assembly for GCC 15
+  - zipl_helper.device-mapper: Add missed step in logical device resolution
+
+* __v2.36.0 (2024-12-06)__
+
+  For Linux kernel version: 6.12
+
+  s390-tools: Define Rust MSRV as 1.75.0
+
+  Add new tools / libraries:
+  - cpacfinfo: Tool to provide CPACF information
+  - opticsmon: Tools to monitor optical modules for directly attached PCI based NICs
+  - pvimg: Rust rewrite of genprotimg
+
+  Changes of existing tools:
+  - chpstat: Add data bandwidth utilization column
+  - chpstat: Add support for full CMCB
+  - chpstat: Add support for new CMG types
+  - dbginfo.sh: add overview commands and crypto update
+  - genprotimg:
+    1. genprotimg is now a symbolic link to the new tool `pvimg create`
+    2. Breaking API changes in genprotimg:
+       1. An existing output file is no longer silently overwritten; to revert
+          to the old behavior use the `--overwrite` option.
+       2. The Linux kernel component is now checked to determine whether it is a
+          binary s390x kernel. To disable this behavior use the
+          `--no-component-check` option.
+  - hyptop: Support for structured output (json, json-seq, csv)
+  - lszfcp: Add missing fallback marker for non-good fc_host port_state
+  - lszfcp: Improve speed with many SCSI devices
+  - pvattest: Add attestation policy check command
+  - zipl: Add support of partitions of mirror md-devices
+
+  Bug Fixes:
+  - lszcrypt: Fix wrong state showing up for removed AP queue within SE guest
+  - lszfcp: Show device names line for zfcp_units without SCSI device
+
 * __v2.35.0 (2024-10-01)__
 
   For Linux kernel version: 6.11

Makefile

@@ -9,18 +9,19 @@ include common.mak
 ifeq ($(HOST_ARCH),s390x)
 BASELIB_DIRS = libutil libseckey
 LIB_DIRS = libvtoc libzds libdasd libccw libvmcp libekmfweb \
-	   libkmipclient libcpumf libap libpv
+	   libkmipclient libcpumf libap libpv libzpci
 TOOL_DIRS = zipl zdump fdasd dasdfmt dasdview tunedasd \
 	   tape390 osasnmpd qetharp ip_watcher qethconf scripts zconf \
 	   vmcp man mon_tools dasdinfo vmur cpuplugd ipl_tools \
 	   ziomon iucvterm hyptop cmsfs-fuse qethqoat zfcpdump zdsfs cpumf \
 	   systemd hmcdrvfs cpacfstats zdev dump2tar zkey netboot etc zpcictl \
-	   genprotimg lsstp hsci hsavmcore chreipl-fcp-mpath ap_tools rust
+	   lsstp hsci hsavmcore chreipl-fcp-mpath ap_tools rust opticsmon \
+	   zpwr zmemtopo
 
 else
 BASELIB_DIRS =
 LIB_DIRS = libpv
-TOOL_DIRS = genprotimg rust
+TOOL_DIRS = rust
 endif
 
 SUB_DIRS = $(BASELIB_DIRS) $(LIB_DIRS) $(TOOL_DIRS)

README.md

@@ -19,12 +19,17 @@ Package contents
    all s390-tools that are written in rust and require external crates.
    Disable the compilation of all tools in `rust/` using HAVE_CARGO=0
    See the `rust/README.md` for Details
+   - cpacfinfo:
+     Command line interface to get information about CP Assist for
+     Cryptographic Functions (CPACF)
    - pvattest:
      Create, perform, and verify IBM Secure Execution attestation measurements.
    - pvapconfig:
      Automatic configure APQNs within an SE KVM guest
    - pvsecret:
      Manage secrets for IBM Secure Execution guests
+   - pvimg:
+     Create and inspect IBM Secure Execution images
 
  * dasdfmt:
    Low-level format ECKD DASDs with the classical Linux disk layout or the new
@@ -42,7 +47,8 @@ Package contents
    Display unique DASD ID, either UID or volser.
 
  * genprotimg:
-   Create a protected virtualization image.
+   Create an IBM Secure Execution (protected virtualization) image. The
+   genprotimg command is a symbolic link to the `pvimg create` command.
 
  * udev rules:
    - 59-dasd.rules: rules for unique DASD device nodes created in /dev/disk/.
@@ -122,9 +128,6 @@ Package contents
  * sclpdbf:
    Display debug data for the sclp kernel component.
 
- * scsi_logging_level:
-   Create, get or set the logging level for the SCSI logging facility.
-
  * zconf:
    Set of scripts to configure and list status information of Linux on s390
    devices.
@@ -304,26 +307,27 @@ HAVE_FUSE=0`".
 The following table provides an overview of the used libraries and
 build options:
 
-| __LIBRARY__    | __BUILD OPTION__   | __TOOLS__                             |
-|----------------|:------------------:|:-------------------------------------:|
-| fuse3          | `HAVE_FUSE`        | cmsfs-fuse, zdsfs, hmcdrvfs, zgetdump,|
-|                |                    | hsavmcore                             |
-| zlib           | `HAVE_ZLIB`        | zgetdump, dump2tar                    |
-| ncurses        | `HAVE_NCURSES`     | hyptop                                |
-| net-snmp       | `HAVE_SNMP`        | osasnmpd                              |
-| glibc-static   | `HAVE_LIBC_STATIC` | zfcpdump                              |
-| openssl        | `HAVE_OPENSSL`     | genprotimg, zkey, libekmfweb,         |
-|                |                    | libkmipclient, pvattest, zgetdump,    |
-|                |                    | rust/pvsecret,                        |
-| cryptsetup     | `HAVE_CRYPTSETUP2` | zkey-cryptsetup                       |
-| json-c         | `HAVE_JSONC`       | zkey-cryptsetup, libekmfweb,          |
-|                |                    | libkmipclient                         |
-| glib2          | `HAVE_GLIB2`       | genprotimg, pvattest, zgetdump        |
-| libcurl        | `HAVE_LIBCURL`     | genprotimg, libekmfweb, libkmipclient,|
-|                |                    | pvattest, rust/pvsecret,              |
-| libxml2        | `HAVE_LIBXML2`     | libkmipclient                         |
-| systemd        | `HAVE_SYSTEMD`     | hsavmcore                             |
-| libudev        | `HAVE_LIBUDEV`     | cpacfstatsd                           |
+| __LIBRARY__  | __BUILD OPTION__   | __TOOLS__                              |
+|--------------|:------------------:|:--------------------------------------:|
+| fuse3        | `HAVE_FUSE`        | cmsfs-fuse, zdsfs, hmcdrvfs, zgetdump, |
+|              |                    | hsavmcore                              |
+| zlib         | `HAVE_ZLIB`        | zgetdump, dump2tar                     |
+| ncurses      | `HAVE_NCURSES`     | hyptop                                 |
+| net-snmp     | `HAVE_SNMP`        | osasnmpd                               |
+| glibc-static | `HAVE_LIBC_STATIC` | zfcpdump                               |
+| openssl      | `HAVE_OPENSSL`     | zkey, libekmfweb, libkmipclient,       |
+|              |                    | zgetdump, rust/pvattest, rust/pvimg,   |
+|              |                    | zgetdump/pvsecret, opticsmon           |
+| cryptsetup   | `HAVE_CRYPTSETUP2` | zkey-cryptsetup                        |
+| json-c       | `HAVE_JSONC`       | zkey-cryptsetup, libekmfweb,           |
+|              |                    | libkmipclient                          |
+| glib2        | `HAVE_GLIB2`       | zgetdump                               |
+| libcurl      | `HAVE_LIBCURL`     | libekmfweb, libkmipclient, rust/pvimg, |
+|              |                    | rust/pvattest, rust/pvsecret,          |
+| libxml2      | `HAVE_LIBXML2`     | libkmipclient                          |
+| systemd      | `HAVE_SYSTEMD`     | hsavmcore                              |
+| libudev      | `HAVE_LIBUDEV`     | cpacfstatsd                            |
+| libnl3       | `HAVE_LIBNL3`      | opticsmon                              |
 
 This table lists additional build or install options:
 
@@ -355,13 +359,13 @@ the different tools are provided:
 * dbginfo.sh:
   The tar package is required to archive collected data.
 
-* genprotimg:
-  For building genprotimg you need OpenSSL version 1.1.0 or newer
-  installed (openssl-devel.rpm). Also required is glib2
-  (glib2-devel.rpm). Tip: you may skip the genprotimg build by adding
-  `HAVE_OPENSSL=0` or `HAVE_GLIB2=0`.
+* rust/pvimg:
+  For building pvimg you need OpenSSL version 1.1.1 or newer
+  installed (openssl-devel.rpm). Also required is cargo and libcurl.
+  Tip: you may skip the pvimg build by adding
+  `HAVE_OPENSSL=0`, `HAVE_LIBCURL=0`, or `HAVE_CARGO=0`.
 
-  The runtime requirements are: openssl-libs (>= 1.1.0) and glib2.
+  The runtime requirements are: openssl-libs (>= 1.1.1) and libcurl.
 
 * rust/pvattest:
   For building pvattest you need OpenSSL version 1.1.1 or newer
@@ -369,8 +373,13 @@ the different tools are provided:
   Tip: you may skip the pvattest build by adding
   `HAVE_OPENSSL=0`, `HAVE_LIBCURL=0`, or `HAVE_CARGO=0`.
 
-  The runtime requirements are: openssl-libs (>= 1.1.1) and
-  glib2.56 or newer.
+  The runtime requirements are: openssl-libs (>= 1.1.1) and libcurl.
+
+* opticsmon:
+  For building opticsmon OpenSSL and the Netlink Library Suite (libnl3) are
+  required.
+  Tip: you may skip the opticsmon build by adding
+  `HAVE_OPENSSL=0` or `HAVE_LIBNL3=0`
 
 * osasnmpd:
   You need at least the NET-SNMP 5.1.x package (net-snmp-devel.rpm)

chreipl-fcp-mpath/chreipl-fcp-mpath.7

@@ -1,182 +1,170 @@
-.\" Automatically generated by Pandoc 2.16.1
+.\" Automatically generated by Pandoc 3.1.11.1
 .\"
-.TH "CHREIPL-FCP-MPATH" "7" "2022-02-24" "s390-tools 2.20.0-build-20220224" "Administrator Manual"
-.hy
+.TH "CHREIPL\-FCP\-MPATH" "7" "2025\-03\-12" "s390-tools 2.37.0-build-20250312" "Administrator Manual"
 .SH NAME
-.PP
-chreipl-fcp-mpath - use multipath information for re-IPL path failover
-on a running Linux instance
+chreipl\-fcp\-mpath \- use multipath information for re\-IPL path
+failover on a running Linux instance
 .SH DESCRIPTION
-.PP
-The IPL process of Linux on Z or LinuxONE from an FCP-attached SCSI
+The IPL process of Linux on Z or LinuxONE from an FCP\-attached SCSI
 volume uses exactly one path to the volume.
 If this path is unavailable, the IPL fails.
 .PP
-The \f[B]chreipl-fcp-mpath\f[R] toolset monitors \f[B]udev\f[R] events
-about paths to the re-IPL volume.
-If the currently configured re-IPL path becomes unavailable, the toolset
-checks for operational paths to the same volume.
-If available, it reconfigures the re-IPL settings to use an operational
+The \f[B]chreipl\-fcp\-mpath\f[R] toolset monitors \f[B]udev\f[R] events
+about paths to the re\-IPL volume.
+If the currently configured re\-IPL path becomes unavailable, the
+toolset checks for operational paths to the same volume.
+If available, it reconfigures the re\-IPL settings to use an operational
 path.
 .PP
-Thus, re-IPL from an FCP-attached SCSI volume can be successful despite
-path failures on a running Linux instance if at least one path to the
-re-IPL volume remains operational.
+Thus, re\-IPL from an FCP\-attached SCSI volume can be successful
+despite path failures on a running Linux instance if at least one path
+to the re\-IPL volume remains operational.
 .PP
-\f[B]Chreipl-fcp-mpath\f[R] requires \f[B]udev\f[R],
-\f[B]multipathd\f[R] and \f[B]dm-multipath\f[R].
+\f[B]Chreipl\-fcp\-mpath\f[R] requires \f[B]udev\f[R],
+\f[B]multipathd\f[R] and \f[B]dm\-multipath\f[R].
 Once installed, the toolset runs automatically and autonomously.
 No user intervention is possible or required.
 .PP
 Other than installing the toolset, there is no user interface for
-\f[B]chreipl-fcp-mpath\f[R].
+\f[B]chreipl\-fcp\-mpath\f[R].
 .SS Requirements
-.PP
-The \f[B]chreipl-fcp-mpath\f[R] tool has the following requirements on
+The \f[B]chreipl\-fcp\-mpath\f[R] tool has the following requirements on
 the Linux instance that is being monitored:
 .IP \[bu] 2
 The Linux instance must have started successfully, during IPL.
 .IP \[bu] 2
-The running Linux instance must use \f[B]dm-multipath\f[R] and
-\f[B]multipathd\f[R] for the configured re-IPL volume - a volume that
-contains a zipl boot record and has one of its paths used in the re-IPL
+The running Linux instance must use \f[B]dm\-multipath\f[R] and
+\f[B]multipathd\f[R] for the configured re\-IPL volume \- a volume that
+contains a zipl boot record and has one of its paths used in the re\-IPL
 configuration.
 .IP \[bu] 2
 \f[B]udev\f[R] must run.
 .IP \[bu] 2
-The toolset must observe at least one event about the configured re-IPL
+The toolset must observe at least one event about the configured re\-IPL
 path.
 Examples for such events are: the SCSI disk comes online, or a path of
 the corresponding multipath device goes down or comes back online.
 .RS 2
 .IP \[bu] 2
-The WWID of the re-IPL volume must not change while the Linux instance
+The WWID of the re\-IPL volume must not change while the Linux instance
 is running.
 .RE
 .IP \[bu] 2
-When the configured re-IPL path becomes unavailable while the Linux
-instance is running, at least one operational path to the re-IPL volume
+When the configured re\-IPL path becomes unavailable while the Linux
+instance is running, at least one operational path to the re\-IPL volume
 must be available, or must become available.
 If no such path is available when the Linux instance is rebooted, the
-re-IPL path is not changed.
+re\-IPL path is not changed.
 .IP \[bu] 2
-The tool assumes that any manually reconfigured re-IPL device is valid
+The tool assumes that any manually reconfigured re\-IPL device is valid
 and operational.
 .RS 2
 .PP
-The tool treats a newly configured re-IPL device like the initially
-configured re-IPL device.
-In particular, if the newly configured re-IPL device fulfills the
-requirements of the tool, re-IPL path failover takes place if the
-configured re-IPL path becomes unavailable.
+The tool treats a newly configured re\-IPL device like the initially
+configured re\-IPL device.
+In particular, if the newly configured re\-IPL device fulfills the
+requirements of the tool, re\-IPL path failover takes place if the
+configured re\-IPL path becomes unavailable.
 .RE
-.SS Caution with Manual Changes to the Configured re-IPL Target
-.PP
-\f[B]chreipl-fcp-mpath\f[R] is designed to accept operator-inititated
-changes of the re-IPL device.
+.SS Caution with Manual Changes to the Configured re\-IPL Target
+\f[B]chreipl\-fcp\-mpath\f[R] is designed to accept operator\-inititated
+changes of the re\-IPL device.
 However, concurrent changes by the operator and tool driven changes can
 result in the operator change being overwritten.
 .PP
-To avoid this problem, change the re-IPL device only during steady-state
-operations, when no path events happen.
+To avoid this problem, change the re\-IPL device only during
+steady\-state operations, when no path events happen.
 Alternatively, make sure that no events are processed while you change
 the device.
 See EXAMPLES for one way to suspend event processing.
 .SH MESSAGES
-.PP
-During monitoring and event processing, \f[B]chreipl-fcp-mpath\f[R]
+During monitoring and event processing, \f[B]chreipl\-fcp\-mpath\f[R]
 writes messages to the syslog.
 .PP
-When the configured re-IPL path is changed to a different path to the
+When the configured re\-IPL path is changed to a different path to the
 same volume (priority \f[I]daemon.notice\f[R]):
 .RS
 .PP
-Changed re-IPL path to: <device-bus-id>:<wwpn>:<lun>.
+Changed re\-IPL path to: <device\-bus\-id>:<wwpn>:<lun>.
 .RE
 .PP
 When a path event indicates that the last available path has become
-non-operational (priority \f[I]daemon.alert\f[R]):
+non\-operational (priority \f[I]daemon.alert\f[R]):
 .RS
 .PP
-The re-IPL device cannot be changed because no operational path to the
-re-IPL volume remains.
-The next re-IPL might fail unless you re-attach or enable at least one
-valid path to the re-IPL volume.
+The re\-IPL device cannot be changed because no operational path to the
+re\-IPL volume remains.
+The next re\-IPL might fail unless you re\-attach or enable at least one
+valid path to the re\-IPL volume.
 .RE
 .PP
-When changing the configured re-IPL device failed because of an error
+When changing the configured re\-IPL device failed because of an error
 with the used Linux kernel interface (priority \f[I]daemon.crit\f[R]):
 .RS
 .PP
-Changing the re-IPL device failed.
-The current re-IPL settings might be inconsistent.
-Check and correct the settings (see the README.md of chreipl-fcp-mpath)
-to make sure that the current re-IPL device is valid.
+Changing the re\-IPL device failed.
+The current re\-IPL settings might be inconsistent.
+Check and correct the settings (see the README.md of
+chreipl\-fcp\-mpath) to make sure that the current re\-IPL device is
+valid.
 .RE
 .PP
-A failure to change the re-IPL device can indicate an inconsistent
+A failure to change the re\-IPL device can indicate an inconsistent
 setting that cannot be corrected automatically by
-\f[B]chreipl-fcp-mpath\f[R].
-As a result, the next re-IPL might fail or might not use the intended
-re-IPL device.
+\f[B]chreipl\-fcp\-mpath\f[R].
+As a result, the next re\-IPL might fail or might not use the intended
+re\-IPL device.
 .PP
 You can use the following tools to check and correct the current
 settings:
 .IP \[bu] 2
-\f[B]lsreipl\f[R] to confirm that the intended re-IPL device is
+\f[B]lsreipl\f[R] to confirm that the intended re\-IPL device is
 configured;
 .IP \[bu] 2
-\f[B]chreipl\f[R] to change the re-IPL device;
+\f[B]chreipl\f[R] to change the re\-IPL device;
 .IP \[bu] 2
-\f[B]lszfcp\f[R] to inspect the state of available paths to the re-IPL
+\f[B]lszfcp\f[R] to inspect the state of available paths to the re\-IPL
 device.
 .SH EXAMPLES
-.SS Manual Changes to the Configured re-IPL Device
-.PP
+.SS Manual Changes to the Configured re\-IPL Device
 As outlined in DESCRIPTION, be cautious when manually changing the
-configured re-IPL device.
+configured re\-IPL device.
 Assure that your reconfiguration actions do not collide with concurrent
-automatic event processing by \f[B]chreipl-fcp-mpath\f[R].
+automatic event processing by \f[B]chreipl\-fcp\-mpath\f[R].
 You can avoid such collisions, by stopping event processing, making your
-changes, and then re-enabling event processing.
+changes, and then re\-enabling event processing.
 You need \f[I]root\f[R] privileges for running the commands in the
 following example:
 .IP
-.nf
-\f[C]
+.EX
 \[ti] # udevadm settle
-\[ti] # udevadm control --stop-exec-queue
+\[ti] # udevadm control \-\-stop\-exec\-queue
 \[ti] # chreipl ...
-\[ti] # udevadm control --start-exec-queue
-\f[R]
-.fi
+\[ti] # udevadm control \-\-start\-exec\-queue
+.EE
 .SS Listing messages with journalctl
-.PP
 If your Linux instance includes \f[B]journalctl\f[R], use the following
 command to list all messages that are issued by
-\f[B]chreipl-fcp-mpath\f[R]:
+\f[B]chreipl\-fcp\-mpath\f[R]:
 .IP
-.nf
-\f[C]
-\[ti] # journalctl -t chreipl-fcp-mpath
-\f[R]
-.fi
+.EX
+\[ti] # journalctl \-t chreipl\-fcp\-mpath
+.EE
 .PP
 To list only messages that were issued since the last IPL, use this
 command:
 .IP
-.nf
-\f[C]
-\[ti] # journalctl -t chreipl-fcp-mpath -b
-\f[R]
-.fi
+.EX
+\[ti] # journalctl \-t chreipl\-fcp\-mpath \-b
+.EE
 .SH REPORTING BUGS
-.PP
 Use the \f[B]Issues\f[R] functionality on GitHub to report any bugs in
-\f[B]chreipl-fcp-mpath\f[R]: s390-tools
-Issues (https://github.com/ibm-s390-linux/s390-tools/issues).
+\f[B]chreipl\-fcp\-mpath\f[R]: \c
+.UR https://github.com/ibm-s390-linux/s390-tools/issues
+s390\-tools Issues
+.UE \c
+\&.
 .SH SEE ALSO
-.PP
 \f[B]chreipl\f[R](8), \f[B]dracut\f[R](8), \f[B]journalctl\f[R](1),
 \f[B]lsreipl(8)\f[R], \f[B]lszfcp\f[R](8), \f[B]multipath\f[R](8),
 \f[B]multipathd\f[R](8), \f[B]udev\f[R](7), \f[B]udevadm\f[R](8),

common.mak

@@ -32,7 +32,7 @@ endif
 # The variable "DISTRELEASE" should be overwritten in rpm spec files with:
 # "make DISTRELEASE=%{release}" and "make install DISTRELEASE=%{release}"
 VERSION            := 2
-RELEASE            := 35
+RELEASE            := 38
 PATCHLEVEL         := 0
 DISTRELEASE        := build-$(shell date +%Y%m%d)
 S390_TOOLS_RELEASE := $(VERSION).$(RELEASE).$(PATCHLEVEL)-$(DISTRELEASE)
@@ -48,7 +48,7 @@ export S390_TEST_LIB_PATH=$(rootdir)/s390-tools-testsuite/lib
 # $ make HOST_ARCH=s390x CROSS_COMPILE="s390x-linux-gnu-"
 #
 
-CROSS_COMPILE   =
+CROSS_COMPILE ?=
 
 #
 # Commands can be overwritten on the command line with "make <VAR>=<VALUE>":
@@ -265,9 +265,12 @@ LIBDIR          = $(INSTALLDIR)/lib
 USRLIBDIR	= $(INSTALLDIR)/usr/lib
 USRLIB64DIR     = $(INSTALLDIR)/usr/lib64
 SYSCONFDIR      = $(INSTALLDIR)/etc
-MANDIR          = $(INSTALLDIR)/usr/share/man
+DATADIR         = $(INSTALLDIR)/usr/share
+MANDIR          = $(DATADIR)/man
+BASHCOMPLETIONDIR = $(DATADIR)/bash-completion/completions
+ZSHCOMPLETIONDIR = $(DATADIR)/zsh/site-functions
 VARDIR          = $(INSTALLDIR)/var
-TOOLS_DATADIR   = $(INSTALLDIR)/usr/share/s390-tools
+TOOLS_DATADIR   = $(DATADIR)/s390-tools
 TOOLS_LIBDIR    = $(INSTALLDIR)/lib/s390-tools
 ZFCPDUMP_DIR    = $(TOOLS_LIBDIR)/zfcpdump
 # Systemd support files are installed only if a directory is specified
@@ -504,6 +507,10 @@ $(rootdir)/libpv/libpv.a: $(rootdir)/libpv
 	$(MAKE) -C $(rootdir)/libpv libpv.a
 .PHONY: $(rootdir)/libpv
 
+$(rootdir)/libzpci/libzpci.a: $(rootdir)/libzpci
+	$(MAKE) -C $(rootdir)/libzpci libzpci.a
+.PHONY: $(rootdir)/libzpci
+
 $(rootdir)/zipl/boot/.loaders:
 	$(MAKE) -C $(rootdir)/zipl/boot/ .loaders
 

cpacfstats/cpacfstats.1

@@ -46,8 +46,8 @@ All counters are initially disabled and must be switched on to measure
 CPACF activities of the system. There is a slight performance penalty with
 CPACF counters enabled.
 
-CPACF activity counters come in two flavors: CPU-MF and PAI.  CPU-MF
-counters are only available on LPARs and have to be authorized.  If
+CPACF activity counters come in two flavors: CPU-MF and PAI. CPU-MF
+counters are only available on LPARs and have to be authorized. If
 they are available, the counters
 .B des,
 .B aes,
@@ -55,14 +55,131 @@ they are available, the counters
 .B rng,
 and
 .B ecc
-are made available.  These counters can individually be activated,
-reset, printed, or deactivated.  PAI counters are a lot more detailed.
+are made available. These counters can individually be activated,
+reset, printed, or deactivated. PAI counters are a lot more detailed.
 The user interface only offers the counters
 .B pai_user
 and
 .B pai_kernel
-to count CPACF usage in user-space or kernel-space.  When printing
-these counters, detailed counters are shown.  The detailed names are:
+to count CPACF usage in user-space or kernel-space. When printing
+these counters, detailed counters are shown.
+
+A complete list of counters can be found at the end of this manpage.
+
+Note that the counters starting with PCKMO and Reserved are only
+available in the pai_kernel set. Also note that the counters are
+designed to count successful operations. In the case of KMA this
+means only complete GCM operations including final hashing are
+counted.
+
+Note: CPU-MF based CPACF performance counters are available on LPARs
+only. PAI counters are available on all hypervisors. For security
+reasons only members of the group \fIcpacfstats\fR are allowed to run
+the cpacfstats client application.
+
+Example usage scenario:
+.P
+1. Start the cpacfstatsd daemon with root privileges.
+.P
+2. Check for successful startup by using the ps and syslog commands.
+.P
+3. Enable the CPACF counters of interest. For example, enable all counters
+by issuing cpacfstats -e.
+.P
+4. Run your applications.
+.P
+5. Display counter values by using the cpacfstats command. Reset the
+cryptographic counters as required. To reset, use, for example, cpacfstats
+-r.
+.P
+6. Disable all the CPACF measurements, for example, by using cpacfstats
+-d.
+.P
+7. Shutdown the cpacfstatsd daemon by using killall cpacfstatsd.
+
+.SH OPTIONS
+.TP
+\fB\-h\fR or \fB\-\-help\fR
+Display help information for the command.
+.TP
+\fB\-v\fR or \fB\-\-version\fR
+Display version and copyright information for the command.
+.TP
+\fB\-e\fR or \fB\-\-enable\fR [counter]
+Enable one or all CPACF performance counters. The optional counter
+argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
+\fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
+performance counters are enabled. Enabling a counter does not reset
+it. New events are added to the current counter value.
+.TP
+\fB\-d\fR or \fB\-\-disable\fR [counter]
+Disable one or all CPACF performance counters. The optional counter
+argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
+\fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
+performance counters are disabled. Disabling a counter does not reset
+it. The counter value is preserved when a counter is disabled, and
+counting will resume using the preserved value when the counter is
+re-enabled.
+.TP
+\fB\-r\fR or \fB\-\-reset\fR [counter]
+Reset one or all CPACF performance counters. The optional counter
+argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
+\fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
+performance counters are reset to 0.
+.TP
+\fB\-p\fR or \fB\-\-print\fR  [\fB\-n\fR or \fB\-\-nonzero\fR] [counter]
+Display the value of one or all CPACF performance counters. The
+optional counter argument can be one of: \fBdes\fR, \fBaes\fR,
+\fBsha\fR, \fBprng\fR, \fBecc\fR, \fBpai_user\fR, \fBpai_kernel\fR, or
+\fBall\fR. If the counter argument is omitted or if there is no
+argument, all performance counters are displayed. If the optional
+\fB\-n\fR or \fB\-\-nonzero\fR argument is given, then only PAI
+counters that have a non-zero value are printed.
+.TP
+\fB\-j\fR or \fB\-\-json\fR
+Display all activated counters in JSON format. The JSON contains an
+array of counter objects. Each object contains the property
+.B counter
+specifying either a CPU-MF counter of one of the detailed PAI counter.
+Additional properties include
+.B error
+an error number if the counter could not be read,
+.B value
+the counter value if the counter could be read,
+.B space
+for PAI counters to specify
+.B user
+or
+.B kernel
+space counter set, and
+.B counterid
+for PAI counters to specify the PAI counter number as specified in the
+Principles of Operation.
+.TP
+The default command is --print all.
+.
+.SH FILES
+.nf
+/run/cpacfstatsd_socket
+.fi
+.
+.SH RETURN VALUE
+.IP 0
+Successful program execution.
+.IP 1
+An error occurred, reasons include: invalid argument, cpacfstatsd could not
+be reached (check that the daemon is running), insufficient access rights,
+version mismatch between client and daemon, or the application is out of
+memory. The application prints a message with the details of the error and
+the errno value.
+.
+.SH NOTES
+ECC counters are only available since z15. cpacfstats will show the
+counters as \fIunsupported\fR if the hardware does not support ECC
+counters.
+.
+.SH APPENDIX
+The detailed pai counter names are:
 .RS
 .IP \(bu
 KM DES,
@@ -376,118 +493,39 @@ PCKMO ECC Ed448,
 Reserved 1, and
 .IP \(bu
 Reserved 2.
+.IP \(bu
+KM AES-XTS (full) 128bit
+.IP \(bu
+KM AES-XTS (full) 256bit
+.IP \(bu
+KM AES-XTS (full) 128bit protected key
+.IP \(bu
+KM AES-XTS (full) 256bit protected key
+.IP \(bu
+KMAC HMAC SHA 224
+.IP \(bu
+KMAC HMAC SHA 256
+.IP \(bu
+KMAC HMAC SHA 384
+.IP \(bu
+KMAC HMAC SHA 512
+.IP \(bu
+KMAC HMAC SHA 224 protected key
+.IP \(bu
+KMAC HMAC SHA 256 protected key
+.IP \(bu
+KMAC HMAC SHA 384 protected key
+.IP \(bu
+KMAC HMAC SHA 512 protected key
+.IP \(bu
+PCKMO HMAC 512 protected key
+.IP \(bu
+PCKMO HMAC 1024 protected key
+.IP \(bu
+PCKMO AES-XTS 128bit double key protected key
+.IP \(bu
+PCKMO AES-XTS 256bit double key protected key
 .RE
-Note that the counters starting with PCKMO and Reserved are only
-available in the pai_kernel set.  Also note that the counters are
-designed to count successful operations.  In the case of KMA this
-means only complete GCM operations including final hashing are
-counted.
-
-Note: CPU-MF based CPACF performance counters are available on LPARs
-only. PAI counters are available on all hypervisors. For security
-reasons only members of the group \fIcpacfstats\fR are allowed to run
-the cpacfstats client application.
-
-Example usage scenario:
-.P
-1. Start the cpacfstatsd daemon with root privileges.
-.P
-2. Check for successful startup by using the ps and syslog commands.
-.P
-3. Enable the CPACF counters of interest. For example, enable all counters
-by issuing cpacfstats -e.
-.P
-4. Run your applications.
-.P
-5. Display counter values by using the cpacfstats command. Reset the
-cryptographic counters as required. To reset, use, for example, cpacfstats
--r.
-.P
-6. Disable all the CPACF measurements, for example, by using cpacfstats
--d.
-.P
-7. Shutdown the cpacfstatsd daemon by using killall cpacfstatsd.
-
-.SH OPTIONS
-.TP
-\fB\-h\fR or \fB\-\-help\fR
-Display help information for the command.
-.TP
-\fB\-v\fR or \fB\-\-version\fR
-Display version and copyright information for the command.
-.TP
-\fB\-e\fR or \fB\-\-enable\fR [counter]
-Enable one or all CPACF performance counters. The optional counter
-argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
-\fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
-performance counters are enabled. Enabling a counter does not reset
-it. New events are added to the current counter value.
-.TP
-\fB\-d\fR or \fB\-\-disable\fR [counter]
-Disable one or all CPACF performance counters. The optional counter
-argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
-\fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
-performance counters are disabled. Disabling a counter does not reset
-it. The counter value is preserved when a counter is disabled, and
-counting will resume using the preserved value when the counter is
-re-enabled.
-.TP
-\fB\-r\fR or \fB\-\-reset\fR [counter]
-Reset one or all CPACF performance counters. The optional counter
-argument can be one of: \fBdes\fR, \fBaes\fR, \fBsha\fR, \fBprng\fR,
-\fBecc\fR, or \fBall\fR. If the counter argument is omitted, all
-performance counters are reset to 0.
-.TP
-\fB\-p\fR or \fB\-\-print\fR  [\fB\-n\fR or \fB\-\-nonzero\fR] [counter]
-Display the value of one or all CPACF performance counters. The
-optional counter argument can be one of: \fBdes\fR, \fBaes\fR,
-\fBsha\fR, \fBprng\fR, \fBecc\fR, \fBpai_user\fR, \fBpai_kernel\fR, or
-\fBall\fR. If the counter argument is omitted or if there is no
-argument, all performance counters are displayed.  If the optional
-\fB\-n\fR or \fB\-\-nonzero\fR argument is given, then only PAI
-counters that have a non-zero value are printed.
-.TP
-\fB\-j\fR or \fB\-\-json\fR
-Display all activated counters in JSON format.  The JSON contains an
-array of counter objects.  Each object contains the property
-.B counter
-specifying either a CPU-MF counter of one of the detailed PAI counter.
-Additional properties include
-.B error
-an error number if the counter could not be read,
-.B value
-the counter value if the counter could be read,
-.B space
-for PAI counters to specify
-.B user
-or
-.B kernel
-space counter set, and
-.B counterid
-for PAI counters to specify the PAI counter number as specified in the
-Principles of Operation.
-.TP
-The default command is --print all.
-.
-.SH FILES
-.nf
-/run/cpacfstatsd_socket
-.fi
-.
-.SH RETURN VALUE
-.IP 0
-Successful program execution.
-.IP 1
-An error occurred, reasons include: invalid argument, cpacfstatsd could not
-be reached (check that the daemon is running), insufficient access rights,
-version mismatch between client and daemon, or the application is out of
-memory. The application prints a message with the details of the error and
-the errno value.
-.
-.SH NOTES
-ECC counters are only available since z15. cpacfstats will show the
-counters as \fIunsupported\fR if the hardware does not support ECC
-counters.
 .
 .SH SEE ALSO
 .BR cpacfstatsd (8)

cpumf/chcpumf.c

@@ -16,11 +16,11 @@
 #include <unistd.h>
 #include <sys/stat.h>
 
-#include "lib/util_opt.h"
-#include "lib/util_prg.h"
-#include "lib/util_base.h"
-
 #include "lib/libcpumf.h"
+#include "lib/util_base.h"
+#include "lib/util_opt.h"
+#include "lib/util_path.h"
+#include "lib/util_prg.h"
 
 static unsigned int verbose;
 static unsigned long min_sdb, max_sdb;
@@ -88,21 +88,22 @@ static long parse_buffersize(char *string)
 static int write_sfb(unsigned int min, unsigned int max)
 {
 	int rc = EXIT_SUCCESS;
-	char text[64];
+	char text[64], *path;
 	size_t len;
 	FILE *fp;
 
-	fp = fopen(S390_CPUMSF_BUFFERSZ, "w");
+	path = util_path_sysfs(S390_CPUMSF_BUFFERSZ);
+	fp = fopen(path, "w");
 	if (!fp)
-		err(EXIT_FAILURE, S390_CPUMSF_BUFFERSZ);
+		err(EXIT_FAILURE, "%s", path);
 	snprintf(text, sizeof(text), "%u,%u", min, max);
 	len = strlen(text) + 1;
 	if (fwrite(text, 1, len, fp) != len) {
-		warn(S390_CPUMSF_BUFFERSZ);
+		warn("%s", path);
 		rc = EXIT_FAILURE;
 	}
 	if (fclose(fp)) {
-		warn(S390_CPUMSF_BUFFERSZ);
+		warn("%s", path);
 		rc = EXIT_FAILURE;
 	}
 	if (verbose && rc != EXIT_FAILURE)
@@ -110,6 +111,7 @@ static int write_sfb(unsigned int min, unsigned int max)
 		      "    Minimum:%7d sample-data-blocks\n"
 		      "    Maximum:%7d sample-data-blocks\n",
 		      min, max);
+	free(path);
 	return rc;
 }
 

cpumf/lscpumf.c

@@ -162,13 +162,6 @@ static struct samples {		/* Sample definition for all machines */
  * Second version number: >3    Range 448 to 495 inclusive (48 counters)
  */
 
-#define CPUMF_CTRSET_NONE               0
-#define CPUMF_CTRSET_BASIC              2
-#define CPUMF_CTRSET_PROBLEM_STATE      4
-#define CPUMF_CTRSET_CRYPTO             8
-#define CPUMF_CTRSET_EXTENDED           1
-#define CPUMF_CTRSET_MT_DIAG            32
-
 struct counters {
 	int ctrnum;
 	int ctrset;
@@ -3136,6 +3129,641 @@ static struct counters cpumcf_z16_counters[] = {
 	},
 };
 
+static struct counters cpumcf_z17_counters[] = {
+	{
+		.ctrnum = 128,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "L1D_RO_EXCL_WRITES",
+		.desc = "A directory write to the Level-1 Data cache where"
+			"\n\t\tthe line was originally in a Read-Only state in the"
+			"\n\t\tcache but has been updated to be in the Exclusive"
+			"\n\t\tstate that allows stores to the cache line.",
+	},
+	{
+		.ctrnum = 129,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DTLB2_WRITES",
+		.desc = "A translation has been written into The Translation"
+			"\n\t\tLookaside Buffer 2 (TLB2) and the request was made"
+			"\n\t\tby the Level-1 Data cache. This is a replacement"
+			"\n\t\tfor what was provided for the DTLB on z13 and prior"
+			"\n\t\tmachines.",
+	},
+	{
+		.ctrnum = 130,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DTLB2_MISSES",
+		.desc = "A TLB2 miss is in progress for a request made by"
+			"\n\t\tthe Level-1 Data cache. Incremented by one for"
+			"\n\t\tevery TLB2 miss in progress for the Level-1 Data"
+			"\n\t\tcache on this cycle. This is a replacement for what"
+			"\n\t\twas provided for the DTLB on z13 and prior"
+			"\n\t\tmachines.",
+	},
+	{
+		.ctrnum = 131,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "CRSTE_1MB_WRITES",
+		.desc = "A translation entry was written into the Combined"
+			"\n\t\tRegion and Segment Table Entry array in the Level-2"
+			"\n\t\tTLB for a one-megabyte page.",
+	},
+	{
+		.ctrnum = 132,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DTLB2_GPAGE_WRITES",
+		.desc = "A translation entry for a two-gigabyte page was"
+			"\n\t\twritten into the Level-2 TLB.",
+	},
+	{
+		.ctrnum = 134,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ITLB2_WRITES",
+		.desc = "A translation entry has been written into the"
+			"\n\t\tTranslation Lookaside Buffer 2 (TLB2) and the"
+			"\n\t\trequest was made by the Level-1 Instruction cache."
+			"\n\t\tThis is a replacement for what was provided for the"
+			"\n\t\tITLB on z13 and prior machines.",
+	},
+	{
+		.ctrnum = 135,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ITLB2_MISSES",
+		.desc = "A TLB2 miss is in progress for a request made by"
+			"\n\t\tthe Level-1 Instruction cache. Incremented by one"
+			"\n\t\tfor every TLB2 miss in progress for the Level-1"
+			"\n\t\tInstruction cache in a cycle. This is a replacement"
+			"\n\t\tfor what was provided for the ITLB on z13 and prior"
+			"\n\t\tmachines.",
+	},
+	{
+		.ctrnum = 137,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TLB2_PTE_WRITES",
+		.desc = "A translation entry was written into the Page Table"
+			"\n\t\tEntry array in the Level-2 TLB.",
+	},
+	{
+		.ctrnum = 138,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TLB2_CRSTE_WRITES",
+		.desc = "Translation entries were written into the Combined"
+			"\n\t\tRegion and Segment Table Entry array and the Page"
+			"\n\t\tTable Entry array in the Level-2 TLB.",
+	},
+	{
+		.ctrnum = 139,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TLB2_ENGINES_BUSY",
+		.desc = "The number of Level-2 TLB translation engines busy"
+			"\n\t\tin a cycle.",
+	},
+	{
+		.ctrnum = 140,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TX_C_TEND",
+		.desc = "A TEND instruction has completed in a constrained"
+			"\n\t\ttransactional-execution mode.",
+	},
+	{
+		.ctrnum = 141,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TX_NC_TEND",
+		.desc = "A TEND instruction has completed in a non-"
+			"\n\t\tconstrained transactional-execution mode.",
+	},
+	{
+		.ctrnum = 143,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "L1C_TLB2_MISSES",
+		.desc = "Increments by one for any cycle where a Level-1"
+			"\n\t\tcache or Level-2 TLB miss is in progress.",
+	},
+	{
+		.ctrnum = 145,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_REQ",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache.",
+	},
+	{
+		.ctrnum = 146,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_REQ_IV",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache with"
+			"\n\t\tintervention.",
+	},
+	{
+		.ctrnum = 147,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_REQ_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache after using"
+			"\n\t\tchip level horizontal persistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 148,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_REQ_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache after using"
+			"\n\t\tdrawer level horizontal persistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 149,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_CHIP",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache.",
+	},
+	{
+		.ctrnum = 150,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_CHIP_IV",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache with intervention.",
+	},
+	{
+		.ctrnum = 151,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_CHIP_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache after using chip"
+			"\n\t\tlevel horizontal persistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 152,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_CHIP_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache after using drawer"
+			"\n\t\tlevel horizontal persistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 153,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_MODULE",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Module Level-2 cache.",
+	},
+	{
+		.ctrnum = 154,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_DRAWER",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Drawer Level-2 cache.",
+	},
+	{
+		.ctrnum = 155,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_OFF_DRAWER",
+		.desc = "A directory write to the Level-1 Data cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an Off-Drawer Level-2 cache.",
+	},
+	{
+		.ctrnum = 156,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_CHIP_MEMORY",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from On-Chip memory.",
+	},
+	{
+		.ctrnum = 157,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_MODULE_MEMORY",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from On-Module memory.",
+	},
+	{
+		.ctrnum = 158,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_ON_DRAWER_MEMORY",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from On-Drawer memory.",
+	},
+	{
+		.ctrnum = 159,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DCW_OFF_DRAWER_MEMORY",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from Off-Drawer memory.",
+	},
+	{
+		.ctrnum = 160,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_ON_MODULE_IV",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an On-Module Level-2"
+			"\n\t\tcache with intervention.",
+	},
+	{
+		.ctrnum = 161,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_ON_MODULE_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an On-Module Level-2"
+			"\n\t\tcache after using chip level horizontal"
+			"\n\t\tpersistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 162,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_ON_MODULE_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an On-Module Level-2"
+			"\n\t\tcache after using drawer level horizontal"
+			"\n\t\tpersistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 163,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_ON_DRAWER_IV",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an On-Drawer Level-2"
+			"\n\t\tcache with intervention.",
+	},
+	{
+		.ctrnum = 164,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_ON_DRAWER_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tinstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an On-Drawer Level-2"
+			"\n\t\tcache after using chip level horizontal"
+			"\n\t\tpersistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 165,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_ON_DRAWER_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tinstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an On-Drawer Level-2"
+			"\n\t\tcache after using drawer level horizontal"
+			"\n\t\tpersistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 166,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_OFF_DRAWER_IV",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tinstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an Off-Drawer Level-2"
+			"\n\t\tcache with intervention.",
+	},
+	{
+		.ctrnum = 167,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_OFF_DRAWER_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tinstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an Off-Drawer Level-2"
+			"\n\t\tcache after using chip level horizontal"
+			"\n\t\tpersistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 168,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "IDCW_OFF_DRAWER_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Data or Level-1"
+			"\n\t\tInstruction cache directory where the returned"
+			"\n\t\tcache line was sourced from an Off-Drawer Level-2"
+			"\n\t\tcache after using drawer level horizontal"
+			"\n\t\tpersistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 169,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_REQ",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tthe requestors Level-2 cache.",
+	},
+	{
+		.ctrnum = 170,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_REQ_IV",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache with"
+			"\n\t\tintervention.",
+	},
+	{
+		.ctrnum = 171,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_REQ_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache after using"
+			"\n\t\tchip level horizontal persistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 172,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_REQ_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom the requestors Level-2 cache after using"
+			"\n\t\tdrawer level horizontal persistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 173,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_ON_CHIP",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache.",
+	},
+	{
+		.ctrnum = 174,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_ON_CHIP_IV",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache with intervention.",
+	},
+	{
+		.ctrnum = 175,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_ON_CHIP_CHIP_HIT",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip Level-2 cache after using chip"
+			"\n\t\tlevel horizontal persistence, Chip-HP hit.",
+	},
+	{
+		.ctrnum = 176,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_ON_CHIP_DRAWER_HIT",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Chip level 2 cache after using drawer"
+			"\n\t\tlevel horizontal persistence, Drawer-HP hit.",
+	},
+	{
+		.ctrnum = 177,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_ON_MODULE",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Module Level-2 cache.",
+	},
+	{
+		.ctrnum = 178,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_ON_DRAWER",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an On-Drawer Level-2 cache.",
+	},
+	{
+		.ctrnum = 179,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "ICW_OFF_DRAWER",
+		.desc = "A directory write to the Level-1 Instruction cache"
+			"\n\t\tdirectory where the returned cache line was sourced"
+			"\n\t\tfrom an Off-Drawer Level-2 cache.",
+	},
+	{
+		.ctrnum = 202,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "CYCLES_SAMETHRD",
+		.desc = "The number of cycles the CPU is not in wait state"
+			"\n\t\tand the CPU is running by itself on the Core.",
+	},
+	{
+		.ctrnum = 203,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "CYCLES_DIFFTHRD",
+		.desc = "The number of cycles the CPU is not in wait state"
+			"\n\t\tand the CPU is running with another thread on the"
+			"\n\t\tCore.",
+	},
+	{
+		.ctrnum = 204,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "INST_SAMETHRD",
+		.desc = "The number of instructions executed on the CPU and"
+			"\n\t\tthe CPU is running by itself on the Core.",
+	},
+	{
+		.ctrnum = 205,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "INST_DIFFTHRD",
+		.desc = "The number of instructions executed on the CPU and"
+			"\n\t\tthe CPU is running with another thread on the Core.",
+	},
+	{
+		.ctrnum = 206,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "WRONG_BRANCH_PREDICTION",
+		.desc = "A count of the number of branches that were"
+			"\n\t\tpredicted incorrectly by the branch prediction"
+			"\n\t\tlogic in the Core. This includes incorrectly"
+			"\n\t\tpredicted branches that are executed in Firmware."
+			"\n\t\tExamples of instructions implemented in Firmware"
+			"\n\t\tare complicated instructions like MVCL (Move"
+			"\n\t\tCharacter Long) and PC (Program Call).",
+	},
+	{
+		.ctrnum = 225,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "VX_BCD_EXECUTION_SLOTS",
+		.desc = "Count of floating point execution slots used for"
+			"\n\t\tfinished vector arithmetic Binary Coded Decimal"
+			"\n\t\tinstructions. Instructions: VAP, VSP, VMP, VMSP,"
+			"\n\t\tVDP, VSDP, VRP, VLIP, VSRP, VPSOP, VCP, VTP, VPKZ,"
+			"\n\t\tVUPKZ, VCVB, VCVBG, VCVD, VCVDG, VSCHP, VSCSHP,"
+			"\n\t\tVCSPH, VCLZDP, VPKZR, VSRPR, VUPKZH, VUPKZL, VTZ,"
+			"\n\t\tVUPH, VUPL, VCVBX, VCVDX.",
+	},
+	{
+		.ctrnum = 226,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DECIMAL_INSTRUCTIONS",
+		.desc = "Decimal instruction dispatched. Instructions: CVB,"
+			"\n\t\tCVD, AP, CP, DP, ED, EDMK, MP, SRP, SP, ZAP, TP.",
+	},
+	{
+		.ctrnum = 232,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "LAST_HOST_TRANSLATIONS",
+		.desc = "Last Host Translation done.",
+	},
+	{
+		.ctrnum = 244,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TX_NC_TABORT",
+		.desc = "A transaction abort has occurred in a non-"
+			"\n\t\tconstrained transactional-execution mode.",
+	},
+	{
+		.ctrnum = 245,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TX_C_TABORT_NO_SPECIAL",
+		.desc = "A transaction abort has occurred in a constrained"
+			"\n\t\ttransactional-execution mode and the CPU is not"
+			"\n\t\tusing any special logic to allow the transaction to"
+			"\n\t\tcomplete.",
+	},
+	{
+		.ctrnum = 246,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "TX_C_TABORT_SPECIAL",
+		.desc = "A transaction abort has occurred in a constrained"
+			"\n\t\ttransactional-execution mode and the CPU is using"
+			"\n\t\tspecial logic to allow the transaction to complete.",
+	},
+	{
+		.ctrnum = 248,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DFLT_ACCESS",
+		.desc = "Cycles CPU spent obtaining access to Deflate unit.",
+	},
+	{
+		.ctrnum = 253,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DFLT_CYCLES",
+		.desc = "Cycles CPU is using Deflate unit.",
+	},
+	{
+		.ctrnum = 256,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "SORTL",
+		.desc = "Increments by one for every SORT LISTS (SORTL)"
+			"\n\t\tinstruction executed.",
+	},
+	{
+		.ctrnum = 265,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DFLT_CC",
+		.desc = "Increments by one for every DEFLATE CONVERSION CALL"
+			"\n\t\t(DFLTCC) instruction executed.",
+	},
+	{
+		.ctrnum = 266,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "DFLT_CCFINISH",
+		.desc = "Increments by one for every DEFLATE CONVERSION CALL"
+			"\n\t\t(DFLTCC) instruction executed that ended in"
+			"\n\t\tCondition Codes 0, 1 or 2.",
+	},
+	{
+		.ctrnum = 267,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_INVOCATIONS",
+		.desc = "Increments by one for every NEURAL NETWORK"
+			"\n\t\tPROCESSING ASSIST (NNPA) instruction executed.",
+	},
+	{
+		.ctrnum = 268,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_COMPLETIONS",
+		.desc = "Increments by one for every NEURAL NETWORK"
+			"\n\t\tPROCESSING ASSIST (NNPA) instruction executed that"
+			"\n\t\tended in Condition Code 0.",
+	},
+	{
+		.ctrnum = 269,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_WAIT_LOCK",
+		.desc = "Cycles CPU spent obtaining access to IBM Z"
+			"\n\t\tIntegrated Accelerator for AI.",
+	},
+	{
+		.ctrnum = 270,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_HOLD_LOCK",
+		.desc = "Cycles CPU is using IBM Z Integrated Accelerator"
+			"\n\t\tfor AI.",
+	},
+	{
+		.ctrnum = 272,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_INST_ONCHIP",
+		.desc = "A NEURAL NETWORK PROCESSING ASSIST (NNPA)"
+			"\n\t\tinstruction has used the Local On-Chip IBM Z"
+			"\n\t\tIntegrated Accelerator for AI during its execution",
+	},
+	{
+		.ctrnum = 273,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_INST_OFFCHIP",
+		.desc = "A NEURAL NETWORK PROCESSING ASSIST (NNPA)"
+			"\n\t\tinstruction has used an Off-Chip IBM Z Integrated"
+			"\n\t\tAccelerator for AI during its execution.",
+	},
+	{
+		.ctrnum = 274,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_INST_DIFF",
+		.desc = "A NEURAL NETWORK PROCESSING ASSIST (NNPA)"
+			"\n\t\tinstruction has used a different IBM Z Integrated"
+			"\n\t\tAccelerator for AI since it was last executed.",
+	},
+	{
+		.ctrnum = 276,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_4K_PREFETCH",
+		.desc = "Number of 4K prefetches done for a remote IBM Z"
+			"\n\t\tIntegated Accelerator for AI.",
+	},
+	{
+		.ctrnum = 277,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_COMPL_LOCK",
+		.desc = "A PERFORM LOCKED OPERATION (PLO) has completed.",
+	},
+	{
+		.ctrnum = 278,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_RETRY_LOCK",
+		.desc = "A PERFORM LOCKED OPERATION (PLO) has been retried and"
+			"\n\t\tthe CPU did not use any special logic to allow the"
+			"\n\t\tPLO to complete.",
+	},
+	{
+		.ctrnum = 279,
+		.ctrset = CPUMF_CTRSET_EXTENDED,
+		.name = "NNPA_RETRY_LOCK_WITH_PLO",
+		.desc = "A PERFORM LOCKED OPERATION (PLO) has been retried and"
+			"\n\t\tthe CPU is using special logic to allow PLO to"
+			"\n\t\tcomplete.",
+	},
+	{
+		.ctrnum = 448,
+		.ctrset = CPUMF_CTRSET_MT_DIAG,
+		.name = "MT_DIAG_CYCLES_ONE_THR_ACTIVE",
+		.desc = "Cycle count with one thread active",
+	},
+	{
+		.ctrnum = 449,
+		.ctrset = CPUMF_CTRSET_MT_DIAG,
+		.name = "MT_DIAG_CYCLES_TWO_THR_ACTIVE",
+		.desc = "Cycle count with two threads active",
+	},
+};
+
 /* Return the type number of the CPU Measurement facility from the sysfs file.
  * If the type number is equal to PERF_TYPE_RAW, then the prefix is 'r' to
  * specify the raw counter number by the perf tool.
@@ -3476,6 +4104,12 @@ static struct counters *get_counter(int ctrset, size_t *len)
 		case UTIL_ARCH_MACHINE_TYPE_Z16_A02:
 			cp = cpumcf_z16_counters;
 			*len = ARRAY_SIZE(cpumcf_z16_counters);
+			break;
+		case UTIL_ARCH_MACHINE_TYPE_Z17:
+		case UTIL_ARCH_MACHINE_TYPE_Z17_2:
+			cp = cpumcf_z17_counters;
+			*len = ARRAY_SIZE(cpumcf_z17_counters);
+			break;
 		}
 		break;
 	}

cpumf/lshwc.c

@@ -1,4 +1,4 @@
-/* Copyright IBM Corp. 2021
+/* Copyright IBM Corp. 2021, 2024
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -39,6 +39,7 @@
 #include "lib/util_scandir.h"
 #include "lib/util_libc.h"
 #include "lib/util_file.h"
+#include "lib/util_fmt.h"
 #include "lib/libcpumf.h"
 
 #include "lshwc.h"
@@ -51,18 +52,91 @@
 
 static unsigned int read_interval = IOCTLSLEEP;
 static int cfvn, csvn, authorization;
-static unsigned long loop_count = 1;
+static unsigned long loop_count = 1, timeout;
 static unsigned char *ioctlbuffer;
 static bool allcpu;
+static char *ctrformat = "%ld";
+static bool shortname;
+static bool hideundef;
+static bool delta, firstread;
+static int output_format = FMT_CSV;
+static bool quote_all;
 
 static unsigned int max_possible_cpus;	/* No of possible CPUs */
 static struct ctrname {		/* List of defined counters */
 	char *name;		/* Counter name */
+	char *label;		/* Output name */
 	bool hitcnt;		/* Counter number read from ioctl() */
 	unsigned long total;	/* Total counter value */
 	unsigned long *ccv;	/* Per CPU counter value */
+	unsigned long *ccvprv;	/* Per CPU counter value (previous read) */
 } ctrname[MAXCTRS];
 
+struct time_formats {
+	char epoch[32];
+	char date_time[32];
+	char date[16];
+	char time[16];
+};
+
+static void mk_labels(void)
+{
+	char label[64];
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(ctrname); ++i) {
+		if (shortname) {
+			if (ctrname[i].name)
+				snprintf(label, sizeof(label), "%s", ctrname[i].name);
+			else
+				snprintf(label, sizeof(label), "U%ld", i);
+		} else {
+			if (output_format == FMT_CSV)
+				snprintf(label, sizeof(label), "%s(%ld)",
+					 ctrname[i].name ?: "Counter", i);
+			else if (ctrname[i].name)
+				snprintf(label, sizeof(label), "%s", ctrname[i].name);
+			else
+				label[0] = 0;
+		}
+		if (output_format != FMT_CSV)
+			util_str_tolower(label);
+		ctrname[i].label = util_strdup(label);
+	}
+}
+
+static char *mk_name(int ctr, char *name)
+{
+	char ctrset[8];
+
+	if (!shortname)
+		return util_strdup(name);
+
+	switch (libcpumf_ctrset(ctr, cfvn, csvn)) {
+	case CPUMF_CTRSET_BASIC:
+		ctrset[0] = 'B';
+		break;
+	case CPUMF_CTRSET_PROBLEM_STATE:
+		ctrset[0] = 'P';
+		break;
+	case CPUMF_CTRSET_CRYPTO:
+		ctrset[0] = 'C';
+		break;
+	case CPUMF_CTRSET_EXTENDED:
+		ctrset[0] = 'E';
+		break;
+	case CPUMF_CTRSET_MT_DIAG:
+		ctrset[0] = 'M';
+		break;
+	default:
+		ctrset[0] = 'U';
+		break;
+	}
+	sprintf(ctrset, "%c%d", ctrset[0], ctr);
+
+	return util_strdup(ctrset);
+}
+
 static bool read_counternames(void)
 {
 	struct dirent **namelist = NULL;
@@ -79,7 +153,7 @@ static bool read_counternames(void)
 	for (i = 0; i < count && ctr >= 0; i++) {
 		util_asprintf(&ctrpath, "%s/%s", path, namelist[i]->d_name);
 		if (util_file_read_va(ctrpath, "event=%x", &ctr) == 1)
-			ctrname[ctr].name = util_strdup(namelist[i]->d_name);
+			ctrname[ctr].name = mk_name(ctr, namelist[i]->d_name);
 		else
 			warnx("Cannot parse %s", ctrpath);
 		free(ctrpath);
@@ -93,7 +167,9 @@ static void free_counternames(void)
 {
 	for (size_t i = 0; i < ARRAY_SIZE(ctrname); ++i) {
 		free(ctrname[i].name);
+		free(ctrname[i].label);
 		free(ctrname[i].ccv);
+		free(ctrname[i].ccvprv);
 	}
 }
 
@@ -298,77 +374,111 @@ static bool check_setpossible(void)
 	return true;
 }
 
-static void show_header(void)
+static void safe_strtime(char *dest, size_t size, const char *fmt, const struct tm *tm)
 {
-	static bool header;
-	bool comma = false;
-
-	if (header)
-		return;			/* Printed already */
-	printf("Date,Time,CPU,");	/* Print counter name and number */
-	for (size_t i = 0; i < ARRAY_SIZE(ctrname); ++i) {
-		if (!ctrname[i].hitcnt)
-			continue;
-		if (comma)
-			putchar(',');
-		printf("%s(%ld)", ctrname[i].name ?: "Counter", i);
-		comma = true;
-	}
-	putchar('\n');
-	header = true;
+	if (!strftime(dest, size, fmt, tm))
+		dest[0] = 0;
 }
 
-static void line(char *header)
+static void generate_timestamp(struct time_formats *date)
 {
-	bool comma;
+	time_t now = time(NULL);
+	struct tm *now_tm = localtime(&now);
 
-	show_header();
-	if (allcpu) {
-		for (unsigned int h = 0; h < max_possible_cpus; ++h) {
-			char txt[16];
+	safe_strtime(date->date_time, sizeof(date->date_time), "%F %T%z", now_tm);
+	safe_strtime(date->date, sizeof(date->date), "%F", now_tm);
+	safe_strtime(date->time, sizeof(date->time), "%T", now_tm);
+	safe_strtime(date->epoch, sizeof(date->epoch), "%s", now_tm);
+}
 
-			if (!check[h].cpu_hit)
-				continue;
-			comma = false;
-			snprintf(txt, sizeof(txt), "CPU%d,", h);
-			printf("%s%s", header, txt);
-			for (size_t i = 0; i < ARRAY_SIZE(ctrname); ++i) {
-				if (!ctrname[i].hitcnt)
-					continue;
-				if (comma)
-					putchar(',');
-				printf("%ld", ctrname[i].ccv[h]);
-				comma = true;
-			}
-			putchar('\n');
-		}
+static void output_times(struct time_formats date)
+{
+	if (output_format == FMT_CSV) {
+		util_fmt_pair(FMT_PERSIST, "Date", "%s", date.date);
+		util_fmt_pair(FMT_PERSIST, "Time", "%s", date.time);
+	} else {
+		util_fmt_pair(FMT_PERSIST | FMT_QUOTE, "date_time", "%s", date.date_time);
+		util_fmt_pair(FMT_PERSIST, "time_epoch", "%s", date.epoch);
 	}
+}
 
-	/* Print total count of all CPUs */
-	printf("%sTotal,", header);
-	comma = false;
+static void prepare_counter(size_t id, unsigned long value)
+{
+	if (output_format == FMT_CSV) {
+		util_fmt_pair(FMT_PERSIST, ctrname[id].label, ctrformat, value);
+	} else {
+		util_fmt_obj_start(FMT_ROW, NULL);
+		if (strlen(ctrname[id].label))
+			util_fmt_pair(FMT_PERSIST | FMT_QUOTE, "name", ctrname[id].label);
+		util_fmt_pair(FMT_PERSIST, "id", ctrformat, id);
+		util_fmt_pair(FMT_PERSIST, "value", ctrformat, value);
+		util_fmt_obj_end();
+	}
+}
+
+static void output_per_cpu(struct time_formats date)
+{
+	for (unsigned int h = 0; h < max_possible_cpus; ++h) {
+		if (!check[h].cpu_hit)
+			continue;
+
+		char txt[16];
+
+		snprintf(txt, sizeof(txt), "CPU%d", h);
+		util_fmt_obj_start(FMT_ROW, "cpu_%d", h);
+		output_times(date);
+		if (output_format == FMT_CSV) {
+			util_fmt_pair(FMT_PERSIST, "CPU", "CPU%d", h);
+		} else {
+			util_fmt_pair(FMT_PERSIST, "cpu", "%d", h);
+			util_fmt_obj_start(FMT_LIST, "counters");
+		}
+		for (size_t i = 0; i < ARRAY_SIZE(ctrname); ++i) {
+			if (!ctrname[i].hitcnt)
+				continue;
+			if (hideundef && !ctrname[i].name)
+				continue;
+			prepare_counter(i, ctrname[i].ccv[h]);
+		}
+		if (output_format != FMT_CSV)
+			util_fmt_obj_end();
+		util_fmt_obj_end();
+	}
+}
+
+static void output_total(struct time_formats date)
+{
+	util_fmt_obj_start(FMT_ROW, "total");
+	output_times(date);
+	if (output_format == FMT_CSV) {
+		util_fmt_pair(FMT_PERSIST, "CPU", "%s", delta && !firstread ? "Delta" : "Total");
+	} else {
+		util_fmt_pair(FMT_PERSIST | FMT_QUOTE, "cpu", "%s",
+			      delta && !firstread ? "delta" : "total");
+		util_fmt_obj_start(FMT_LIST, "counters");
+	}
 	for (size_t i = 0; i < ARRAY_SIZE(ctrname); ++i) {
 		if (!ctrname[i].hitcnt)
 			continue;
-		if (comma)
-			putchar(',');
-		printf("%ld", ctrname[i].total);
-		comma = true;
+		if (hideundef && !ctrname[i].name)
+			continue;
+		prepare_counter(i, ctrname[i].total);
 		ctrname[i].total = 0;
 		ctrname[i].hitcnt = false;
 	}
-	putchar('\n');
+	if (output_format != FMT_CSV)
+		util_fmt_obj_end();
+	util_fmt_obj_end();
 }
 
-static void show(void)
+static void show_format(void)
 {
-	time_t now = time(NULL);
-	struct tm *now_tm;
-	char now_text[32];
+	struct time_formats now;
 
-	now_tm = localtime(&now);
-	strftime(now_text, sizeof(now_text), "%F,%T,", now_tm);
-	line(now_text);
+	generate_timestamp(&now);
+	if (allcpu)
+		output_per_cpu(now);
+	output_total(now);
 }
 
 /* Return Counter set size numbers (in counters) */
@@ -442,11 +552,18 @@ static bool add_countervalue(size_t idx, unsigned int cpu, unsigned long value)
 		warnx("Invalid CPU number %d", cpu);
 		return false;
 	}
-	if (!ctrname[idx].ccv)		/* Unknown counter */
-		ctrname[idx].ccv = calloc(max_possible_cpus,
-					  sizeof(unsigned long));
-	if (ctrname[idx].ccv)
+	if (delta) {
+		if (firstread) {
+			ctrname[idx].ccvprv[cpu] = value;
+			ctrname[idx].ccv[cpu] = value;
+		} else {
+			ctrname[idx].ccv[cpu] = value - ctrname[idx].ccvprv[cpu];
+			ctrname[idx].ccvprv[cpu] = value;
+			value = ctrname[idx].ccv[cpu];
+		}
+	} else {
 		ctrname[idx].ccv[cpu] = value;
+	}
 	ctrname[idx].total += value;
 	ctrname[idx].hitcnt = true;
 	return true;
@@ -493,7 +610,8 @@ static int test_read(struct s390_hwctr_read *read)
 			}
 		}
 	}
-	show();
+	show_format();
+	firstread = false;
 	return 0;
 }
 
@@ -556,6 +674,7 @@ static void do_sleep(void)
 static int do_it(char *s)
 {
 	struct s390_hwctr_start start;
+	unsigned int flags = FMT_WARN;
 	int ioctlfd;
 	int rc;
 
@@ -575,6 +694,24 @@ static int do_it(char *s)
 		return EXIT_FAILURE;
 	}
 
+	if (output_format == FMT_CSV)
+		flags |= FMT_NOMETA;
+	if (output_format == FMT_JSON || output_format == FMT_JSONSEQ)
+		flags |= FMT_HANDLEINT;
+	if (quote_all)
+		flags |= FMT_QUOTEALL;
+
+	mk_labels();
+	util_fmt_init(stdout, output_format, flags, 1);
+	util_fmt_obj_start(FMT_DEFAULT, "lshwc");
+	if (output_format == FMT_JSON || output_format == FMT_JSONSEQ) {
+		util_fmt_obj_start(FMT_ROW, "cpumcf info");
+		util_fmt_pair(FMT_PERSIST, "counter first", "%d", cfvn);
+		util_fmt_pair(FMT_PERSIST, "counter second", "%d", csvn);
+		util_fmt_pair(FMT_PERSIST, "authorization", "%d", authorization);
+		util_fmt_obj_end();
+	}
+	util_fmt_obj_start(FMT_LIST, "measurements");
 	for (unsigned long i = 0; !rc && i < loop_count; ++i) {
 		rc = do_read(ioctlfd);
 		if (rc) {
@@ -584,6 +721,9 @@ static int do_it(char *s)
 		if (read_interval && i + 1 < loop_count)
 			do_sleep();
 	}
+	util_fmt_obj_end();
+	util_fmt_obj_end();
+	util_fmt_exit();
 	rc = do_stop(ioctlfd);
 	close(ioctlfd);
 	return rc ? EXIT_FAILURE : EXIT_SUCCESS;
@@ -605,6 +745,40 @@ static struct util_opt opt_vec[] = {
 		.argument = "NUMBER",
 		.desc = "Specifies interval between read operations (seconds)"
 	},
+	{
+		.option = { "short", no_argument, NULL, 's' },
+		.desc = "Abbreviate counter name with counter set letter and number"
+	},
+	{
+		.option = { "hex0x", no_argument, NULL, 'X' },
+		.desc = "Counter values in hexadecimal format with leading 0x"
+	},
+	{
+		.option = { "hex", no_argument, NULL, 'x' },
+		.desc = "Counter values in hexadecimal format"
+	},
+	{
+		.option = { "hide", no_argument, NULL, 'H' },
+		.desc = "Do not display undefined counters of a counter set"
+	},
+	{
+		.option = { "delta", no_argument, NULL, 'd' },
+		.desc = "Display delta counter values"
+	},
+	{
+		.option = { "timeout", required_argument, NULL, 't' },
+		.argument = "NUMBER",
+		.desc = "run time in s (seconds) m (minutes) h (hours) and d (days)"
+	},
+	{
+		.option = { "quote-all", no_argument, NULL, 'q' },
+		.desc = "Apply quoting to all output elements"
+	},
+	{
+		.option = { "format", required_argument, NULL, 'f' },
+		.argument = "FORMAT",
+		.desc = "List counters in specified FORMAT (" FMT_TYPE_NAMES ")"
+	},
 	UTIL_OPT_HELP,
 	UTIL_OPT_VERSION,
 	UTIL_OPT_END
@@ -634,6 +808,8 @@ static void have_support(void)
 
 int main(int argc, char **argv)
 {
+	enum util_fmt_t fmt;
+	unsigned long no;
 	char *slash;
 	int ch;
 
@@ -665,12 +841,65 @@ int main(int argc, char **argv)
 			if (errno || *slash)
 				errx(EXIT_FAILURE, "Invalid argument for -%c", ch);
 			break;
+		case 'H':
+			hideundef = true;
+			break;
+		case 's':
+			shortname = true;
+			break;
+		case 'x':
+			ctrformat = "%lx";
+			break;
+		case 'X':
+			ctrformat = "%#lx";
+			break;
 		case 'a':
 			allcpu = true;
 			break;
+		case 'd':
+			delta = true;
+			firstread = true;
+			break;
+		case 't':
+			errno = 0;
+			no = strtoul(optarg, &slash, 0);
+			if (errno)
+				errx(EXIT_FAILURE, "Invalid argument for -%c", ch);
+			switch (*slash) {
+			case 's':
+			case '\0':
+				timeout += no;
+				break;
+			case 'm':
+				timeout += no * 60;
+				break;
+			case 'h':
+				timeout += no * 60 * 60;
+				break;
+			case 'd':
+				timeout += no * 60 * 60 * 24;
+				break;
+			default:
+				errx(EXIT_FAILURE, "Invalid argument for -%c", ch);
+				break;
+			}
+			break;
+		case 'q':
+			quote_all = true;
+			break;
+		case 'f':
+			if (!util_fmt_name_to_type(optarg, &fmt))
+				errx(EXIT_FAILURE, "Supported formats:" FMT_TYPE_NAMES);
+			output_format = fmt;
+			break;
 		}
 	}
 
+	if (timeout && timeout < read_interval)
+		read_interval = timeout;
+	/* If no timeout specified, simply add zero */
+	loop_count += timeout / read_interval;
+
 	have_support();
 	if (!libcpumf_cpumcf_info(&cfvn, &csvn, &authorization))
 		return EXIT_FAILURE;
@@ -681,6 +910,11 @@ int main(int argc, char **argv)
 		return EXIT_FAILURE;
 	}
 
+	for (unsigned int i = 0; i < ARRAY_SIZE(ctrname); ++i) {
+		ctrname[i].ccv = util_zalloc(max_possible_cpus * sizeof(unsigned long));
+		ctrname[i].ccvprv = util_zalloc(max_possible_cpus * sizeof(unsigned long));
+	}
+
 	if (optind >= argc) {
 		ch = do_it(NULL);
 	} else {
@@ -692,5 +926,6 @@ int main(int argc, char **argv)
 	}
 	free_counternames();
 	free(check);
+	free(ioctlbuffer);
 	return ch;
 }

cpumf/lspai.c

@@ -19,18 +19,26 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "lib/util_opt.h"
-#include "lib/util_prg.h"
 #include "lib/util_base.h"
-#include "lib/util_path.h"
-#include "lib/util_scandir.h"
-#include "lib/util_libc.h"
 #include "lib/util_file.h"
+#include "lib/util_fmt.h"
+#include "lib/util_libc.h"
 #include "lib/util_list.h"
+#include "lib/util_opt.h"
+#include "lib/util_path.h"
+#include "lib/util_prg.h"
+#include "lib/util_scandir.h"
 #include "lib/libcpumf.h"
 
+#define	OPT_FORMAT		256	/* --format XXX option */
 static struct util_opt opt_vec[] = {
 	UTIL_OPT_SECTION("OPTIONS"),
+	{
+		.option = { "format", required_argument, NULL, OPT_FORMAT },
+		.argument = "FORMAT",
+		.flags = UTIL_OPT_FLAG_NOSHORT,
+		.desc = "List counters in specified FORMAT (" FMT_TYPE_NAMES ")"
+	},
 	{
 		.option = { "numeric", no_argument, NULL, 'n' },
 		.desc = "Sort PAI counters by counter number"
@@ -58,6 +66,7 @@ static const struct util_prg prg = {
 };
 
 static bool numsort;		/* If true sort counter numerically */
+static int output_format = -1;	/* Generate style if >= 0 */
 
 #define PAI_PATH	"/bus/event_source/devices/%s"
 
@@ -190,12 +199,44 @@ static void read_counternames(struct pai_node *node)
 		qsort(node->ctrlist, more, sizeof(*node->ctrlist), pai_ctrcmp);
 }
 
+static void show_format(enum util_fmt_t fmt)
+{
+	struct pai_node *node;
+
+	util_fmt_init(stdout, fmt, FMT_HANDLEINT, 1);
+	util_fmt_obj_start(FMT_DEFAULT, NULL);
+	util_list_iterate(&pai_list, node) {
+		util_fmt_obj_start(FMT_DEFAULT, "pmu");
+		util_fmt_pair(FMT_PERSIST, "base", "%d",  node->base);
+		util_fmt_pair(FMT_PERSIST, "type", "%d",  node->pmu);
+		util_fmt_pair(FMT_QUOTE | FMT_PERSIST, "pmu-name", "%s", node->sysfs_name);
+		util_fmt_obj_start(FMT_LIST, "counters");
+		for (int i = 0; i < node->ctridx; ++i) {
+			util_fmt_obj_start(FMT_ROW, "counter");
+			util_fmt_pair(FMT_QUOTE, "name", "%s", node->ctrlist[i].name);
+			util_fmt_pair(FMT_DEFAULT, "config", "%d", node->ctrlist[i].nr);
+			util_fmt_pair(FMT_DEFAULT, "number", "%d",
+				      node->ctrlist[i].nr - node->base);
+			util_fmt_obj_end();
+		}
+		util_fmt_obj_end();		/* Counters */
+		util_fmt_obj_end();		/* PMU */
+	}
+	util_fmt_obj_end();
+	util_fmt_exit();
+}
+
 static void show_painode(void)
 {
 	struct pai_node *node;
 	int indent = 0;
 	int offset = 0;
 
+	if (output_format != -1) {
+		show_format(output_format);
+		return;
+	}
+
 	util_list_iterate(&pai_list, node) {
 		for (int i = 0; i < node->ctridx; ++i)
 			indent = MAX((size_t)indent, strlen(node->ctrlist[i].name));
@@ -243,7 +284,7 @@ static void make_painode(enum pai_types t)
 	node->base = pai_type_base(t);
 
 	/* Read PMU type number. */
-	path = util_path_sysfs(PAI_PATH, node->sysfs_name);
+	util_asprintf(&path, PAI_PATH, node->sysfs_name);
 	node->pmu = libcpumf_pmutype(path);
 	if (node->pmu < 0)
 		errx(EXIT_FAILURE, "Cannot open %s", path);
@@ -305,6 +346,7 @@ static void check_type_name(const char *type)
 
 int main(int argc, char **argv)
 {
+	enum util_fmt_t fmt;
 	int ch;
 
 	util_list_init(&pai_list, struct pai_node, node);
@@ -329,6 +371,11 @@ int main(int argc, char **argv)
 		case 't':
 			check_type_name(optarg);
 			break;
+		case OPT_FORMAT:
+			if (!util_fmt_name_to_type(optarg, &fmt))
+				errx(EXIT_FAILURE, "Supported formats:" FMT_TYPE_NAMES);
+			output_format = fmt;
+			break;
 		}
 	}
 

cpumf/man/lscpumf.8

@@ -50,7 +50,7 @@ counters for which the LPAR is not authorized. For counter measurements with
 the perf program, the raw event identifier is displayed.
 For Linux version 5.5 and later, the raw event identifier is
 displayed as <type>:<number>, where type is an integer that the kernel
-assignes to the CPU Measurement counter facility device driver.
+assigns to the CPU Measurement counter facility device driver.
 For earlier Linux versions the raw event identifier is displayed as r<number>.
 .
 .TP

cpumf/man/lshwc.8

@@ -7,18 +7,22 @@
 .\" ----------------------------------------------------------------------
 .ds c \fBlshwc\fP
 .
-.TH \*c "8" "May 2022" "s390-tools" "CPU-MF management programs"
+.TH \*c "8" "Mar 2025" "s390-tools" "CPU-MF management programs"
 .
 .SH NAME
-\*c \- extract CPU Measurement Facilities counter sets
+lshwc \- extract CPU Measurement Facilities counter sets
 .
 .SH SYNOPSIS
 \*c
-.RB [ \-a ]
+.RB [ \-a ][ \-d ][ \-H ][ \-s ][ \-x ][ \-X ][ \-q ]
 .RB [ \-l
 .IR count ]
 .RB [ \-i
 .IR interval ]
+.RB [ \-t
+.IR time ]
+.RB [ \-f
+.IR format ]
 \fR[\fIcpulist\fR][:\fIsets\fR]\fP
 .br
 \*c
@@ -51,6 +55,13 @@ Displays counter values from each CPU.
 The default is a total summary line of all counters from all CPUs.
 .
 .TP
+.BR \-d ", " \-\-delta
+Displays counter values in form of deltas.
+Each counter value shows the increment to the previous output line.
+Without this flag the total value of each counter is displayed.
+See Examples.
+.
+.TP
 .BR \-i ", " \-\-interval \fI\ seconds\fP
 Specifies a time interval, in seconds,
 that the command waits between read operations.
@@ -61,6 +72,107 @@ The default is 60 seconds.
 Performs the specified number of read operations.
 .
 .TP
+.BR \-H ", " \-\-hide
+Do not display values of undefined counters.
+.
+.TP
+.BR \-s ", " \-\-short
+Displays counter names as short names in the heading.
+A short name consists of
+a letter for the counter set followed by a number.
+For example,
+this flag displays counter number 0 in the basic counter
+set as
+.B B0
+instead of
+.BR Cycles .
+Valid counter set letters are:
+.RS
+.IP B
+Basic counter set
+.IP P
+Problem state counter set
+.IP C
+Crypto counter set
+.IP E
+Extended counter set
+.IP M
+MT-Diagnostic counter set
+.IP U
+Undefined counter.
+.RE
+.
+.TP
+.BR \-t ", " \-\-time
+Specifies the runtime as an integer in days,
+hours, minutes or seconds.
+This option can be specified multiple times:
+the runtime sums up.
+Specify time as an integer followed by one of the letters
+.RS
+.IP d
+Specifies the runtime in days.
+.IP h
+Specifies the runtime in hours.
+.IP m
+Specifies the runtime in minutes.
+.IP s
+Specifies the runtime in seconds.
+This is the default when no letter is given.
+.RE
+.
+.TP
+.BR \-x ", " \-\-hex
+Displays counter values as hexadecimal values.
+.
+.TP
+.BR \-X ", " \-\-hex0x
+Displays counter values as hexadecimal values with a leading 0x prefix.
+.
+.TP
+.BR \-q
+Apply quoting to every output element, regardless of content or format.
+.
+.TP
+.BR \-f ", " \-\-format \fI\ format\fP
+Retrieve output in one of the following formats:
+JSON, CSV, JSON-SEQ or PAIRS.
+If no format is specified, the output defaults to CSV.
+.
+.SS JSON Output Structure
+The JSON output contains two top-level objects:
+.B "meta"
+and
+.B "lshwc"
+
+.TP
+.B meta
+General metadata such as API version, host, and timestamp.
+
+.TP
+.B lshwc
+Measurement data and configuration.
+
+.RS
+.IP \fBcpumcf info\fP
+CPU Measurement Counter Facility information.
+.IP \fBmeasurements\fP
+An array of objects, each representing a CPU or "total". 
+Each object includes:
+.RS
+.IP \fBcpu\fP
+CPU identifier, such as 0, 1 or "delta" or "total".
+.IP \fBdate_time\fP
+Timestamp in ISO 8601 format.
+.IP \fBtime_epoch\fP
+The number of seconds since the epoch: 1970-01-01 00:00:00 UTC.
+.IP \fBcounters\fP
+An array of counter objects, each containing \fBname\fP (if available), \fBid\fP,
+and \fBvalue\fP.
+.RE
+.RE
+.
+.TP
 \fR[\fIcpulist\fR][:\fIsets\fR]\fP
 A comma-separated list of CPUs.
 Each CPU can optionally be followed by characters that specify the counter set.
@@ -105,8 +217,8 @@ Date,Time,CPU,CPU_CYCLES(0),INSTRUCTIONS(1),L1I_DIR_WRITES(2),L1I_PENALTY_CYCLES
 .ft
 .fi
 .sp 1
-This example shows the counter values of the problem state counter set
-per CPU. CPU 0 and CPU 1 is selected.
+This example shows the counter values of the problem state counter set per CPU.
+CPU 0 and CPU 1 are selected.
 .nf
 .ft CW
 .sp 1
@@ -123,6 +235,121 @@ Date,Time,CPU,PROBLEM_STATE_CPU_CYCLES(32),PROBLEM_STATE_INSTRUCTIONS(33)
 2021-04-01,11:56:47,Total,6432163447,2978400903
 .ft
 .fi
+.sp 1
+This example shows the counter values of the basic counter set
+using delta output format.
+.nf
+.ft CW
+.sp 1
+# lshwc -d -l 10 -i 5 -s :b
+Date,Time,CPU,B0,B1,B2,B3,B4,B5
+2025-03-26,10:34:19,Total,208075,117287,1950,50548,1082,49609
+2025-03-26,10:34:24,Delta,85800055,70353492,590286,13228290,364034,12945804
+2025-03-26,10:34:29,Delta,70654751,60656797,483047,10838672,305703,10570868
+2025-03-26,10:34:34,Delta,81043162,69476160,587141,13228161,376662,12868298
+2025-03-26,10:34:39,Delta,73434017,62675417,524857,11787256,333966,11543649
+2025-03-26,10:34:44,Delta,68367967,58452919,506712,11370740,310785,10589883
+2025-03-26,10:34:49,Delta,70351947,57607764,507675,11433377,312433,10676243
+2025-03-26,10:34:54,Delta,77154817,65371168,562153,12671030,349750,12311061
+2025-03-26,10:34:59,Delta,88871882,75441201,655310,14875963,392530,13773130
+2025-03-26,10:35:04,Delta,83763472,71730813,609260,13643680,366992,12672405
+.ft
+.fi
+.sp 1
+This example shows the counter values of the problem state counter set with
+CPU 3 selected.
+.nf
+.ft CW
+.sp 1
+# lshwc -l2 -a 3:P -H --format json
+{
+  "meta": {
+    "api_level": 1,
+    "version": "2.37.0-build-20250616",
+    "host": "b46lp08.lnxne.boe",
+    "time_epoch": 1750094646,
+    "time": "2025-06-16 19:24:06+0200"
+  },
+  "lshwc": {
+    "cpumcf info": {
+      "counter first": 3,
+      "counter second": 8,
+      "authorization": 47
+    },
+    "measurements": [
+      {
+        "date_time": "2025-06-16 19:24:06+0200",
+        "time_epoch": 1750094646,
+        "cpu": 3,
+        "counters": [
+          {
+            "name": "problem_state_cpu_cycles",
+            "id": 32,
+            "value": 0
+          },
+          {
+            "name": "problem_state_instructions",
+            "id": 33,
+            "value": 0
+          }
+        ]
+      },
+      {
+        "date_time": "2025-06-16 19:24:06+0200",
+        "time_epoch": 1750094646,
+        "cpu": "total",
+        "counters": [
+          {
+            "name": "problem_state_cpu_cycles",
+            "id": 32,
+            "value": 0
+          },
+          {
+            "name": "problem_state_instructions",
+            "id": 33,
+            "value": 0
+          }
+        ]
+      },
+      {
+        "date_time": "2025-06-16 19:25:06+0200",
+        "time_epoch": 1750094706,
+        "cpu": 3,
+        "counters": [
+          {
+            "name": "problem_state_cpu_cycles",
+            "id": 32,
+            "value": 0
+          },
+          {
+            "name": "problem_state_instructions",
+            "id": 33,
+            "value": 0
+          }
+        ]
+      },
+      {
+        "date_time": "2025-06-16 19:25:06+0200",
+        "time_epoch": 1750094706,
+        "cpu": "total",
+        "counters": [
+          {
+            "name": "problem_state_cpu_cycles",
+            "id": 32,
+            "value": 0
+          },
+          {
+            "name": "problem_state_instructions",
+            "id": 33,
+            "value": 0
+          }
+        ]
+      }
+    ]
+  }
+}
+.ft
+.fi
 .SH "SEE ALSO"
 .BR lscpumf (8)
 .BR chcpumf (8)

cpumf/man/lspai.8

@@ -10,10 +10,12 @@
 .TH \*c "8" "August 2023" "s390-tools" "CPU-MF management programs"
 .
 .SH NAME
-\*c \- list Processor Activity Instrumentation (PAI) counters
+lspai \- list Processor Activity Instrumentation (PAI) counters
 .
 .SH SYNOPSIS
 \*c
+.RB [ \-\-format
+.IR FORMAT ]
 .RB [ \-n ]
 .RB [ \-t
 .IR "\ TYPE" ]
@@ -55,6 +57,12 @@ Crypto refers to the Cryptografic Processing Assist facility counter set.
 Shows the PAI counter sets sorted by counter number.
 Default sort order is PAI counter name.
 .
+.TP
+.BI \-\-format "\ FORMAT"
+Retrieve output in one of the following formats:
+JSON, csv, json-seq or pairs.
+If no format is specified,
+the output defaults to a human-readable format.
 .SH "EXAMPLE"
 The \*c invocation lists all PAI Neural Network Processing Assist Facility
 (NNPA) counters in numeric order:

cpumf/man/pai.8

@@ -10,7 +10,7 @@
 .TH \*c "8" "May 2022" "s390-tools" "PAI Management Programs"
 .
 .SH NAME
-\*c \- record and report Processor Activity Instrumentation (PAI) counters
+pai \- record and report Processor Activity Instrumentation (PAI) counters
 .
 .SH SYNOPSIS
 \*c

cpuplugd/config.c

@@ -314,8 +314,7 @@ void check_config()
 		cpuplugd_debug("Daemon started with vertical polarization.\n");
 		cpuplugd_debug("Cpu adjustments won't be made until system ");
 		cpuplugd_debug("is in horizontal polarization\n");
-	} else if (saved_polarization == PLR_HORIZONTAL &&
-		   cpu == 1) {
+	} else if (cpu == 1) {
 		apply_cpu_config();
 	}
 	if (memory == 1) {

cpuplugd/cpu.c

@@ -87,6 +87,8 @@ int get_polarization(void)
 	char *path;
 
 	path = util_path_sysfs("devices/system/cpu/dispatching");
+	if (!util_path_exists(path))
+		return PLR_NONE;
 	if (util_file_read_i(&polarization, NUM_BASE, path) < 0) {
 		polarization = -1;
 		cpuplugd_debug("failed to read system polarization\n");

cpuplugd/cpuplugd.h

@@ -40,6 +40,7 @@
 #define CPUSTATS	10
 #define PLR_HORIZONTAL	0
 #define PLR_VERTICAL	1
+#define PLR_NONE	2
 
 /*
  *  Precedence of C operators

etc/modules-load.d/s390-pkey.conf

@@ -1,2 +1,6 @@
 # Load protected key support module on s390 early at boot
 pkey
+pkey_pckmo
+pkey_ep11
+pkey_cca
+paes_s390

etc/udev/rules.d/80-hotplug-cpu.rules

@@ -0,0 +1,4 @@
+#
+# Rules to set online a newly hotplugged cpu on s390x
+#
+SUBSYSTEM=="cpu", ACTION=="add", CONST{arch}=="s390*", ATTR{configure}=="1", TEST=="online", ATTR{online}!="1", ATTR{online}="1"

genprotimg/.gitignore

@@ -1,5 +0,0 @@
-tags
-compile_commands.json
-src/.check-dep-genprotimg
-src/.detect-openssl.dep.c
-src/genprotimg

genprotimg/Makefile

@@ -1,25 +0,0 @@
-# Common definitions
-include ../common.mak
-
-.DEFAULT_GOAL := all
-
-PKGDATADIR := "$(TOOLS_DATADIR)/genprotimg"
-TESTS :=
-SUBDIRS := boot src man
-RECURSIVE_TARGETS := all-recursive install-recursive clean-recursive
-
-all: all-recursive
-
-install: install-recursive
-	$(INSTALL) -d -m 755 "$(DESTDIR)$(PKGDATADIR)"
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 samples/check_hostkeydoc "$(DESTDIR)$(PKGDATADIR)"
-
-clean: clean-recursive
-
-$(RECURSIVE_TARGETS):
-	@target=`echo $@ |sed s/-recursive//`; \
-		for d in $(SUBDIRS); do \
-			$(MAKE) -C $$d $$target || exit 1; \
-		done
-
-.PHONY: all install clean $(RECURSIVE_TARGETS)

genprotimg/README.md

@@ -1,85 +0,0 @@
-# genprotimg
-
-`genprotimg` takes a kernel, key files, optionally an initrd image,
-optionally a file containing the kernel command line parameters, and
-generates a single, bootable image file. The generated image file
-consists of a concatenation of a plain text boot loader, the encrypted
-components for kernel, initrd, kernel command line, and the
-integrity-protected PV header, containing the metadata necessary for
-running the guest in protected mode. See [Memory Layout](#memory-layout)
-for details about the internal structure of the created image.
-
-It is possible to use the generated image as a kernel for zipl or for
-a direct kernel boot using QEMU.
-
-## Getting started
-
-If all dependencies are met a simple `make` call in the source tree
-should be enough for building `genprotimg`.
-
-## Details
-
-The main idea of `genprotimg` is:
-
-1. read in all keys, IVs, and other information needed for the
-   encryption of the components and the generation of the PV header
-2. add stub stage3a (so we can calculate the memory addresses)
-3. add components: prepare the components (alignment and encryption)
-   and add them to the memory layout
-4. build and add stage3b: generate the stage3b and add it to the memory layout
-5. generate the PV header: generate the hashes (pld, ald, and tld) of
-   the components and create the PV header and IPIB
-6. parameterize the stub stage3a: uses the IPIB and PV header
-7. write the final image to the specified output path
-
-### Boot Loader
-
-The boot loader consists of two parts:
-
-1. stage3a boot loader (cleartext), this loader is responsible for the
-   transition into the protected mode by doing diag308 subcode 8 and
-   10 calls.
-2. stage3b boot loader (encrypted), this loader is very similar to the
-   normal zipl stage3 boot loader. It will be loaded by the Ultravisor
-   after the successful transition into protected mode. Like the zipl
-   stage3 boot loader it moves the kernel and patches in the values
-   for initrd and parmline.
-
-The loaders have the following constraints:
-
-1. It must be possible to place stage3a and stage3b at a location
-   greater than 0x10000 because the zipl stage3 loader zeroes out
-   everything at addresses lower than 0x10000 of the image.
-2. As the stage3 loader of zipl assumes that the passed kernel image
-   looks like a normal kernel image, the zipl stage3 loader modifies the
-   content at the memory area 0x10400 - 0x10800, therefore we leave this
-   area unused in our stage3a loader.
-3. The default entry address used by the zipl stage3 loader is 0x10000
-   so we add a simple branch to 0x11000 at 0x10000 so the zipl stage3
-   loader can modify the area 0x10400 - 0x10800 without affecting the
-   stage3a loader.
-
-#### Detail about stage3b
-
-The stage3b.bin is linked at address 0x9000, therefore it will not
-work at another address. The relocation support for the stage3b
-loader, so that it can be placed at addresses != 0x9000, is added in
-the loader with the name stage3b_reloc.bin. By default, if we're
-talking about stage3b we refer to stage3b_reloc.bin.
-
-### Memory Layout
-
-The memory layout of the bootable file looks like:
-
-| Start                  | End        | Use                                                                   |
-|------------------------|------------|-----------------------------------------------------------------------|
-| 0                      | 0x7        | Short PSW, starting instruction at 0x11000                            |
-| 0x10000                | 0x10012    | Branch to 0x11000                                                     |
-| 0x10013                | 0x10fff    | Left intentionally unused                                             |
-| 0x11000                | 0x12fff    | Stage3a                                                               |
-| 0x13000                | 0x13fff    | IPIB used as argument for the diag308 call                            |
-| 0x14000                | 0x1[45]fff | UV header used for the diag308 call (size can be either 1 or 2 pages) |
-| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted kernel                                                      |
-| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted kernel parameters                                           |
-| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted initrd                                                      |
-| NEXT_PAGE_ALIGNED_ADDR |            | Encrypted stage3b_reloc                                               |

genprotimg/boot/stage3a.c

@@ -1,62 +0,0 @@
-/*
- * Main program for stage3a bootloader
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include "libc.h"
-#include "stage3a.h"
-
-#include "lib/zt_common.h"
-#include "boot/error.h"
-#include "boot/s390.h"
-#include "boot/ipl.h"
-#include "sclp.h"
-
-
-static volatile struct stage3a_args __section(".loader_parms") loader_parms;
-
-void __noreturn start(void)
-{
-	int rc;
-	volatile struct stage3a_args *args = &loader_parms;
-	/* calculate the IPIB memory address */
-	struct ipl_parameter_block *ipib = (void *)((uint64_t)args + args->ipib_offs);
-
-	/* Calculate the PV header memory address and set it and its
-	 * size in the IPIB. This allows the PV header to be position
-	 * independent.
-	 */
-	ipib->pv.pv_hdr_addr = (uint64_t)args + args->hdr_offs;
-	ipib->pv.pv_hdr_size = args->hdr_size;
-
-	/* set up ASCII and line-mode */
-	sclp_setup(SCLP_LINE_ASCII_INIT);
-
-	/* test if Secure Execution Unpack facility is available */
-	stfle(S390_lowcore.stfle_fac_list,
-	      ARRAY_SIZE(S390_lowcore.stfle_fac_list));
-	rc = test_facility(UNPACK_FACILITY);
-	if (rc == 0)
-		panic(ENOPV, "Secure unpack facility is not available\n");
-
-	rc = diag308(DIAG308_SET_PV, ipib);
-	if (rc != DIAG308_RC_OK)
-		panic(EPV, "Protected boot setup has failed: 0x%x\n", rc);
-
-	rc = diag308(DIAG308_UNPACK_PV, 0x0);
-	if (rc != DIAG308_RC_OK) {
-		sclp_setup(SCLP_LINE_ASCII_INIT);
-		panic(EPV, "Protected boot has failed: 0x%x\n", rc);
-	}
-
-	while (1)
-		;
-}
-
-void panic_notify(unsigned long UNUSED(rc))
-{
-}

genprotimg/man/Makefile

@@ -1,12 +0,0 @@
-# Common definitions
-include ../../common.mak
-
-all:
-
-install:
-	$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man1
-	$(INSTALL) -m 644 -c genprotimg.1 $(DESTDIR)$(MANDIR)/man1
-
-clean:
-
-.PHONY: all install clean

genprotimg/man/genprotimg.1

@@ -1,159 +0,0 @@
-.\" Copyright 2020 IBM Corp.
-.\" s390-tools is free software; you can redistribute it and/or modify
-.\" it under the terms of the MIT license. See LICENSE for details.
-.\"
-.TH GENPROTIMG 1 "May 2022" "s390-tools"
-.SH NAME
-genprotimg \- Create a protected virtualization image
-
-.SH SYNOPSIS
-.SY
-.B genprotimg
-\fB\-k\fR \fIHOST_KEY_DOCUMENT\fR...
-\fB\-C\fR \fICERTIFICATE\fR...
-\fB\-i\fR \fIVMLINUZ\fR
-[\fB\-r\fR \fIRAMDISK\fR]
-[\fB\-p\fR \fIPARMFILE\fR]
-\fB\-o\fR \fIOUTFILE\fR
-[\fIOPTION\fR]...
-.YS
-
-.SH DESCRIPTION
-.PP
-Use \fBgenprotimg\fR to generate a single bootable image file with
-encrypted and integrity-protected parts. The command requires a kernel
-image, a host-key document, certificates for the host-key document
-verification, and an output file name. Optionally, specify an initial
-RAM filesystem, and a file containing the kernel parameters. If the
-command should be run offline, use the \fB\-\-offline\fR option and
-specify the certificate revocation lists (CRLs) by using the
-\fB\-\-crl\fR option. Should special circumstances require it, you can
-optionally specify your own keys for the encryption by using the
-experimental options. For all certificates, CRLs, and host-key
-documents, both the PEM and DER input formats are supported. In the
-resulting image file, a plain text boot loader, the encrypted
-components for kernel, initial RAM disk, kernel parameters, and the
-encrypted and integrity-protected header are concatenated. The header
-contains metadata necessary for running the guest in protected mode.
-.PP
-Use this image file as a kernel image for zipl or for a direct kernel
-boot using QEMU.
-
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Prints usage information, then exits.
-.TP
-\fB\-\-help-experimental\fR
-Prints experimental usage information, then exits.
-.TP
-\fB\-\-help-all\fR
-Prints all usage information, then exits.
-.TP
-\fB\-V\fR, \fB\-\-verbose\fR
-Provides more detailed output.
-.TP
-\fB\-k\fR, \fB\-\-host-key-document\fR=\fI\,HOST_KEY_DOCUMENT\/\fR
-Specifies a host-key document. At least one is required. Specify this
-option multiple times to enable the image to run on more than one
-host.
-.TP
-\fB\-C\fR, \fB\-\-cert\fR=\fI\,FILE\/\fR
-Specifies the certificate that is used to establish a chain of trust
-for the verification of the host-key documents. Specify this option
-twice to specify the IBM Z signing key and the intermediate CA
-certificate (signed by the root CA).
-Required. Ignored if \fB--no-verify\fP is specified.
-.TP
-\fB\-o\fR, \fB\-\-output\fR=\fI\,OUTPUT_FILE\/\fR
-Specifies the output file. Required.
-.TP
-\fB\-i\fR, \fB\-\-image\fR=\fI\,VMLINUZ\/\fR
-Specifies the Linux kernel image file. Required.
-.TP
-\fB\-r\fR, \fB\-\-ramdisk\fR=\fI\,RAMDISK\/\fR
-Specifies the RAM disk image. Optional.
-.TP
-\fB\-p\fR, \fB\-\-parmfile\fR=\fI\,PARMFILE\/\fR
-Specifies the kernel command line stored in \fI\,PARMFILE\/\fR. Optional.
-.TP
-\fB\-\-crl\fR=\fI\,FILE\/\fR
-Specifies the revocation list that is used to check whether a
-certificate of the chain of trust is revoked. Specify this option
-multiple times to use multiple CRLs. Optional.
-.TP
-\fB\-\-offline\fR
-Specifies offline mode, in which no attempt is made to download
-CRLs. Optional.
-.TP
-\fB\-\-root\-ca\fR=\fI\,FILE\/\fR
-Specifies the root CA certificate for the verification. If omitted,
-the system wide root CAs installed on the system is used. Use
-this only if you trust the specified certificate. Optional.
-.TP
-\fB\-\-no-verify\fR
-Does not require the host-key documents to be valid.
-Do not use for a production image unless you verified
-the host-key document before. Optional.
-.TP
-\fB\-\-comm\-key\fR=\fI\,FILE\/\fR
-Specifies the customer communication key (CCK). This key is used for the
-PV guest dump encryption and to derive the CCK-derived extension secret
-used for add-secret requests. Use a secure, random, plaintext AES-256
-GCM key. Optional.
-.TP
-\fB\-\-enable\-dump\fR
-Enable PV guest dumps. Requires the \fB\-\-comm\-key\fR option. Optional.
-.TP
-\fB\-\-disable\-dump\fR
-Disable PV guest dumps. This is the default.
-.TP
-\fB\-\-enable\-cck\-extension\-secret\fR
-Add-secret requests must provide an extension secret that matches the
-CCK-derived extension secret. Requires the \fB\-\-comm\-key\fR option.
-Optional.
-.TP
-\fB\-\-disable\-cck\-extension\-secret\fR
-Add-secret requests don't have to provide an extension secret. This is
-the default.
-.TP
-\fB\-\-enable\-pckmo\fR
-Enable the support for the DEA, TDEA, AES, and ECC PCKMO key encryption
-functions. This is the default.
-.TP
-\fB\-\-disable\-pckmo\fR
-Disable the support for the DEA, TDEA, AES, and ECC PCKMO key encryption
-functions. Optional.
-.TP
-\fB\-v\fR, \fB\-\-version\fR
-Prints version information, then exits.
-
-.SH EXAMPLES
-
-These are examples to generate a protected virtualization image in
-\fI\,/boot/vmlinuz.pv\/\fR, using the kernel file \fI\,vmlinuz\/\fR, the
-initrd in \fI\,initramfs\/\fR, the kernel parameters contained in
-\fI\,parmfile\/\fR, the intermediate CA in \fI\,DigiCertCA.crt\/\fR, the
-IBM Z signing key in \fI\,ibm-z-host-key-signing.crt\/\fR, and the
-host-key document in \fI\,host_key.crt\/\fR. An AES-256 GCM key is stored in
-\fI\,comm-key\/\fR, which is used for the PV guest dump support in the second
-example.
-
-Generate a protected virtualization image:
-
-.PP
-.B genprotimg \-i \fI\,vmlinuz\/\fR \-r \fI\,initramfs\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-C \fI\,ibm-z-host-key-signing.crt\/\fR \-C \fI\,DigiCertCA.crt\fR \-o \fI\,/boot/vmlinuz.pv\/\fR
-
-Generate a protected virtualization image with PV guest dump support:
-.PP
-.B genprotimg \-i \fI\,vmlinuz\/\fR \-r \fI\,initramfs\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-C \fI\,ibm-z-host-key-signing.crt\/\fR \-C \fI\,DigiCertCA.crt\fR \-o \fI\,/boot/vmlinuz.pv\/\fR \-\-enable\-dump \-\-comm\-key \fI\,comm-key\fR
-
-.SH NOTES
-.IP "1." 4
-An ELF file cannot be used as a Linux kernel image.
-.IP "2." 4
-Remember to re-run \fBzipl\fR after updating a protected
-virtualization image.
-
-.SH SEE ALSO
-\&\fBzipl\fR\|(5), \fBqemu\fR\|(1)

genprotimg/src/Makefile

@@ -1,104 +0,0 @@
-# Common definitions
-include ../../common.mak
-
-bin_PROGRAM = genprotimg
-
-PKGDATADIR ?= "$(TOOLS_DATADIR)/genprotimg"
-SRC_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
-TOP_SRCDIR := $(SRC_DIR)/../
-ROOT_DIR = $(TOP_SRC_DIR)/../../
-ZIPL_DIR = $(ROOT_DIR)/zipl
-LOADER_DIR = $(TOP_SRCDIR)/boot
-
-INCLUDE_PATHS = "$(SRC_DIR)" "$(TOP_SRCDIR)" "$(ROOTDIR)/include"
-INCLUDE_PARMS = $(addprefix -I,$(INCLUDE_PATHS))
-
-WARNINGS := -Wall -Wextra -Wshadow \
-	-Wcast-align -Wwrite-strings -Wmissing-prototypes \
-	-Wmissing-declarations -Wredundant-decls -Wnested-externs \
-	-Wno-long-long -Wuninitialized -Wconversion -Wstrict-prototypes \
-	-Wpointer-arith -Wno-error=inline \
-	$(NULL)
-
-$(bin_PROGRAM)_SRCS := $(bin_PROGRAM).c pv/pv_stage3.c pv/pv_image.c \
-	pv/pv_comp.c pv/pv_hdr.c pv/pv_ipib.c utils/crypto.c utils/file_utils.c \
-	pv/pv_args.c utils/buffer.c pv/pv_comps.c pv/pv_error.c \
-	pv/pv_opt_item.c utils/curl.c \
-	$(NULL)
-$(bin_PROGRAM)_OBJS := $($(bin_PROGRAM)_SRCS:.c=.o)
-
-ALL_CFLAGS += -DPKGDATADIR=$(PKGDATADIR) \
-	$(GLIB2_CFLAGS) $(LIBCRYPTO_CFLAGS) $(LIBCURL_CFLAGS) \
-	-DOPENSSL_API_COMPAT=0x10100000L \
-	$(WARNINGS) \
-	$(NULL)
-ALL_CPPFLAGS += $(INCLUDE_PARMS)
-LDLIBS += $(GLIB2_LIBS) $(LIBCRYPTO_LIBS) $(LIBCURL_LIBS)
-
-
-GLIB2_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags glib-2.0)
-GLIB2_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs glib-2.0)
-LIBCRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcrypto)
-LIBCRYPTO_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcrypto)
-LIBCURL_CFLAGS := $(shell $(PKG_CONFIG) --silence-errors --cflags libcurl)
-LIBCURL_LIBS := $(shell $(PKG_CONFIG) --silence-errors --libs libcurl)
-
-BUILD_TARGETS := skip-$(bin_PROGRAM)
-INSTALL_TARGETS := skip-$(bin_PROGRAM)
-ifneq (${HAVE_OPENSSL},0)
-ifneq (${HAVE_GLIB2},0)
-ifneq (${HAVE_LIBCURL},0)
-BUILD_TARGETS := $(bin_PROGRAM)
-INSTALL_TARGETS := install-$(bin_PROGRAM)
-endif
-endif
-endif
-
-all: $(BUILD_TARGETS)
-
-install: $(INSTALL_TARGETS)
-
-$(bin_PROGRAM): $($(bin_PROGRAM)_OBJS)
-
-skip-$(bin_PROGRAM):
-	echo "  SKIP    $(bin_PROGRAM) due to unresolved dependencies"
-
-install-$(bin_PROGRAM): $(bin_PROGRAM)
-	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
-	$(INSTALL) -c $^ $(DESTDIR)$(USRBINDIR)
-
-clean:
-	$(RM) -f $($(bin_PROGRAM)_OBJS) $(bin_PROGRAM) .check-dep-$(bin_PROGRAM) .detect-openssl.dep.c
-
-.PHONY: all install clean skip-$(bin_PROGRAM) install-$(bin_PROGRAM)
-
-$($(bin_PROGRAM)_OBJS): .check-dep-$(bin_PROGRAM)
-
-.detect-openssl.dep.c:
-	echo "#include <openssl/evp.h>" > $@
-	echo "#if OPENSSL_VERSION_NUMBER < 0x10100000L" >> $@
-	echo "  #error openssl version 1.1.0 is required" >> $@
-	echo "#endif" >> $@
-	echo "static void __attribute__((unused)) test(void) {" >> $@
-	echo "    EVP_MD_CTX *ctx = EVP_MD_CTX_new();" >> $@
-	echo "    EVP_MD_CTX_free(ctx);" >> $@
-	echo "}" >> $@
-
-.check-dep-$(bin_PROGRAM): .detect-openssl.dep.c
-	$(call check_dep, \
-		"$(bin_PROGRAM)", \
-		"glib.h", \
-		"glib2-devel / libglib2.0-dev", \
-		"HAVE_GLIB2=0")
-	$(call check_dep, \
-		"$(bin_PROGRAM)", \
-		$^, \
-		"openssl-devel / libssl-dev version >= 1.1.0", \
-		"HAVE_OPENSSL=0", \
-		"-I.")
-	$(call check_dep, \
-		"$(bin_PROGRAM)", \
-		"curl/curl.h", \
-		"libcurl-devel", \
-		"HAVE_LIBCURL=0")
-	touch $@

genprotimg/src/common.h

@@ -1,41 +0,0 @@
-/*
- * Copyright IBM Corp. 2020, 2022
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef COMMON_H
-#define COMMON_H
-
-#define GETTEXT_PACKAGE "genprotimg"
-#include <glib.h>
-#include <glib/gi18n.h>
-
-#include "boot/linux_layout.h"
-#include "lib/zt_common.h"
-
-static const gchar tool_name[] = "genprotimg";
-static const gchar copyright_notice[] = "Copyright IBM Corp. 2020";
-
-/* default values */
-#define GENPROTIMG_STAGE3A_PATH (STRINGIFY(PKGDATADIR) "/stage3a.bin")
-#define GENPROTIMG_STAGE3B_PATH (STRINGIFY(PKGDATADIR) "/stage3b_reloc.bin")
-
-#define DEFAULT_INITIAL_PSW_ADDR IMAGE_ENTRY
-#define DEFAULT_INITIAL_PSW_MASK (PSW_MASK_EA | PSW_MASK_BA)
-
-#define DO_PRAGMA(x) _Pragma(#x)
-
-# ifdef __clang__
-#  define WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(...) \
-	DO_PRAGMA(clang diagnostic push) \
-	DO_PRAGMA(clang diagnostic ignored "-Wunused-function") \
-	G_DEFINE_AUTOPTR_CLEANUP_FUNC(__VA_ARGS__) \
-	DO_PRAGMA(clang diagnostic pop)
-# else
-#  define WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(...) \
-	G_DEFINE_AUTOPTR_CLEANUP_FUNC(__VA_ARGS__)
-# endif
-
-#endif

genprotimg/src/genprotimg.c

@@ -1,200 +0,0 @@
-/*
- * genprotimg - build relocatable secure images
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <errno.h>
-#include <glib.h>
-#include <glib/gstdio.h>
-#include <glib/gtypes.h>
-#include <locale.h>
-#include <signal.h>
-#include <stdio.h>
-
-#include "common.h"
-#include "pv/pv_args.h"
-#include "pv/pv_image.h"
-#include "utils/crypto.h"
-#include "utils/curl.h"
-
-enum {
-	LOG_LEVEL_CRITICAL = 0,
-	LOG_LEVEL_INFO = 1,
-	LOG_LEVEL_DEBUG = 2,
-};
-
-static gint log_level = LOG_LEVEL_CRITICAL;
-static gchar *tmp_dir;
-
-static void rmdir_recursive(gchar *dir_path, GError **err)
-{
-	const gchar *file = NULL;
-	g_autoptr(GDir) d = NULL;
-
-	if (!dir_path)
-		return;
-
-	d = g_dir_open(dir_path, 0, err);
-	if (!d) {
-		g_set_error(err, G_FILE_ERROR,
-			    (gint)g_file_error_from_errno(errno),
-			    _("Failed to open directory '%s': %s"), dir_path,
-			    g_strerror(errno));
-		return;
-	}
-
-	while ((file = g_dir_read_name(d)) != NULL) {
-		g_autofree gchar *file_path =
-			g_build_filename(dir_path, file, NULL);
-		/* ignore error */
-		(void)g_unlink(file_path);
-	}
-
-	if (g_rmdir(dir_path) != 0) {
-		g_set_error(err, G_FILE_ERROR,
-			    (gint)g_file_error_from_errno(errno),
-			    _("Failed to remove directory '%s': %s"), dir_path,
-			    g_strerror(errno));
-		return;
-	}
-}
-
-static void sig_term_handler(int signal G_GNUC_UNUSED)
-{
-	rmdir_recursive(tmp_dir, NULL);
-	exit(EXIT_FAILURE);
-}
-
-static void log_handler_cb(const gchar *log_domain G_GNUC_UNUSED,
-			   GLogLevelFlags level, const gchar *message,
-			   gpointer user_data G_GNUC_UNUSED)
-{
-	const gchar *prefix = "";
-
-	/* filter out messages depending on debugging level */
-	if ((level & G_LOG_LEVEL_DEBUG) && log_level < LOG_LEVEL_DEBUG)
-		return;
-
-	if ((level & G_LOG_LEVEL_INFO) && log_level < LOG_LEVEL_INFO)
-		return;
-
-	if (level & G_LOG_LEVEL_WARNING)
-		prefix = "WARNING: ";
-
-	if (level & G_LOG_LEVEL_ERROR)
-		prefix = "ERROR: ";
-
-	if (level & (G_LOG_LEVEL_WARNING | G_LOG_LEVEL_ERROR))
-		g_printerr("%s%s\n", prefix, message);
-	else
-		g_print("%s%s\n", prefix, message);
-}
-
-static void setup_prgname(const gchar *name)
-{
-	g_set_prgname(name);
-	g_set_application_name(_(name));
-}
-
-static void setup_handler(const gint *signals, const gsize signals_n)
-{
-	/* set up logging handler */
-	g_log_set_handler(NULL,
-			  G_LOG_LEVEL_MASK | G_LOG_FLAG_FATAL |
-				  G_LOG_FLAG_RECURSION,
-			  log_handler_cb, NULL);
-
-	/* set signal handler */
-	for (gsize i = 0; i < signals_n; i++)
-		signal(signals[i], sig_term_handler);
-}
-
-static void remove_signal_handler(const gint *signals, const gsize signals_n)
-{
-	for (gsize i = 0; i < signals_n; i++)
-		signal(signals[i], SIG_DFL);
-}
-
-static void __attribute__((constructor)) __init(void);
-static void __attribute__((destructor)) __cleanup(void);
-gint main(gint argc, gchar *argv[])
-{
-	g_autoptr(PvArgs) args = pv_args_new();
-	gint signals[] = { SIGINT, SIGTERM };
-	g_autoptr(PvImage) img = NULL;
-	gint ret = EXIT_FAILURE;
-	GError *err = NULL;
-
-	setlocale(LC_CTYPE, "");
-	setup_prgname(tool_name);
-	setup_handler(signals, G_N_ELEMENTS(signals));
-
-	if (pv_args_parse_options(args, &argc, &argv, &err) < 0)
-		goto error;
-
-	/* set new log level */
-	log_level = args->log_level;
-
-	/* if the user has not specified a temporary directory let's
-	 * create one
-	 */
-	if (!args->tmp_dir) {
-		tmp_dir = g_dir_make_tmp("genprotimg-XXXXXX", &err);
-		if (!tmp_dir)
-			goto error;
-		args->tmp_dir = g_strdup(tmp_dir);
-	}
-
-	/* allocate and initialize ``pv_img`` data structure */
-	img = pv_img_new(args, GENPROTIMG_STAGE3A_PATH, &err);
-	if (!img)
-		goto error;
-
-	/* add user components: `args->comps` must be sorted by the
-	 * component type => by memory address
-	 */
-	for (GSList *iterator = args->comps; iterator; iterator = iterator->next) {
-		const PvArg *arg = iterator->data;
-
-		if (pv_img_add_component(img, arg, &err) < 0)
-			goto error;
-	}
-
-	if (pv_img_finalize(img, GENPROTIMG_STAGE3B_PATH, &err) < 0)
-		goto error;
-
-	if (pv_img_write(img, args->output_path, &err) < 0)
-		goto error;
-
-	ret = EXIT_SUCCESS;
-
-error:
-	if (err) {
-		fputs(err->message, stderr);
-		fputc('\n', stderr);
-		g_clear_error(&err);
-	}
-	rmdir_recursive(tmp_dir, NULL);
-	remove_signal_handler(signals, G_N_ELEMENTS(signals));
-	g_free(tmp_dir);
-	g_clear_pointer(&img, pv_img_free);
-	g_clear_pointer(&args, pv_args_free);
-	exit(ret);
-}
-
-static void __init(void)
-{
-	pv_crypto_init();
-	if (curl_init() != 0)
-		g_abort();
-}
-
-static void __cleanup(void)
-{
-	curl_cleanup();
-	pv_crypto_cleanup();
-}

genprotimg/src/include/pv_crypto_def.h

@@ -1,41 +0,0 @@
-/*
- * PV cryptography related definitions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_CRYPTO_DEF_H
-#define PV_CRYPTO_DEF_H
-
-#include <stdint.h>
-
-#include "lib/zt_common.h"
-
-/* IBM signing key subject */
-#define PV_IBM_Z_SUBJECT_COMMON_NAME "International Business Machines Corporation"
-#define PV_IBM_Z_SUBJECT_COUNTRY_NAME "US"
-#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE	   "Poughkeepsie"
-#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK		   "Armonk"
-#define PV_IBM_Z_SUBJECT_ORGANIZATIONONAL_UNIT_NAME_SUFFIX "Key Signing Service"
-#define PV_IBM_Z_SUBJECT_ORGANIZATION_NAME "International Business Machines Corporation"
-#define PV_IBM_Z_SUBJECT_STATE "New York"
-#define PV_IMB_Z_SUBJECT_ENTRY_COUNT 6
-
-/* Minimum security level for the keys/certificates used to establish a chain of
- * trust (see https://www.openssl.org/docs/man1.1.1/man3/X509_VERIFY_PARAM_set_auth_level.html
- * for details).
- */
-#define PV_CERTS_SECURITY_LEVEL 2
-
-union ecdh_pub_key {
-	struct {
-		uint8_t x[80];
-		uint8_t y[80];
-	};
-	uint8_t data[160];
-} __packed;
-
-#endif

genprotimg/src/include/pv_hdr_def.h

@@ -1,95 +0,0 @@
-/*
- * PV header definitions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_HDR_DEF_H
-#define PV_HDR_DEF_H
-
-#include <openssl/sha.h>
-
-#include "boot/psw.h"
-#include "lib/zt_common.h"
-#include "utils/crypto.h"
-
-#include "pv_crypto_def.h"
-
-/* Magic number which is used to identify the file containing the PV
- * header
- */
-#define PV_MAGIC_NUMBER 0x49424d5365634578ULL
-#define PV_VERSION_1	0x00000100U
-
-/* Internal helper macro */
-#define __PV_BIT(nr)		(1ULL << (63 - (nr)))
-
-/* Plaintext control flags */
-#define PV_PCF_ALLOW_DUMPING	__PV_BIT(34) /* dumping of the configuration is allowed */
-#define PV_PCF_NO_DECRYPTION	__PV_BIT(35) /* prevent Ultravisor decryption during unpack operation */
-#define PV_PCF_PCKMO_DEA_TDEA	__PV_BIT(56) /* PCKMO encrypt-DEA/TDEA-key functions allowed */
-#define PV_PCF_PCKMO_AES	__PV_BIT(57) /* PCKMO encrypt-AES-key functions allowed */
-#define PV_PCF_PCKM_ECC	__PV_BIT(58) /* PCKMO encrypt-ECC-key functions allowed */
-
-/* Secret control flags */
-#define PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT                                                     \
-	__PV_BIT(1) /* All add-secret requests must provide an extension secret */
-
-/* maxima for the PV version 1 */
-#define PV_V1_IPIB_MAX_SIZE	PAGE_SIZE
-#define PV_V1_PV_HDR_MAX_SIZE	(2 * PAGE_SIZE)
-
-typedef struct pv_hdr_key_slot {
-	uint8_t digest_key[SHA256_DIGEST_LENGTH];
-	uint8_t wrapped_key[32];
-	uint8_t tag[AES_256_GCM_TAG_SIZE];
-} __packed PvHdrKeySlot;
-
-typedef struct pv_hdr_opt_item {
-	uint32_t otype;
-	uint8_t ibk[32];
-	uint8_t data[];
-} __packed PvHdrOptItem;
-
-/* integrity protected data (by GCM tag), but non-encrypted */
-struct pv_hdr_head {
-	uint64_t magic;
-	uint32_t version;
-	uint32_t phs;
-	uint8_t iv[AES_256_GCM_IV_SIZE];
-	uint32_t res1;
-	uint64_t nks;
-	uint64_t sea;
-	uint64_t nep;
-	uint64_t pcf;
-	union ecdh_pub_key cust_pub_key;
-	uint8_t pld[SHA512_DIGEST_LENGTH];
-	uint8_t ald[SHA512_DIGEST_LENGTH];
-	uint8_t tld[SHA512_DIGEST_LENGTH];
-} __packed;
-
-/* Must not have any padding */
-struct pv_hdr_encrypted {
-	uint8_t cust_comm_key[32];
-	uint8_t img_enc_key_1[AES_256_XTS_KEY_SIZE / 2];
-	uint8_t img_enc_key_2[AES_256_XTS_KEY_SIZE / 2];
-	struct psw_t psw;
-	uint64_t scf;
-	uint32_t noi;
-	uint32_t res2;
-};
-STATIC_ASSERT(sizeof(struct pv_hdr_encrypted) ==
-	      32 + 32 + 32 + sizeof(struct psw_t) + 8 + 4 + 4)
-
-typedef struct pv_hdr {
-	struct pv_hdr_head head;
-	struct pv_hdr_key_slot *slots;
-	struct pv_hdr_encrypted *encrypted;
-	struct pv_hdr_opt_item **optional_items;
-	uint8_t tag[AES_256_GCM_TAG_SIZE];
-} PvHdr;
-
-#endif

genprotimg/src/pv/pv_args.c

@@ -1,556 +0,0 @@
-/*
- * PV arguments related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-#include <glib/gprintf.h>
-
-#include "common.h"
-
-#include "pv_comp.h"
-#include "pv_error.h"
-#include "pv_args.h"
-
-static gchar summary[] =
-	"Use genprotimg to create a protected virtualization kernel image file,\n"
-	"which can be loaded using zipl or QEMU. For all certificates, revocation\n"
-	"lists, and host-key documents, both the PEM and DER input formats are\n"
-	"supported.";
-
-static gint pv_arg_compare(gconstpointer arg_1, gconstpointer arg_2)
-{
-	g_assert(arg_1);
-	g_assert(arg_2);
-
-	PvComponentType a = ((PvArg *)arg_1)->type;
-	PvComponentType b = ((PvArg *)arg_2)->type;
-
-	if (a < b)
-		return -1;
-	if (a == b)
-		return 0;
-	return 1;
-}
-
-static gint pv_arg_has_type(gconstpointer arg, gconstpointer type)
-{
-	const PvArg *c = arg;
-	const PvComponentType *t = type;
-
-	g_assert(arg);
-
-	if (c->type == *t)
-		return 0;
-	if (c->type < *t)
-		return -1;
-	return 1;
-}
-
-static gint pv_args_set_defaults(PvArgs *args, GError **err G_GNUC_UNUSED)
-{
-	if (!args->psw_addr)
-		args->psw_addr =
-			g_strdup_printf("0x%lx", DEFAULT_INITIAL_PSW_ADDR);
-
-	return 0;
-}
-
-static gint pv_args_validate_options(PvArgs *args, GError **err)
-{
-	const PvControlFlagsArgs *cf_args = &args->cf_args;
-	PvComponentType KERNEL = PV_COMP_TYPE_KERNEL;
-
-	/* Check for mutually exclusive arguments */
-	if (cf_args->pcf &&
-	    !(cf_args->enable_pckmo == PV_NOT_SET && cf_args->enable_dump == PV_NOT_SET)) {
-		g_set_error(
-			err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
-			_("The '--x-pcf' option cannot be used with the '--(enable|disable)-pckmo' or"
-			  " '--(enable|disable)-dump' flags.\nUse 'genprotimg --help' for more information"));
-		return -1;
-	}
-
-	if (cf_args->scf && !(cf_args->enable_cck_extension_secret_enforcement == PV_NOT_SET)) {
-		g_set_error(
-			err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
-			_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
-		return -1;
-	}
-
-	/* Check for unused arguments */
-	if (args->unused_values->len > 0) {
-		g_autofree gchar *unused = NULL;
-
-		for (gsize i = args->unused_values->len; i > 0; i--) {
-			g_autofree gchar *tmp = unused;
-
-			unused = g_strjoin(" ", g_ptr_array_index(args->unused_values, i - 1),
-					   tmp,
-					   NULL);
-		}
-
-		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_INVALID_ARGUMENT,
-			    _("Unrecognized arguments: '%s'.\nUse 'genprotimg --help' for more information"),
-			    unused);
-		return -1;
-	}
-
-	/* Check for mandatory arguments */
-	if (cf_args->enable_dump == PV_TRUE && !args->cust_comm_key_path) {
-		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			    _("Option '--enable-dump' requires the '--comm-key' option.\nUse 'genprotimg "
-			      "--help' for more information"));
-		return -1;
-	}
-	if (cf_args->enable_cck_extension_secret_enforcement == PV_TRUE &&
-	    !args->cust_comm_key_path) {
-		g_set_error(
-			err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			_("Option '--enable-cck-extension-secret' requires the '--comm-key' option.\nUse 'genprotimg "
-			  "--help' for more information"));
-		return -1;
-	}
-
-	if (!args->output_path) {
-		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			    _("Option '--output' is required.\nUse 'genprotimg --help' for more information"));
-		return -1;
-	}
-
-	if (!g_slist_find_custom(args->comps, &KERNEL, pv_arg_has_type)) {
-		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			    _("Option '--image' is required.\nUse 'genprotimg --help' for more information"));
-		return -1;
-	}
-
-	if (!args->host_keys || g_strv_length(args->host_keys) == 0) {
-		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			    _("Option '--host-key-document' is required.\nUse 'genprotimg --help' for more information"));
-		return -1;
-	}
-
-	if (!args->no_verify &&
-	    (!args->untrusted_cert_paths ||
-	     g_strv_length(args->untrusted_cert_paths) == 0)) {
-		g_set_error(
-			err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
-			_("Either specify the IBM Z signing key and intermediate CA certificate\n"
-			  "by using the '--cert' option, or use the '--no-verify' flag to disable the\n"
-			  "host-key document verification completely (at your own risk)."));
-		return -1;
-	}
-
-	return 0;
-}
-
-static gboolean cb_add_component(const gchar *option, const gchar *value,
-				 PvArgs *args, GError **err)
-{
-	PvArg *comp = NULL;
-	gint type = -1;
-
-	if (g_str_equal(option, "-i") || g_str_equal(option, "--image"))
-		type = PV_COMP_TYPE_KERNEL;
-	if (g_str_equal(option, "-r") || g_str_equal(option, "--ramdisk"))
-		type = PV_COMP_TYPE_INITRD;
-	if (g_str_equal(option, "-p") || g_str_equal(option, "--parmfile"))
-		type = PV_COMP_TYPE_CMDLINE;
-
-	if (type < 0) {
-		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
-			    _("Invalid option '%s': "), option);
-		return FALSE;
-	}
-
-	if (g_slist_find_custom(args->comps, &type, pv_arg_has_type)) {
-		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
-			    _("Multiple values for option '%s'"), option);
-		return FALSE;
-	}
-
-	comp = pv_arg_new((PvComponentType)type, value);
-	args->comps = g_slist_insert_sorted(args->comps, comp, pv_arg_compare);
-	return TRUE;
-}
-
-static gboolean cb_set_string_option(const gchar *option, const gchar *value,
-				     PvArgs *args, GError **err)
-{
-	gchar **args_option = NULL;
-
-	if (g_str_equal(option, "--comm-key"))
-		args_option = &args->cust_comm_key_path;
-	if (g_str_equal(option, "--root-ca"))
-		args_option = &args->root_ca_path;
-	if (g_str_equal(option, "-o") || g_str_equal(option, "--output"))
-		args_option = &args->output_path;
-	if (g_str_equal(option, "--x-comp-key"))
-		args_option = &args->xts_key_path;
-	if (g_str_equal(option, "--x-header-key"))
-		args_option = &args->cust_root_key_path;
-	if (g_str_equal(option, "--x-pcf"))
-		args_option = &args->cf_args.pcf;
-	if (g_str_equal(option, "--x-psw"))
-		args_option = &args->psw_addr;
-	if (g_str_equal(option, "--x-scf"))
-		args_option = &args->cf_args.scf;
-
-	if (!args_option) {
-		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
-			    _("Invalid option '%s': "), option);
-		return FALSE;
-	}
-
-	if (*args_option) {
-		g_set_error(err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
-			    _("Multiple values for option '%s'"), option);
-		return FALSE;
-	}
-
-	*args_option = g_strdup(value);
-	return TRUE;
-}
-
-static gboolean cb_set_log_level(const gchar *option G_GNUC_UNUSED,
-				 const gchar *value G_GNUC_UNUSED, PvArgs *args,
-				 GError **err G_GNUC_UNUSED)
-{
-	args->log_level++;
-	return TRUE;
-}
-
-static gboolean cb_remaining_values(const gchar *option G_GNUC_UNUSED,
-				    const gchar *value, PvArgs *args,
-				    GError **err G_GNUC_UNUSED)
-{
-	g_ptr_array_add(args->unused_values, g_strdup(value));
-	return TRUE;
-}
-
-#define MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, VALUE) (cb_##FLAG##_##VALUE)
-#define DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, VALUE)                                                  \
-	static gboolean MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, VALUE)(const gchar *option G_GNUC_UNUSED, \
-								const gchar *value G_GNUC_UNUSED,  \
-								PvArgs *args, GError **err)        \
-	{                                                                                          \
-		if (!(args->cf_args.enable_##FLAG == PV_NOT_SET ||                                 \
-		      args->cf_args.enable_##FLAG == VALUE)) {                                     \
-			g_set_error(err, G_OPTION_ERROR, G_OPTION_ERROR_FAILED,                    \
-				    "'--enable-" #FLAG "' and '--disable-" #FLAG                   \
-				    "' are mutually exclusive");                                   \
-			return FALSE;                                                              \
-		}                                                                                  \
-		args->cf_args.enable_##FLAG = VALUE;                                               \
-		return TRUE;                                                                       \
-	}
-
-#define DEFINE_MUT_EXCL_BOOL_FLAG_CBS(FLAG)                                    \
-	DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, PV_TRUE)                            \
-	DEFINE_MUT_EXCL_BOOL_FLAG_CB(FLAG, PV_FALSE)
-
-#define MUT_EXCL_BOOL_FLAG(NAME, FLAG, ENABLE_DESC, DISABLE_DESC)                                  \
-	{                                                                                          \
-		.long_name = "enable-" #NAME,                                                      \
-		.short_name = 0,                                                                   \
-		.flags = G_OPTION_FLAG_NO_ARG,                                                     \
-		.arg = G_OPTION_ARG_CALLBACK,                                                      \
-		.arg_data = MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, PV_TRUE),                             \
-		.description = ENABLE_DESC,                                                        \
-	},                                                                                         \
-	{                                                                                          \
-		.long_name = "disable-" #NAME, .short_name = 0, .flags = G_OPTION_FLAG_NO_ARG,     \
-		.arg = G_OPTION_ARG_CALLBACK,                                                      \
-		.arg_data = MUT_EXCL_BOOL_FLAG_CB_NAME(FLAG, PV_FALSE),                            \
-		.description = DISABLE_DESC,                                                       \
-	}
-
-#define INDENT "                                     "
-
-/* Define the callbacks for mutually exclusive command line flags */
-DEFINE_MUT_EXCL_BOOL_FLAG_CBS(dump);
-DEFINE_MUT_EXCL_BOOL_FLAG_CBS(pckmo);
-DEFINE_MUT_EXCL_BOOL_FLAG_CBS(cck_extension_secret_enforcement);
-
-gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
-			   GError **err)
-{
-	g_autoptr(GOptionContext) context = NULL;
-	gboolean print_version = FALSE;
-	GOptionGroup *group, *x_group;
-
-	g_autofree gchar *psw_desc = g_strdup_printf(
-		_("Load from the specified hexadecimal ADDRESS.\n" INDENT
-		  "Optional; default: '0x%lx'."),
-		DEFAULT_INITIAL_PSW_ADDR);
-	GOptionEntry entries[] = {
-		{ .long_name = "host-key-document",
-		  .short_name = 'k',
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_FILENAME_ARRAY,
-		  .arg_data = &args->host_keys,
-		  .description =
-			_("FILE specifies a host-key document. At least\n" INDENT
-			  "one is required. Specify this option multiple times\n" INDENT
-			  "to enable the image to run on more than one host."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "cert",
-		  .short_name = 'C',
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_FILENAME_ARRAY,
-		  .arg_data = &args->untrusted_cert_paths,
-		  .description = _(
-			  "FILE contains a certificate that is used to\n" INDENT
-			  "establish a chain of trust for the verification\n" INDENT
-			  "of the host-key documents. The IBM Z signing\n" INDENT
-			  "key and intermediate CA certificate (signed\n" INDENT
-			  "by the root CA) are required."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "output",
-		  .short_name = 'o',
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = _("Set FILE as the output file."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "image",
-		  .short_name = 'i',
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_add_component,
-		  .description = _("Use IMAGE as the Linux kernel image."),
-		  .arg_description = _("IMAGE") },
-		{ .long_name = "ramdisk",
-		  .short_name = 'r',
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_add_component,
-		  .description = _("Use RAMDISK as the initial RAM disk\n" INDENT
-				   "(optional)."),
-		  .arg_description = _("RAMDISK") },
-		{ .long_name = "parmfile",
-		  .short_name = 'p',
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_add_component,
-		  .description = _("Use the kernel parameters stored in PARMFILE\n" INDENT
-				   "(optional)."),
-		  .arg_description = _("PARMFILE") },
-		MUT_EXCL_BOOL_FLAG(dump, dump,
-				   _("Enable PV guest dumps (optional). This option\n" INDENT
-				     "requires the '--comm-key' option."),
-				   _("Disable PV guest dumps (default).")),
-		MUT_EXCL_BOOL_FLAG(
-			cck-extension-secret, cck_extension_secret_enforcement,
-			_("Add-secret requests must provide an extension\n" INDENT
-			  "secret that matches the CCK-derived extension\n" INDENT
-			  "secret (optional). This option requires the\n" INDENT
-			  "'--comm-key' option."),
-			_("Add-secret requests don't have to provide\n" INDENT
-			  "the CCK-derived extension secret (default).")),
-		MUT_EXCL_BOOL_FLAG(pckmo, pckmo,
-				   _("Enable the support for the DEA, TDEA, AES, and\n" INDENT
-				     "ECC PCKMO key encryption functions (default)."),
-				   _("Disable the support for the DEA, TDEA, AES, and\n" INDENT
-				     "ECC PCKMO key encryption functions (optional).")),
-		{ .long_name = "comm-key",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = _(
-			  "FILE contains the customer communication key\n" INDENT
-			  "(CCK) (optional)."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "crl",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_FILENAME_ARRAY,
-		  .arg_data = &args->crl_paths,
-		  .description = _(
-			  "FILE contains a certificate revocation list\n" INDENT
-			  "(optional)."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "offline",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_NONE,
-		  .arg_data = &args->offline,
-		  .description = _("Don't download CRLs (optional)."),
-		  .arg_description = NULL },
-		{ .long_name = "root-ca",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = _(
-			  "Set FILE as the trusted root CA and don't use the\n" INDENT
-			  "root CAs that are installed on the system (optional)."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "no-verify",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_NONE,
-		  .arg_data = &args->no_verify,
-		  .description = _("Disable the host-key document verification\n" INDENT
-				   "(optional)."),
-		  .arg_description = NULL },
-		{ .long_name = "verbose",
-		  .short_name = 'V',
-		  .flags = G_OPTION_FLAG_NO_ARG,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_log_level,
-		  .description = _("Provide more detailed output (optional)."),
-		  .arg_description = NULL },
-		{ .long_name = "version",
-		  .short_name = 'v',
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_NONE,
-		  .arg_data = &print_version,
-		  .description = _("Print the version and exit."),
-		  .arg_description = NULL },
-		{ .long_name = G_OPTION_REMAINING,
-		  .short_name = 0,
-		  .flags = 0,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_remaining_values,
-		  .description = NULL,
-		  .arg_description = NULL },
-		{ 0 },
-	};
-
-	GOptionEntry x_entries[] = {
-		{ .long_name = "x-comp-key",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = _(
-			  "Use FILE as the AES 256-bit XTS key\n" INDENT
-			  "that is used for the component encryption.\n" INDENT
-			  "Optional; default: auto-generated."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "x-header-key",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_FILENAME,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = _(
-			  "Use FILE as the AES 256-bit GCM header key\n" INDENT
-			  "that protects the PV header.\n" INDENT
-			  "Optional; default: auto-generated."),
-		  .arg_description = _("FILE") },
-		{ .long_name = "x-pcf",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description =
-			  _("Specify the plaintext control flags\n" INDENT
-			    "as a hexadecimal value.\n" INDENT
-			    "Optional; mutually exclusive with\n" INDENT
-			    "'--(enable|disable)-pckmo'; default: '0xe0'."),
-		  .arg_description = _("VALUE") },
-		{ .long_name = "x-psw",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = psw_desc,
-		  .arg_description = _("ADDRESS") },
-		{ .long_name = "x-scf",
-		  .short_name = 0,
-		  .flags = G_OPTION_FLAG_NONE,
-		  .arg = G_OPTION_ARG_CALLBACK,
-		  .arg_data = cb_set_string_option,
-		  .description = _("Specify the secret control flags\n" INDENT
-				   "as a hexadecimal value.\n" INDENT
-				   "Optional; mutually exclusive with\n" INDENT
-				   "'--(enable|disable)-cck-extension-secret';\n" INDENT
-				   "Optional; default: '0x0'."),
-		  .arg_description = _("VALUE") },
-		{ 0 },
-	};
-
-	context = g_option_context_new(
-		_("- Create a protected virtualization image"));
-	g_option_context_set_summary(context, _(summary));
-	group = g_option_group_new(GETTEXT_PACKAGE, _("Application Options:"),
-				   _("Show help options"), args, NULL);
-	g_option_group_add_entries(group, entries);
-	g_option_context_set_main_group(context, group);
-
-	x_group = g_option_group_new("experimental", _("Experimental Options:"),
-				     _("Show experimental options"), args, NULL);
-	g_option_group_add_entries(x_group, x_entries);
-	g_option_context_add_group(context, x_group);
-	if (!g_option_context_parse(context, argc, argv, err))
-		return -1;
-
-	if (print_version) {
-		g_printf(_("%s version %s\n"), tool_name, RELEASE_STRING);
-		g_printf("%s\n", copyright_notice);
-		exit(EXIT_SUCCESS);
-	}
-
-	if (pv_args_set_defaults(args, err) < 0)
-		return -1;
-
-	return pv_args_validate_options(args, err);
-}
-
-PvArgs *pv_args_new(void)
-{
-	g_autoptr(PvArgs) args = g_new0(PvArgs, 1);
-
-	args->unused_values = g_ptr_array_new_with_free_func(g_free);
-	/* `args->cf_args` is implicitly initialized with zeros since
-	 * `g_new0` is used. So there is no reason to explicitly
-	 * initialize the values as PV_NOT_SET == 0.
-	 */
-	return g_steal_pointer(&args);
-}
-
-void pv_args_free(PvArgs *args)
-{
-	if (!args)
-		return;
-
-	g_free(args->cf_args.pcf);
-	g_free(args->cf_args.scf);
-	g_free(args->psw_addr);
-	g_free(args->cust_root_key_path);
-	g_free(args->cust_comm_key_path);
-	g_free(args->gcm_iv_path);
-	g_free(args->root_ca_path);
-	g_strfreev(args->crl_paths);
-	g_strfreev(args->untrusted_cert_paths);
-	g_strfreev(args->host_keys);
-	g_free(args->xts_key_path);
-	g_slist_free_full(args->comps, (GDestroyNotify)pv_arg_free);
-	g_ptr_array_free(args->unused_values, TRUE);
-	g_free(args->output_path);
-	g_free(args->tmp_dir);
-	g_free(args);
-}
-
-void pv_arg_free(PvArg *arg)
-{
-	if (!arg)
-		return;
-
-	g_free(arg->path);
-	g_free(arg);
-}
-PvArg *pv_arg_new(PvComponentType type, const gchar *path)
-{
-	g_autoptr(PvArg) ret = g_new0(struct pv_arg, 1);
-
-	ret->type = type;
-	ret->path = g_strdup(path);
-	return g_steal_pointer(&ret);
-}

genprotimg/src/pv/pv_args.h

@@ -1,75 +0,0 @@
-/*
- * PV arguments related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_ARGS_H
-#define PV_ARGS_H
-
-#include <glib.h>
-
-#include "pv_comp.h"
-
-typedef struct pv_arg {
-	PvComponentType type;
-	gchar *path;
-} PvArg;
-
-PvArg *pv_arg_new(PvComponentType type, const gchar *path);
-void pv_arg_free(PvArg *arg);
-
-typedef enum pv_tristate {
-	PV_NOT_SET = 0,
-	PV_TRUE,
-	PV_FALSE,
-} PvTristate;
-/* The value of PV_NOT_SET is not allowed to be changed */
-STATIC_ASSERT(PV_NOT_SET == 0)
-
-typedef struct {
-	gchar *pcf;
-	gchar *scf;
-	/* Add-secret requests do require CCK-extension secrets */
-	PvTristate enable_cck_extension_secret_enforcement;
-	PvTristate enable_dump;
-	PvTristate enable_pckmo;
-} PvControlFlagsArgs;
-
-typedef struct {
-	gint log_level;
-	gint no_verify;
-	gboolean offline;
-	PvControlFlagsArgs cf_args;
-	gchar *psw_addr; /* PSW address which will be used for the start of
-			  * the actual component (e.g. Linux kernel)
-			  */
-	gchar *cust_root_key_path;
-	gchar *cust_comm_key_path;
-	gchar *gcm_iv_path;
-	gchar **host_keys;
-	gchar *root_ca_path; /* Trusted root CA used for the verification of the
-			      * chain of trust (if specified).
-			      */
-	gchar **untrusted_cert_paths;
-	gchar **crl_paths;
-	gchar *xts_key_path;
-	GSList *comps;
-	gchar *output_path;
-	gchar *tmp_dir;
-	GPtrArray *unused_values;
-} PvArgs;
-
-PvArgs *pv_args_new(void);
-void pv_args_free(PvArgs *args);
-
-gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
-			   GError **err);
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvArg, pv_arg_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvArgs, pv_args_free)
-
-#endif

genprotimg/src/pv/pv_comp.c

@@ -1,432 +0,0 @@
-/*
- * PV component related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <openssl/bn.h>
-#include <openssl/evp.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "common.h"
-#include "utils/align.h"
-#include "utils/buffer.h"
-#include "utils/crypto.h"
-#include "utils/file_utils.h"
-
-#include "pv_comp.h"
-#include "pv_error.h"
-
-static void comp_file_free(CompFile *comp)
-{
-	if (!comp)
-		return;
-
-	g_free(comp->path);
-	g_free(comp);
-}
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(CompFile, comp_file_free)
-
-static PvComponent *pv_component_new(PvComponentType type, gsize size,
-				     PvComponentDataType d_type, void **data,
-				     GError **err)
-{
-	g_autoptr(PvComponent) ret = g_new0(PvComponent, 1);
-
-	g_assert(type >= 0 && type <= UINT16_MAX);
-
-	ret->type = (int)type;
-	ret->d_type = (int)d_type;
-	ret->data = g_steal_pointer(data);
-	ret->orig_size = size;
-
-	if (generate_tweak(&ret->tweak, (uint16_t)type, err) < 0)
-		return NULL;
-
-	return g_steal_pointer(&ret);
-}
-
-PvComponent *pv_component_new_file(PvComponentType type, const gchar *path,
-				   GError **err)
-{
-	g_autoptr(CompFile) file = g_new0(CompFile, 1);
-	gsize size;
-	gint rc;
-
-	g_assert(path != NULL);
-
-	rc = file_size(path, &size, err);
-	if (rc < 0)
-		return NULL;
-
-	file->path = g_strdup(path);
-	file->size = size;
-	return pv_component_new(type, size, DATA_FILE, (void **)&file, err);
-}
-
-PvComponent *pv_component_new_buf(PvComponentType type, const PvBuffer *buf,
-				  GError **err)
-{
-	g_assert(buf);
-
-	g_autoptr(PvBuffer) dup_buf = pv_buffer_dup(buf, FALSE);
-	return pv_component_new(type, buf->size, DATA_BUFFER, (void **)&dup_buf,
-				err);
-}
-
-void pv_component_free(PvComponent *component)
-{
-	if (!component)
-		return;
-
-	switch ((PvComponentDataType)component->d_type) {
-	case DATA_BUFFER:
-		pv_buffer_clear(&component->buf);
-		break;
-	case DATA_FILE:
-		comp_file_free(component->file);
-		break;
-	}
-
-	g_free(component);
-}
-
-gint pv_component_type(const PvComponent *component)
-{
-	return component->type;
-}
-
-const gchar *pv_component_name(const PvComponent *component)
-{
-	gint type = pv_component_type(component);
-
-	switch ((PvComponentType)type) {
-	case PV_COMP_TYPE_KERNEL:
-		return "kernel";
-	case PV_COMP_TYPE_INITRD:
-		return "ramdisk";
-	case PV_COMP_TYPE_CMDLINE:
-		return "parmline";
-	case PV_COMP_TYPE_STAGE3B:
-		return "stage3b";
-	}
-
-	g_assert_not_reached();
-}
-
-uint64_t pv_component_size(const PvComponent *component)
-{
-	switch ((PvComponentDataType)component->d_type) {
-	case DATA_BUFFER:
-		return component->buf->size;
-	case DATA_FILE:
-		return component->file->size;
-	}
-
-	g_assert_not_reached();
-}
-
-uint64_t pv_component_get_src_addr(const PvComponent *component)
-{
-	return component->src_addr;
-}
-
-uint64_t pv_component_get_orig_size(const PvComponent *component)
-{
-	return component->orig_size;
-}
-
-uint64_t pv_component_get_tweak_prefix(const PvComponent *component)
-{
-	return GUINT64_FROM_BE(component->tweak.cmp_idx.data);
-}
-
-gboolean pv_component_is_stage3b(const PvComponent *component)
-{
-	return pv_component_type(component) == PV_COMP_TYPE_STAGE3B;
-}
-
-gint pv_component_align_and_encrypt(PvComponent *component, const gchar *tmp_path,
-				    void *opaque, GError **err)
-{
-	struct cipher_parms *parms = opaque;
-
-	switch ((PvComponentDataType)component->d_type) {
-	case DATA_BUFFER: {
-		g_autoptr(PvBuffer) enc_buf = NULL;
-
-		if (!(IS_PAGE_ALIGNED(pv_component_size(component)))) {
-			g_autoptr(PvBuffer) new = NULL;
-
-			/* create a page aligned copy */
-			new = pv_buffer_dup(component->buf, TRUE);
-			pv_buffer_clear(&component->buf);
-			component->buf = g_steal_pointer(&new);
-		}
-		enc_buf = encrypt_buf(parms, component->buf, err);
-		if (!enc_buf)
-			return -1;
-
-		pv_buffer_clear(&component->buf);
-		component->buf = g_steal_pointer(&enc_buf);
-		return 0;
-	}
-	case DATA_FILE: {
-		const gchar *comp_name = pv_component_name(component);
-		gchar *path_in = component->file->path;
-		g_autofree gchar *path_out = NULL;
-		gsize orig_size;
-		gsize prep_size;
-
-		g_assert(path_in);
-
-		path_out = g_build_filename(tmp_path, comp_name, NULL);
-		if (encrypt_file(parms, path_in, path_out, &orig_size,
-				 &prep_size, err) < 0)
-			return -1;
-
-		if (component->orig_size != orig_size) {
-			g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
-				    _("File has changed during the preparation '%s'"),
-				    path_out);
-			return -1;
-		}
-
-		g_free(component->file->path);
-		component->file->size = prep_size;
-		component->file->path = g_steal_pointer(&path_out);
-		return 0;
-	}
-	}
-
-	g_assert_not_reached();
-}
-
-/* Page align the size of the component */
-gint pv_component_align(PvComponent *component, const gchar *tmp_path,
-			void *opaque G_GNUC_UNUSED, GError **err)
-{
-	if (IS_PAGE_ALIGNED(pv_component_size(component)))
-		return 0;
-
-	switch (component->d_type) {
-	case DATA_BUFFER: {
-		g_autoptr(PvBuffer) buf = NULL;
-
-		buf = pv_buffer_dup(component->buf, TRUE);
-		pv_buffer_clear(&component->buf);
-		component->buf = g_steal_pointer(&buf);
-		return 0;
-	} break;
-	case DATA_FILE: {
-		const gchar *comp_name = pv_component_name(component);
-		g_autofree gchar *path_out =
-			g_build_filename(tmp_path, comp_name, NULL);
-		gchar *path_in = component->file->path;
-		gsize size_out;
-
-		if (pad_file_right(path_out, path_in, &size_out, PAGE_SIZE,
-				   err) < 0)
-			return -1;
-
-		g_free(component->file->path);
-		component->file->path = g_steal_pointer(&path_out);
-		component->file->size = size_out;
-		return 0;
-	} break;
-	}
-
-	g_assert_not_reached();
-}
-
-int64_t pv_component_update_ald(const PvComponent *comp, EVP_MD_CTX *ctx,
-				GError **err)
-{
-	uint64_t addr = pv_component_get_src_addr(comp);
-	uint64_t size = pv_component_size(comp);
-	uint64_t cur = addr;
-	int64_t nep = 0;
-
-	g_assert(IS_PAGE_ALIGNED(size) && size != 0);
-
-	do {
-		uint64_t cur_be = GUINT64_TO_BE(cur);
-
-		if (EVP_DigestUpdate(ctx, &cur_be, sizeof(cur_be)) != 1) {
-			g_set_error(err, PV_CRYPTO_ERROR,
-				    PV_CRYPTO_ERROR_INTERNAL,
-				    _("EVP_DigestUpdate failed"));
-			return -1;
-		}
-
-		cur += PAGE_SIZE;
-		nep++;
-	} while (cur < addr + size);
-
-	return nep;
-}
-
-int64_t pv_component_update_pld(const PvComponent *comp, EVP_MD_CTX *ctx,
-				GError **err)
-{
-	uint64_t size = pv_component_size(comp);
-	int64_t nep = 0;
-
-	g_assert(IS_PAGE_ALIGNED(size) && size != 0);
-
-	switch (comp->d_type) {
-	case DATA_BUFFER: {
-		const PvBuffer *buf = comp->buf;
-
-		g_assert(buf->size <= INT64_MAX);
-		g_assert(buf->size == size);
-
-		if (EVP_DigestUpdate(ctx, buf->data, buf->size) != 1) {
-			g_set_error(err, PV_CRYPTO_ERROR,
-				    PV_CRYPTO_ERROR_INTERNAL,
-				    _("EVP_DigestUpdate failed"));
-			return -1;
-		}
-
-		nep = (int64_t)(buf->size / PAGE_SIZE);
-		break;
-	}
-	case DATA_FILE: {
-		const gchar *in_path = comp->file->path;
-		guchar in_buf[PAGE_SIZE];
-		gsize num_bytes_read_total = 0;
-		gsize num_bytes_read = 0;
-		FILE *f_in;
-
-		f_in = file_open(in_path, "rb", err);
-		if (!f_in)
-			return -1;
-
-		do {
-			/* Read data in blocks. Update the digest
-			 * context each read.
-			 */
-			if (file_read(f_in, in_buf, sizeof(*in_buf),
-				      sizeof(in_buf), &num_bytes_read,
-				      err) < 0) {
-				fclose(f_in);
-				return -1;
-			}
-			num_bytes_read_total += num_bytes_read;
-
-			if (EVP_DigestUpdate(ctx, in_buf, sizeof(in_buf)) != 1) {
-				g_set_error(err, PV_CRYPTO_ERROR,
-					    PV_CRYPTO_ERROR_INTERNAL,
-					    _("EVP_DigestUpdate failed"));
-				fclose(f_in);
-				return -1;
-			}
-
-			nep++;
-		} while (num_bytes_read_total < pv_component_size(comp) &&
-			 num_bytes_read != 0);
-
-		if (num_bytes_read_total != pv_component_size(comp)) {
-			g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
-				    _("'%s' has changed during the preparation"),
-				    in_path);
-			fclose(f_in);
-			return -1;
-		}
-		fclose(f_in);
-		break;
-	}
-	default:
-		g_assert_not_reached();
-	}
-
-	return nep;
-}
-
-int64_t pv_component_update_tld(const PvComponent *comp, EVP_MD_CTX *ctx,
-				GError **err)
-{
-	uint64_t size = pv_component_size(comp);
-	const union tweak *tweak = &comp->tweak;
-	g_autoptr(BIGNUM) tweak_num = NULL;
-	int64_t nep = 0;
-
-	g_assert(IS_PAGE_ALIGNED(size) && size != 0);
-
-	tweak_num = BN_bin2bn(tweak->data, sizeof(tweak->data), NULL);
-	if (!tweak_num) {
-		g_set_error(err, PV_CRYPTO_ERROR,
-			    PV_CRYPTO_ERROR_INTERNAL,
-			    _("BN_bin2bn failed"));
-		return -1;
-	}
-
-	for (uint64_t cur = 0; cur < size; cur += PAGE_SIZE) {
-		guchar tmp[sizeof(tweak->data)] = { 0 };
-
-		g_assert(BN_num_bytes(tweak_num) >= 0);
-		g_assert(sizeof(tmp) - (guint)BN_num_bytes(tweak_num) > 0);
-
-		if (BN_bn2binpad(tweak_num, tmp, sizeof(tmp)) < 0) {
-			g_set_error(err, PV_CRYPTO_ERROR,
-				    PV_CRYPTO_ERROR_INTERNAL,
-				    _("BN_bn2binpad failed"));
-			return -1;
-		}
-
-		if (EVP_DigestUpdate(ctx, tmp, sizeof(tmp)) != 1) {
-			g_set_error(err, PV_CRYPTO_ERROR,
-				    PV_CRYPTO_ERROR_INTERNAL,
-				    _("EVP_DigestUpdate failed"));
-			return -1;
-		}
-
-		/* calculate new tweak value */
-		if (BN_add_word(tweak_num, PAGE_SIZE) != 1) {
-			g_set_error(err, PV_CRYPTO_ERROR,
-				    PV_CRYPTO_ERROR_INTERNAL,
-				    _("BN_add_word failed"));
-			return -1;
-		}
-
-		nep++;
-	}
-
-	return nep;
-}
-
-gint pv_component_write(const PvComponent *component, FILE *f, GError **err)
-{
-	uint64_t offset = pv_component_get_src_addr(component);
-
-	g_assert(f);
-
-	switch (component->d_type) {
-	case DATA_BUFFER: {
-		const PvBuffer *buf = component->buf;
-
-		if (seek_and_write_buffer(f, buf, offset, err) < 0)
-			return -1;
-
-		return 0;
-	}
-	case DATA_FILE: {
-		const CompFile *file = component->file;
-
-		if (seek_and_write_file(f, file, offset, err) < 0)
-			return -1;
-
-		return 0;
-	}
-	}
-
-	g_assert_not_reached();
-}

genprotimg/src/pv/pv_comp.h

@@ -1,78 +0,0 @@
-/*
- * PV component related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_COMP_H
-#define PV_COMP_H
-
-#include <glib.h>
-#include <openssl/evp.h>
-#include <stdint.h>
-
-#include "utils/crypto.h"
-
-/* The order of this enum also implicitly defines the order of the
- * components within the PV image!
- */
-typedef enum {
-	PV_COMP_TYPE_KERNEL  = 0,
-	PV_COMP_TYPE_CMDLINE = 1,
-	PV_COMP_TYPE_INITRD  = 2,
-	PV_COMP_TYPE_STAGE3B = 3,
-} PvComponentType;
-
-typedef enum {
-	DATA_FILE = 0,
-	DATA_BUFFER,
-} PvComponentDataType;
-
-typedef struct comp_file {
-	gchar *path;
-	gsize size;
-} CompFile;
-
-typedef struct {
-	gint type; /* PvComponentType */
-	gint d_type; /* PvComponentDataType */
-	union {
-		struct comp_file *file;
-		PvBuffer *buf;
-		void *data;
-	};
-	uint64_t src_addr;
-	uint64_t orig_size;
-	union tweak tweak; /* used for the AES XTS encryption */
-} PvComponent;
-
-PvComponent *pv_component_new_file(PvComponentType type, const gchar *path,
-				   GError **err);
-PvComponent *pv_component_new_buf(PvComponentType type, const PvBuffer *buf,
-				  GError **err);
-void pv_component_free(PvComponent *component);
-gint pv_component_type(const PvComponent *component);
-const gchar *pv_component_name(const PvComponent *component);
-uint64_t pv_component_size(const PvComponent *component);
-uint64_t pv_component_get_src_addr(const PvComponent *component);
-uint64_t pv_component_get_orig_size(const PvComponent *component);
-uint64_t pv_component_get_tweak_prefix(const PvComponent *component);
-gboolean pv_component_is_stage3b(const PvComponent *component);
-gint pv_component_align_and_encrypt(PvComponent *component, const gchar *tmp_path,
-				    void *opaque, GError **err);
-gint pv_component_align(PvComponent *component, const gchar *tmp_path,
-			void *opaque G_GNUC_UNUSED, GError **err);
-int64_t pv_component_update_pld(const PvComponent *comp, EVP_MD_CTX *ctx,
-				GError **err);
-int64_t pv_component_update_ald(const PvComponent *comp, EVP_MD_CTX *ctx,
-				GError **err);
-int64_t pv_component_update_tld(const PvComponent *comp, EVP_MD_CTX *ctx,
-				GError **err);
-gint pv_component_write(const PvComponent *component, FILE *f, GError **err);
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvComponent, pv_component_free)
-
-#endif

genprotimg/src/pv/pv_comps.c

@@ -1,252 +0,0 @@
-/*
- * PV components related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <openssl/evp.h>
-#include <stdint.h>
-
-#include "boot/psw.h"
-#include "boot/stage3b.h"
-#include "common.h"
-#include "utils/align.h"
-#include "utils/crypto.h"
-
-#include "pv_comp.h"
-#include "pv_comps.h"
-#include "pv_error.h"
-#include "pv_stage3.h"
-
-struct _pv_img_comps {
-	gboolean finalized;
-	uint64_t next_src;
-	uint64_t nep;
-	EVP_MD_CTX *ald; /* context used for the hash of the addresses */
-	EVP_MD_CTX *pld; /* context used for the hash of the pages content */
-	EVP_MD_CTX *tld; /* context used for the hash of the tweaks */
-	GSList *comps; /* elements sorted by component type */
-};
-
-void pv_img_comps_free(PvImgComps *comps)
-{
-	if (!comps)
-		return;
-
-	EVP_MD_CTX_free(comps->ald);
-	EVP_MD_CTX_free(comps->pld);
-	EVP_MD_CTX_free(comps->tld);
-	g_slist_free_full(comps->comps, (GDestroyNotify)pv_component_free);
-	g_free(comps);
-}
-
-PvImgComps *pv_img_comps_new(const EVP_MD *ald_md, const EVP_MD *pld_md,
-			     const EVP_MD *tld_md, GError **err)
-{
-	g_autoptr(PvImgComps) ret = g_new0(PvImgComps, 1);
-
-	ret->ald = digest_ctx_new(ald_md, err);
-	if (!ret->ald)
-		return NULL;
-
-	ret->pld = digest_ctx_new(pld_md, err);
-	if (!ret->pld)
-		return NULL;
-
-	ret->tld = digest_ctx_new(tld_md, err);
-	if (!ret->tld)
-		return NULL;
-
-	return g_steal_pointer(&ret);
-}
-
-guint pv_img_comps_length(const PvImgComps *comps)
-{
-	return g_slist_length(comps->comps);
-}
-
-/* Update hashes and nep */
-/* Returns 0 in case of success and -1 in case of a failure */
-static gint pv_img_comps_hash_comp(PvImgComps *comps, const PvComponent *comp,
-				   GError **err)
-{
-	int64_t nep_1 = 0;
-	int64_t nep_2 = 0;
-	int64_t nep_3 = 0;
-
-	/* update pld */
-	nep_1 = pv_component_update_pld(comp, comps->pld, err);
-	if (nep_1 < 0)
-		return -1;
-
-	/* update ald */
-	nep_2 = pv_component_update_ald(comp, comps->ald, err);
-	if (nep_2 < 0)
-		return -1;
-
-	/* update tld */
-	nep_3 = pv_component_update_tld(comp, comps->tld, err);
-	if (nep_3 < 0)
-		return -1;
-
-	g_assert(nep_1 == nep_2);
-	g_assert(nep_2 == nep_3);
-
-	/* update comps->nep */
-	g_assert_true(g_uint64_checked_add(&comps->nep, comps->nep,
-					   (uint64_t)nep_1));
-	return 0;
-}
-
-gint pv_img_comps_add_component(PvImgComps *comps, PvComponent **comp,
-				GError **err)
-{
-	g_assert(comp);
-	g_assert(*comp);
-	g_assert(comps);
-	g_assert(IS_PAGE_ALIGNED(comps->next_src));
-
-	uint64_t src_addr = comps->next_src;
-	uint64_t src_size = pv_component_size(*comp)
-				    ? PAGE_ALIGN(pv_component_size(*comp))
-				    : PAGE_SIZE;
-
-	if (comps->finalized) {
-		g_set_error(err, PV_COMPONENT_ERROR, PV_COMPONENT_ERROR_FINALIZED,
-			    _("Failed to add component, image is already finalized"));
-		return -1;
-	}
-
-	/* set the address of the component in the memory layout */
-	(*comp)->src_addr = src_addr;
-
-	g_info("%12s:\t0x%012lx (%12ld / %12ld Bytes)",
-	       pv_component_name(*comp), pv_component_get_src_addr(*comp),
-	       pv_component_size(*comp), pv_component_get_orig_size(*comp));
-
-	/* append the component and pass the responsibility of @comp
-	 * to @comps
-	 */
-	comps->comps = g_slist_append(comps->comps, g_steal_pointer(comp));
-	comps->next_src += src_size;
-
-	g_assert(IS_PAGE_ALIGNED(comps->next_src));
-	g_assert(!*comp);
-	return 0;
-}
-
-struct stage3b_args *pv_img_comps_get_stage3b_args(const PvImgComps *comps,
-						   struct psw_t *psw)
-{
-	g_autofree struct stage3b_args *ret = g_new0(struct stage3b_args, 1);
-
-	for (GSList *iterator = comps->comps; iterator; iterator = iterator->next) {
-		const PvComponent *img_comp = iterator->data;
-		uint64_t src_addr, dst_size;
-
-		g_assert(img_comp);
-
-		src_addr = pv_component_get_src_addr(img_comp);
-		dst_size = pv_component_get_orig_size(img_comp);
-
-		g_assert(dst_size <= pv_component_size(img_comp));
-
-		switch ((PvComponentType)pv_component_type(img_comp)) {
-		case PV_COMP_TYPE_KERNEL:
-			memblob_init(&ret->kernel, src_addr, dst_size);
-			break;
-		case PV_COMP_TYPE_CMDLINE:
-			memblob_init(&ret->cmdline, src_addr, dst_size);
-			break;
-		case PV_COMP_TYPE_INITRD:
-			memblob_init(&ret->initrd, src_addr, dst_size);
-			break;
-		case PV_COMP_TYPE_STAGE3B:
-			/* nothing needs to be done since it is the
-			 * stage3b itself
-			 */
-			break;
-		default:
-			g_assert_not_reached();
-			break;
-		}
-	}
-
-	/* for `stage3b_args` big-endian format must be used */
-	ret->psw.mask = GUINT64_TO_BE(psw->mask);
-	ret->psw.addr = GUINT64_TO_BE(psw->addr);
-	return g_steal_pointer(&ret);
-}
-
-gint pv_img_comps_set_offset(PvImgComps *comps, gsize offset, GError **err)
-{
-	g_assert(IS_PAGE_ALIGNED(comps->next_src));
-
-	if (!IS_PAGE_ALIGNED(offset)) {
-		g_set_error(err, PV_IMAGE_ERROR, PV_IMAGE_ERROR_OFFSET,
-			    _("Offset must be page aligned"));
-		return -1;
-	}
-
-	if (pv_img_comps_length(comps) > 0) {
-		g_set_error(err, PV_IMAGE_ERROR, PV_IMAGE_ERROR_OFFSET,
-			    _("Offset cannot be changed after a component was added"));
-		return -1;
-	}
-
-	comps->next_src += offset;
-
-	g_assert(IS_PAGE_ALIGNED(comps->next_src));
-	return 0;
-}
-
-GSList *pv_img_comps_get_comps(const PvImgComps *comps)
-{
-	return comps->comps;
-}
-
-gint pv_img_comps_finalize(PvImgComps *comps, PvBuffer **pld_digest,
-			   PvBuffer **ald_digest, PvBuffer **tld_digest,
-			   uint64_t *nep, GError **err)
-{
-	g_autoptr(PvBuffer) tmp_pld_digest = NULL;
-	g_autoptr(PvBuffer) tmp_ald_digest = NULL;
-	g_autoptr(PvBuffer) tmp_tld_digest = NULL;
-
-	comps->finalized = TRUE;
-	for (GSList *iterator = comps->comps; iterator; iterator = iterator->next) {
-		const PvComponent *comp = iterator->data;
-
-		/* update hashes and nep */
-		if (pv_img_comps_hash_comp(comps, comp, err) < 0)
-			return -1;
-	}
-
-	tmp_pld_digest = digest_ctx_finalize(comps->pld, err);
-	if (!tmp_pld_digest)
-		return -1;
-
-	tmp_ald_digest = digest_ctx_finalize(comps->ald, err);
-	if (!tmp_ald_digest)
-		return -1;
-
-	tmp_tld_digest = digest_ctx_finalize(comps->tld, err);
-	if (!tmp_tld_digest)
-		return -1;
-
-	*pld_digest = g_steal_pointer(&tmp_pld_digest);
-	*ald_digest = g_steal_pointer(&tmp_ald_digest);
-	*tld_digest = g_steal_pointer(&tmp_tld_digest);
-	*nep = comps->nep;
-	return 0;
-}
-
-PvComponent *pv_img_comps_get_nth_comp(PvImgComps *comps, guint n)
-{
-	return g_slist_nth_data(comps->comps, n);
-}

genprotimg/src/pv/pv_comps.h

@@ -1,42 +0,0 @@
-/*
- * PV components related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_COMPS_H
-#define PV_COMPS_H
-
-#include <glib.h>
-#include <openssl/evp.h>
-#include <stdint.h>
-
-#include "boot/psw.h"
-#include "boot/stage3b.h"
-#include "utils/buffer.h"
-
-#include "pv_comp.h"
-
-typedef struct _pv_img_comps PvImgComps;
-
-PvImgComps *pv_img_comps_new(const EVP_MD *ald_md, const EVP_MD *pld_md,
-			     const EVP_MD *tld_md, GError **err);
-guint pv_img_comps_length(const PvImgComps *comps);
-GSList *pv_img_comps_get_comps(const PvImgComps *comps);
-struct stage3b_args *pv_img_comps_get_stage3b_args(const PvImgComps *comps,
-						   struct psw_t *psw);
-gint pv_img_comps_add_component(PvImgComps *comps, PvComponent **comp,
-				GError **err);
-PvComponent *pv_img_comps_get_nth_comp(PvImgComps *comps, guint n);
-gint pv_img_comps_set_offset(PvImgComps *comps, gsize offset, GError **err);
-gint pv_img_comps_finalize(PvImgComps *comps, PvBuffer **pld_digest,
-			   PvBuffer **ald_digest, PvBuffer **tld_digest,
-			   uint64_t *nep, GError **err);
-void pv_img_comps_free(PvImgComps *comps);
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvImgComps, pv_img_comps_free)
-
-#endif

genprotimg/src/pv/pv_error.c

@@ -1,37 +0,0 @@
-/*
- * PV error related functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-
-#include "pv_error.h"
-
-GQuark pv_error_quark(void)
-{
-	return g_quark_from_static_string("pv-error-quark");
-}
-
-GQuark pv_crypto_error_quark(void)
-{
-	return g_quark_from_static_string("pv-crypto-error-quark");
-}
-
-GQuark pv_component_error_quark(void)
-{
-	return g_quark_from_static_string("pv-component-error-quark");
-}
-
-GQuark pv_image_error_quark(void)
-{
-	return g_quark_from_static_string("pv-image-error-quark");
-}
-
-GQuark pv_parse_error_quark(void)
-{
-	return g_quark_from_static_string("pv-parse-error-quark");
-}

genprotimg/src/pv/pv_error.h

@@ -1,89 +0,0 @@
-/*
- * PV error related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_ERROR_H
-#define PV_ERROR_H
-
-#include <glib.h>
-
-GQuark pv_error_quark(void);
-GQuark pv_parse_error_quark(void);
-GQuark pv_component_error_quark(void);
-GQuark pv_crypto_error_quark(void);
-GQuark pv_image_error_quark(void);
-
-#define PV_ERROR	   pv_error_quark()
-#define PV_PARSE_ERROR	   pv_parse_error_quark()
-#define PV_CRYPTO_ERROR	   pv_crypto_error_quark()
-#define PV_COMPONENT_ERROR pv_component_error_quark()
-#define PV_IMAGE_ERROR	   pv_image_error_quark()
-
-typedef enum {
-	PV_ERROR_IPIB_SIZE,
-	PV_ERROR_PV_HDR_SIZE,
-	PV_ERROR_INTERNAL,
-	PV_ERROR_CURL_INIT_FAILED,
-	PV_ERROR_DOWNLOAD_FAILED,
-} PvErrors;
-
-typedef enum {
-	PV_PARSE_ERROR_OK = 0,
-	PV_PARSE_ERROR_SYNTAX,
-	PR_PARSE_ERROR_INVALID_ARGUMENT,
-	PR_PARSE_ERROR_MISSING_ARGUMENT,
-} PvParseErrors;
-
-typedef enum {
-	PV_COMPONENT_ERROR_UNALIGNED,
-	PV_COMPONENT_ERROR_FINALIZED,
-} PvComponentErrors;
-
-typedef enum {
-	PV_IMAGE_ERROR_OFFSET,
-	PV_IMAGE_ERROR_FINALIZED,
-} PvImageErrors;
-
-typedef enum {
-	PV_CRYPTO_ERROR_VERIFICATION,
-	PV_CRYPTO_ERROR_INIT,
-	PV_CRYPTO_ERROR_READ_CERTIFICATE,
-	PV_CRYPTO_ERROR_INTERNAL,
-	PV_CRYPTO_ERROR_DERIVE,
-	PV_CRYPTO_ERROR_KEYGENERATION,
-	PV_CRYPTO_ERROR_RANDOMIZATION,
-	PV_CRYPTO_ERROR_INVALID_PARM,
-	PV_CRYPTO_ERROR_INVALID_KEY_SIZE,
-	PV_CRYPTO_ERROR_INVALID_VALIDITY_PERIOD,
-	PV_CRYPTO_ERROR_EXPIRED,
-	PV_CRYPTO_ERROR_NOT_VALID_YET,
-	PV_CRYPTO_ERROR_LOAD_CRL,
-	PV_CRYPTO_ERROR_NO_PUBLIC_KEY,
-	PV_CRYPTO_ERROR_INVALID_SIGNATURE_ALGORITHM,
-	PV_CRYPTO_ERROR_SIGNATURE_ALGORITHM_MISMATCH,
-	PV_CRYPTO_ERROR_INVALID_URI,
-	PV_CRYPTO_ERROR_CRL_DOWNLOAD_FAILED,
-	PV_CRYPTO_ERROR_CERT_SIGNATURE_INVALID,
-	PV_CRYPTO_ERROR_CRL_SIGNATURE_INVALID,
-	PV_CRYPTO_ERROR_CERT_SUBJECT_ISSUER_MISMATCH,
-	PV_CRYPTO_ERROR_CRL_SUBJECT_ISSUER_MISMATCH,
-	PV_CRYPTO_ERROR_NO_IBM_Z_SIGNING_KEY,
-	PV_CRYPTO_ERROR_MALFORMED_CERTIFICATE,
-	PV_CRYPTO_ERROR_NO_CRL,
-	PV_CRYPTO_ERROR_LOAD_ROOT_CA,
-	PV_CRYPTO_ERROR_LOAD_DEFAULT_CA,
-	PV_CRYPTO_ERROR_MALFORMED_ROOT_CA,
-	PV_CRYPTO_ERROR_WRONG_CA_USED,
-	PV_CRYPTO_ERROR_SKID_AKID_MISMATCH,
-	PV_CRYPTO_ERROR_NO_ISSUER_IBM_Z_FOUND,
-	PV_CRYPTO_ERROR_FAILED_DOWNLOAD_CRL,
-	PV_CRYPTO_ERROR_NO_CRLDP,
-	PV_CRYPTO_ERROR_CERT_REVOKED,
-} PvCryptoErrors;
-
-#endif

genprotimg/src/pv/pv_hdr.c

@@ -1,293 +0,0 @@
-/*
- * PV header related functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <openssl/aes.h>
-#include <openssl/evp.h>
-#include <stdint.h>
-#include <string.h>
-
-#include "boot/psw.h"
-#include "include/pv_crypto_def.h"
-#include "utils/buffer.h"
-#include "utils/crypto.h"
-
-#include "pv_comp.h"
-#include "pv_hdr.h"
-#include "pv_image.h"
-
-void pv_hdr_free(PvHdr *hdr)
-{
-	if (!hdr)
-		return;
-
-	g_free(hdr->optional_items);
-	g_free(hdr->encrypted);
-	g_free(hdr->slots);
-	g_free(hdr);
-}
-
-uint32_t pv_hdr_size(const PvHdr *hdr)
-{
-	return GUINT32_FROM_BE(hdr->head.phs);
-}
-
-gboolean pv_hdr_uses_encryption(const PvHdr *hdr)
-{
-	return !(GUINT64_FROM_BE(hdr->head.pcf) & PV_PCF_NO_DECRYPTION);
-}
-
-uint64_t pv_hdr_enc_size(const PvHdr *hdr)
-{
-	return GUINT64_FROM_BE(hdr->head.sea);
-}
-
-uint32_t pv_hdr_enc_size_casted(const PvHdr *hdr)
-{
-	uint64_t size = pv_hdr_enc_size(hdr);
-
-	if (size > UINT32_MAX)
-		g_abort();
-
-	return (uint32_t)size;
-}
-
-static guint pv_hdr_tag_size(const PvHdr *hdr)
-{
-	return sizeof(hdr->tag);
-}
-
-uint32_t pv_hdr_aad_size(const PvHdr *hdr)
-{
-	return pv_hdr_size(hdr) - pv_hdr_enc_size_casted(hdr) -
-	       pv_hdr_tag_size(hdr);
-}
-
-uint64_t pv_hdr_get_nks(const PvHdr *hdr)
-{
-	return GUINT64_FROM_BE(hdr->head.nks);
-}
-
-/* In-place modification of ``buf`` */
-static gint pv_hdr_encrypt(const PvHdr *hdr, const PvImage *img, PvBuffer *buf,
-			   GError **err)
-{
-	uint32_t hdr_len = pv_hdr_size(hdr);
-	uint32_t aad_len = pv_hdr_aad_size(hdr);
-	guint tag_len = pv_hdr_tag_size(hdr);
-	uint32_t enc_len = pv_hdr_enc_size_casted(hdr);
-	const PvBuffer aad_part = { .data = buf->data, .size = aad_len };
-	PvBuffer enc_part = { .data = (uint8_t *)buf->data + aad_len,
-			    .size = enc_len };
-	PvBuffer tag_part = { .data = (uint8_t *)buf->data + hdr_len - tag_len,
-			    .size = tag_len };
-	struct cipher_parms parms;
-	int64_t c_len;
-
-	g_assert(aad_part.size + enc_part.size + tag_part.size == buf->size);
-	g_assert(img->cust_root_key->size <= INT_MAX);
-	g_assert(img->gcm_iv->size <= INT_MAX);
-	g_assert(EVP_CIPHER_key_length(img->gcm_cipher) ==
-		 (int)img->cust_root_key->size);
-	g_assert(EVP_CIPHER_iv_length(img->gcm_cipher) == (int)img->gcm_iv->size);
-
-	parms.key = img->cust_root_key;
-	parms.iv_or_tweak = img->gcm_iv;
-	parms.cipher = img->gcm_cipher;
-
-	/* in-place encryption */
-	c_len = gcm_encrypt(&enc_part, &aad_part, &parms, &enc_part, &tag_part, err);
-	if (c_len < 0)
-		return -1;
-
-	g_assert(c_len == enc_len);
-	return 0;
-}
-
-/* Initializes the unencrypted, but integrity protected part of the PV
- * header
- */
-static gint pv_hdr_aad_init(PvHdr *hdr, const PvImage *img, GError **err)
-{
-	g_autofree union ecdh_pub_key *cust_pub_key = NULL;
-	struct pv_hdr_key_slot *hdr_slot = hdr->slots;
-	struct pv_hdr_head *head = &hdr->head;
-	g_autoptr(PvBuffer) pld = NULL;
-	g_autoptr(PvBuffer) ald = NULL;
-	g_autoptr(PvBuffer) tld = NULL;
-	uint64_t nep = 0;
-
-	g_assert(sizeof(head->iv) == img->gcm_iv->size);
-	g_assert(sizeof(head->cust_pub_key) == sizeof(*cust_pub_key));
-
-	cust_pub_key = evp_pkey_to_ecdh_pub_key(img->cust_pub_priv_key, err);
-	if (!cust_pub_key)
-		return -1;
-
-	head->magic = GUINT64_TO_BE(PV_MAGIC_NUMBER);
-	head->version = GUINT32_TO_BE(PV_VERSION_1);
-	/* ``phs`` is already set so we can skip it here */
-	memcpy(head->iv, img->gcm_iv->data, sizeof(head->iv));
-	/* ``nks`` is already set so we can skip it here */
-	/* ``sea`` is already set so we can skip it here */
-	head->pcf = GUINT64_TO_BE(img->pcf);
-	memcpy(head->cust_pub_key.data, cust_pub_key,
-	       sizeof(head->cust_pub_key));
-
-	if (pv_img_calc_pld_ald_tld_nep(img, &pld, &ald, &tld, &nep, err) < 0)
-		return -1;
-
-	g_assert(sizeof(head->pld) == pld->size);
-	g_assert(sizeof(head->ald) == ald->size);
-	g_assert(sizeof(head->tld) == tld->size);
-
-	head->nep = GUINT64_TO_BE(nep);
-	memcpy(head->pld, pld->data, sizeof(head->pld));
-	memcpy(head->ald, ald->data, sizeof(head->ald));
-	memcpy(head->tld, tld->data, sizeof(head->tld));
-
-	/* set the key slots */
-	for (GSList *iterator = img->key_slots; iterator; iterator = iterator->next) {
-		const PvHdrKeySlot *slot = iterator->data;
-
-		g_assert(slot);
-
-		/* the memory for the slots is pre-allocated so we
-		 * have not to allocate and since PvHdrKeySlot is
-		 * stored in the big-edian format we can simply use
-		 * memcpy.
-		 */
-		memcpy(hdr_slot++, slot, sizeof(*slot));
-	}
-
-	return 0;
-}
-
-/* Initializes the encrypted and also integrity protected part of the
- * PV header
- */
-static gint pv_hdr_enc_init(PvHdr *hdr, const PvImage *img, GError **err)
-{
-	struct pv_hdr_encrypted *enc = hdr->encrypted;
-	const PvComponent *stage3b;
-	struct psw_t psw;
-
-	g_assert(sizeof(enc->img_enc_key_1) + sizeof(enc->img_enc_key_2) ==
-		 EVP_CIPHER_key_length(img->xts_cipher));
-	g_assert(sizeof(enc->cust_comm_key) == img->cust_comm_key->size);
-	g_assert(img->xts_key->size ==
-		 (guint)EVP_CIPHER_key_length(img->xts_cipher));
-
-	stage3b = pv_img_get_stage3b_comp(img, err);
-	if (!stage3b)
-		return -1;
-
-	memcpy(enc->cust_comm_key, img->cust_comm_key->data,
-	       sizeof(enc->cust_comm_key));
-	memcpy(enc->img_enc_key_1, img->xts_key->data,
-	       sizeof(enc->img_enc_key_1));
-	memcpy(enc->img_enc_key_2,
-	       (uint8_t *)img->xts_key->data + sizeof(enc->img_enc_key_1),
-	       sizeof(enc->img_enc_key_2));
-
-	/* Setup program check handler */
-	psw.mask = GUINT64_TO_BE(DEFAULT_INITIAL_PSW_MASK);
-	psw.addr = GUINT64_TO_BE(pv_component_get_src_addr(stage3b));
-	enc->psw = psw;
-	enc->scf = GUINT64_TO_BE(img->scf);
-	enc->noi = GUINT32_TO_BE(g_slist_length(img->optional_items));
-
-	/* set the optional items */
-	for (GSList *iterator = img->optional_items; iterator;
-	     iterator = iterator->next) {
-		const struct pv_hdr_opt_item *item = iterator->data;
-
-		g_assert(item);
-
-		/* not supported in the first version */
-		g_assert_not_reached();
-	}
-
-	return 0;
-}
-
-PvHdr *pv_hdr_new(const PvImage *img, GError **err)
-{
-	uint32_t noi = g_slist_length(img->optional_items);
-	uint32_t hdr_size = pv_img_get_pv_hdr_size(img);
-	gsize nks = g_slist_length(img->key_slots);
-	uint32_t sea = pv_img_get_enc_size(img);
-	g_autoptr(PvHdr) ret = NULL;
-
-	g_assert(nks > 0);
-	/* must be a multiple of AES block size */
-	g_assert(sea % AES_BLOCK_SIZE == 0);
-	g_assert(sea >= sizeof(struct pv_hdr_encrypted));
-
-	ret = g_new0(PvHdr, 1);
-	ret->slots = g_new0(struct pv_hdr_key_slot, nks);
-	ret->head.phs = GUINT32_TO_BE(hdr_size);
-	ret->head.nks = GUINT64_TO_BE(nks);
-	ret->head.sea = GUINT64_TO_BE(sea);
-
-	ret->encrypted = g_new0(struct pv_hdr_encrypted, 1);
-	ret->optional_items = g_malloc0(sea - sizeof(struct pv_hdr_encrypted));
-	ret->encrypted->noi = GUINT32_TO_BE(noi);
-
-	if (pv_hdr_aad_init(ret, img, err) < 0)
-		return NULL;
-
-	if (pv_hdr_enc_init(ret, img, err) < 0)
-		return NULL;
-
-	return g_steal_pointer(&ret);
-}
-
-static void pv_hdr_memcpy(const PvHdr *hdr, const PvBuffer *dst)
-{
-	uint64_t nks = pv_hdr_get_nks(hdr);
-	uint8_t *data;
-
-	g_assert(dst->size == pv_hdr_size(hdr));
-	g_assert(pv_hdr_enc_size_casted(hdr) >= sizeof(*hdr->encrypted));
-
-	data = memcpy(dst->data, &hdr->head, sizeof(hdr->head));
-	data = memcpy(data + sizeof(hdr->head), hdr->slots,
-		      sizeof(struct pv_hdr_key_slot) * nks);
-	data = memcpy(data + sizeof(struct pv_hdr_key_slot) * nks,
-		      hdr->encrypted, sizeof(*hdr->encrypted));
-	if (pv_hdr_enc_size_casted(hdr) - sizeof(*hdr->encrypted) > 0) {
-		(void)memcpy(data + sizeof(*hdr->encrypted),
-			     hdr->optional_items,
-			     pv_hdr_enc_size_casted(hdr) - sizeof(*hdr->encrypted));
-	}
-}
-
-PvBuffer *pv_hdr_serialize(const PvHdr *hdr, const PvImage *img,
-			   enum PvCryptoMode mode, GError **err)
-{
-	uint32_t hdr_size = pv_hdr_size(hdr);
-	g_autoptr(PvBuffer) ret = NULL;
-
-	ret = pv_buffer_alloc(hdr_size);
-	pv_hdr_memcpy(hdr, ret);
-
-	if (mode == PV_ENCRYPT) {
-		/* The buffer @ret is modified in-place */
-		if (pv_hdr_encrypt(hdr, img, ret, err) < 0)
-			return NULL;
-	} else {
-		/* Simply copy the tag */
-		memcpy((uint8_t *)ret->data + hdr_size - pv_hdr_tag_size(hdr),
-		       hdr->tag, pv_hdr_tag_size(hdr));
-	}
-
-	return g_steal_pointer(&ret);
-}

genprotimg/src/pv/pv_hdr.h

@@ -1,35 +0,0 @@
-/*
- * PV header related functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_HDR_H
-#define PV_HDR_H
-
-#include <glib.h>
-#include <stdint.h>
-
-#include "include/pv_hdr_def.h"
-#include "utils/crypto.h"
-#include "utils/buffer.h"
-
-#include "pv_image.h"
-
-PvHdr *pv_hdr_new(const PvImage *img, GError **err);
-void pv_hdr_free(PvHdr *hdr);
-G_GNUC_UNUSED gboolean pv_hdr_uses_encryption(const PvHdr *hdr);
-PvBuffer *pv_hdr_serialize(const PvHdr *hdr, const PvImage *img,
-			   enum PvCryptoMode mode, GError **err);
-uint32_t pv_hdr_size(const PvHdr *hdr);
-uint32_t pv_hdr_aad_size(const PvHdr *hdr);
-uint64_t pv_hdr_enc_size(const PvHdr *hdr);
-uint32_t pv_hdr_enc_size_casted(const PvHdr *hdr);
-uint64_t pv_hdr_get_nks(const PvHdr *hdr);
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvHdr, pv_hdr_free)
-
-#endif

genprotimg/src/pv/pv_image.h

@@ -1,68 +0,0 @@
-/*
- * PV image related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_IMAGE_H
-#define PV_IMAGE_H
-
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <openssl/evp.h>
-#include <stdint.h>
-
-#include "boot/psw.h"
-#include "utils/buffer.h"
-
-#include "pv_args.h"
-#include "pv_comp.h"
-#include "pv_comps.h"
-#include "pv_stage3.h"
-
-typedef struct {
-	gchar *tmp_dir; /* directory used for temporary files */
-	PvBuffer *stage3a; /* stage3a containing IPIB and PV header */
-	gsize stage3a_bin_size; /* size of stage3a.bin */
-	struct psw_t stage3a_psw; /* (short) PSW that is written to
-				   * location 0 of the created image
-				   */
-	struct psw_t initial_psw; /* PSW loaded by stage3b */
-	EVP_PKEY *cust_pub_priv_key; /* customer private/public key */
-	GSList *host_pub_keys; /* public host keys */
-	gint nid; /* Elliptic Curve used for the key derivation */
-	/* keys and cipher used for the AES-GCM encryption */
-	PvBuffer *cust_root_key;
-	PvBuffer *gcm_iv;
-	const EVP_CIPHER *gcm_cipher;
-	/* Information for the IPIB and PV header */
-	uint64_t pcf;
-	uint64_t scf;
-	PvBuffer *cust_comm_key;
-	const EVP_CIPHER *cust_comm_cipher;
-	PvBuffer *xts_key;
-	const EVP_CIPHER *xts_cipher;
-	GSList *key_slots;
-	GSList *optional_items;
-	PvImgComps *comps;
-} PvImage;
-
-PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err);
-void pv_img_free(PvImage *img);
-gint pv_img_add_component(PvImage *img, const PvArg *arg, GError **err);
-gint pv_img_finalize(PvImage *img, const gchar *stage3b_path, GError **err);
-gint pv_img_calc_pld_ald_tld_nep(const PvImage *img, PvBuffer **pld, PvBuffer **ald,
-				 PvBuffer **tld, uint64_t *nep, GError **err);
-gint pv_img_load_and_set_stage3a(PvImage *img, const gchar *path, GError **err);
-const PvComponent *pv_img_get_stage3b_comp(const PvImage *img, GError **err);
-gint pv_img_add_stage3b_comp(PvImage *img, const gchar *path, GError **err);
-uint32_t pv_img_get_enc_size(const PvImage *img);
-uint32_t pv_img_get_pv_hdr_size(const PvImage *img);
-gint pv_img_write(PvImage *img, const gchar *path, GError **err);
-
-G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvImage, pv_img_free)
-
-#endif

genprotimg/src/pv/pv_ipib.c

@@ -1,127 +0,0 @@
-/*
- * PV IPIB related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <stdint.h>
-#include <stdio.h>
-
-#include "boot/ipl.h"
-#include "common.h"
-#include "include/pv_hdr_def.h"
-#include "lib/zt_common.h"
-#include "utils/align.h"
-#include "utils/buffer.h"
-
-#include "pv_comp.h"
-#include "pv_error.h"
-#include "pv_ipib.h"
-
-uint64_t pv_ipib_get_size(uint32_t num_comp)
-{
-	gsize ipib_size = sizeof(struct ipl_pl_hdr) +
-			  sizeof(struct ipl_pb0_pv) +
-			  num_comp * sizeof(struct ipl_pb0_pv_comp);
-
-	/* the minimal size is one page */
-	return MAX(ipib_size, PAGE_SIZE);
-}
-
-static gint pv_ipib_init(IplParameterBlock *ipib, GSList *comps,
-			 const PvBuffer *hdr)
-{
-	g_assert(sizeof(struct ipl_pl_hdr) <= UINT32_MAX);
-	g_assert(sizeof(struct ipl_pb0_pv_comp) <= UINT32_MAX);
-	g_assert(sizeof(struct ipl_pb0_pv) <= UINT32_MAX);
-	g_assert(ipib);
-
-	guint comps_length = g_slist_length(comps);
-	uint32_t ipl_pl_hdr_size = (uint32_t)sizeof(struct ipl_pl_hdr);
-	struct ipl_pb0_pv *pv = &ipib->pv;
-	uint32_t ipib_comps_size;
-	uint32_t blk0_len;
-	uint32_t ipib_size;
-	gsize i;
-
-	g_assert_true(
-		g_uint_checked_mul(&ipib_comps_size, comps_length,
-				   (uint32_t)sizeof(struct ipl_pb0_pv_comp)));
-	g_assert_true(g_uint_checked_add(&blk0_len, (uint32_t)sizeof(*pv),
-					 ipib_comps_size));
-	g_assert(ipl_pl_hdr_size + blk0_len <= PAGE_SIZE);
-
-	ipib_size = MAX(ipl_pl_hdr_size + blk0_len, (uint32_t)PAGE_SIZE);
-	g_assert(pv_ipib_get_size(comps_length) == ipib_size);
-
-	pv->pbt = IPL_PBT_PV;
-	pv->len = GUINT32_TO_BE(blk0_len);
-	pv->num_comp = GUINT32_TO_BE(comps_length);
-	/* both values will be overwritten during the IPL process by
-	 * the stage3a loader
-	 */
-	pv->pv_hdr_addr = GUINT64_TO_BE(0x0);
-	pv->pv_hdr_size = GUINT64_TO_BE(hdr->size);
-
-	ipib->hdr.len = GUINT32_TO_BE(ipib_size);
-	ipib->hdr.version = IPL_PARM_BLOCK_VERSION;
-
-	i = 0;
-	for (GSList *iterator = comps; iterator; iterator = iterator->next, i++) {
-		const PvComponent *comp = iterator->data;
-		uint64_t comp_addr, comp_size;
-
-		g_assert(comp);
-
-		comp_addr = pv_component_get_src_addr(comp);
-		comp_size = pv_component_size(comp);
-
-		g_assert(IS_PAGE_ALIGNED(comp_size));
-
-		pv->components[i].addr = GUINT64_TO_BE(comp_addr);
-		pv->components[i].len = GUINT64_TO_BE(comp_size);
-		pv->components[i].tweak_pref =
-			GUINT64_TO_BE(pv_component_get_tweak_prefix(comp));
-		if (i > 0) {
-			/* tweak prefixes of the components must grow
-			 * strictly monotonous
-			 */
-			g_assert(GUINT64_FROM_BE(pv->components[i].tweak_pref) >
-				 GUINT64_FROM_BE(pv->components[i - 1].tweak_pref));
-		}
-	}
-
-	return 0;
-}
-
-IplParameterBlock *pv_ipib_new(GSList *comps, const PvBuffer *hdr, GError **err)
-{
-	uint64_t ipib_size = pv_ipib_get_size(g_slist_length(comps));
-	g_autoptr(IplParameterBlock) ret = NULL;
-
-	if (ipib_size > PV_V1_IPIB_MAX_SIZE) {
-		g_set_error(err, PV_ERROR, PV_ERROR_IPIB_SIZE,
-			    _("IPIB size is too large: %lu < %lu"), ipib_size,
-			    PAGE_SIZE);
-		return NULL;
-	}
-
-	ret = g_malloc0(ipib_size);
-	if (pv_ipib_init(ret, comps, hdr) < 0)
-		return NULL;
-
-	return g_steal_pointer(&ret);
-}
-
-void pv_ipib_free(IplParameterBlock *ipib)
-{
-	if (!ipib)
-		return;
-
-	g_free(ipib);
-}

genprotimg/src/pv/pv_ipib.h

@@ -1,27 +0,0 @@
-/*
- * PV IPIB related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_IPIB_H
-#define PV_IPIB_H
-
-#include <glib.h>
-#include <stdint.h>
-
-#include "boot/ipl.h"
-#include "utils/buffer.h"
-
-typedef struct ipl_parameter_block IplParameterBlock;
-
-uint64_t pv_ipib_get_size(uint32_t num_comp);
-IplParameterBlock *pv_ipib_new(GSList *comps, const PvBuffer *hdr, GError **err);
-void pv_ipib_free(IplParameterBlock *ipib);
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(IplParameterBlock, pv_ipib_free)
-
-#endif

genprotimg/src/pv/pv_opt_item.c

@@ -1,26 +0,0 @@
-/*
- * PV optional item related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-
-#include "pv_opt_item.h"
-
-uint32_t pv_opt_item_size(const struct pv_hdr_opt_item *item G_GNUC_UNUSED)
-{
-	/* not implemented yet */
-	g_assert_not_reached();
-}
-
-void pv_opt_item_free(struct pv_hdr_opt_item *item)
-{
-	if (!item)
-		return;
-
-	g_free(item);
-}

genprotimg/src/pv/pv_opt_item.h

@@ -1,20 +0,0 @@
-/*
- * PV optional item related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_OPT_ITEM_H
-#define PV_OPT_ITEM_H
-
-#include <stdint.h>
-
-#include "include/pv_hdr_def.h"
-
-uint32_t pv_opt_item_size(const struct pv_hdr_opt_item *item);
-void pv_opt_item_free(struct pv_hdr_opt_item *item);
-
-#endif

genprotimg/src/pv/pv_stage3.c

@@ -1,164 +0,0 @@
-/*
- * PV stage3 loader related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <glib.h>
-#include <stdint.h>
-#include <string.h>
-
-#include "boot/ipl.h"
-#include "boot/stage3a.h"
-#include "boot/stage3b.h"
-#include "common.h"
-#include "utils/align.h"
-
-#include "pv_error.h"
-#include "pv_stage3.h"
-
-#define STAGE3A_ARGS(data_ptr, loader_size)                         \
-	((struct stage3a_args *)((uint64_t)data_ptr + loader_size - \
-				 sizeof(struct stage3a_args)))
-
-static PvBuffer *loader_getblob(const gchar *filename, gsize *loader_size,
-				gsize args_size, gsize data_size,
-				gboolean data_aligned, GError **err)
-{
-	g_autoptr(GMappedFile) mapped_file = NULL;
-	g_autoptr(PvBuffer) ret = NULL;
-	gsize size, tmp_loader_size;
-	gchar *loader_data;
-
-	g_assert(loader_size);
-
-	mapped_file = g_mapped_file_new(filename, FALSE, err);
-	if (!mapped_file)
-		return NULL;
-
-	loader_data = g_mapped_file_get_contents(mapped_file);
-	if (!loader_data) {
-		g_set_error(err, G_FILE_ERROR, G_FILE_ERROR_BADF,
-			    _("File '%s' is empty"), filename);
-		return NULL;
-	}
-	tmp_loader_size = g_mapped_file_get_length(mapped_file);
-
-	if (tmp_loader_size < args_size) {
-		g_set_error(err, G_FILE_ERROR, G_FILE_ERROR_BADF,
-			    _("File size less than expected: %lu < %ln"),
-			    tmp_loader_size, loader_size);
-		return NULL;
-	}
-
-	/* For example, the PV header and IPIB data must be page
-	 * aligned.
-	 */
-	size = (data_aligned ? PAGE_ALIGN(tmp_loader_size) : tmp_loader_size) +
-	       data_size;
-
-	ret = pv_buffer_alloc(size);
-
-	/* copy the loader "template" */
-	memcpy(ret->data, loader_data, tmp_loader_size);
-	/* reset our dummy data (offsets and length) to zeros */
-	memset((uint8_t *)ret->data + tmp_loader_size - args_size, 0,
-	       args_size);
-	*loader_size = tmp_loader_size;
-	return g_steal_pointer(&ret);
-}
-
-PvBuffer *stage3a_getblob(const gchar *filename, gsize *loader_size,
-			  gsize data_size, GError **err)
-{
-	return loader_getblob(filename, loader_size,
-			      sizeof(struct stage3a_args), data_size, TRUE,
-			      err);
-}
-
-/* For the memory layout see stage3a.lds */
-/* Set the right offsets and sizes in the stage3a template + add
- * the IPIB block with the PV header
- */
-static gint stage3a_set_data(PvBuffer *loader, gsize loader_size,
-			     const PvBuffer *hdr, struct ipl_parameter_block *ipib,
-			     GError **err)
-{
-	uint32_t ipib_size = GUINT32_FROM_BE(ipib->hdr.len);
-	gsize args_size = sizeof(struct stage3a_args);
-	uint32_t hdr_size = (uint32_t)hdr->size;
-	uint64_t args_addr, next_data_addr;
-
-	if (hdr->size > UINT32_MAX) {
-		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
-			    _("Invalid header size: %zu"), hdr->size);
-		return -1;
-	}
-
-	/* we assume here that the loader ``stage3a`` is loaded page
-	 * aligned in the guest
-	 */
-	args_addr = (uint64_t)loader->data + loader_size - args_size;
-
-	/* therefore `next_data_addr` is also page aligned */
-	next_data_addr = (uint64_t)loader->data + PAGE_ALIGN(loader_size);
-
-	/* copy IPIB data */
-	memcpy((void *)next_data_addr, ipib, ipib_size);
-
-	/* set IPIB offset in relation to the stage3a arguments */
-	STAGE3A_ARGS(loader->data, loader_size)->ipib_offs =
-		GUINT64_TO_BE(next_data_addr - args_addr);
-
-	next_data_addr = next_data_addr + PAGE_ALIGN(ipib_size);
-	/* copy PV header */
-	memcpy((void *)next_data_addr, hdr->data, hdr_size);
-	/* set PV header size and offset in relation to the stage3a
-	 * arguments
-	 */
-	STAGE3A_ARGS(loader->data, loader_size)->hdr_offs =
-		GUINT64_TO_BE(next_data_addr - args_addr);
-	STAGE3A_ARGS(loader->data, loader_size)->hdr_size = GUINT64_TO_BE(hdr_size);
-
-	return 0;
-}
-
-gint build_stage3a(PvBuffer *loader, gsize loader_size, const PvBuffer *hdr,
-		   struct ipl_parameter_block *ipib, GError **err)
-{
-	return stage3a_set_data(loader, loader_size, hdr, ipib, err);
-}
-
-PvBuffer *stage3b_getblob(const gchar *filename, GError **err)
-{
-	g_autoptr(PvBuffer) ret = NULL;
-	gsize rb_size;
-
-	ret = loader_getblob(filename, &rb_size, sizeof(struct stage3b_args), 0,
-			     FALSE, err);
-	if (!ret)
-		return NULL;
-
-	g_assert(ret->size == rb_size);
-	return g_steal_pointer(&ret);
-}
-
-void build_stage3b(PvBuffer *stage3b, const struct stage3b_args *args)
-{
-	g_assert(stage3b->size > sizeof(*args));
-
-	/* at the end of the stage3b there are the stage3b args
-	 * positioned
-	 */
-	memcpy((uint8_t *)stage3b->data + stage3b->size - sizeof(*args), args,
-	       sizeof(*args));
-}
-
-void memblob_init(struct memblob *arg, uint64_t src, uint64_t size)
-{
-	arg->src = GUINT64_TO_BE(src);
-	arg->size = GUINT64_TO_BE(size);
-}

genprotimg/src/pv/pv_stage3.h

@@ -1,29 +0,0 @@
-/*
- * PV stage3 loader related definitions and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_STAGE3_H
-#define PV_STAGE3_H
-
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <stdint.h>
-
-#include "boot/ipl.h"
-#include "boot/stage3b.h"
-#include "utils/buffer.h"
-
-PvBuffer *stage3a_getblob(const gchar *filename, gsize *loader_size,
-			  gsize data_size, GError **err);
-gint build_stage3a(PvBuffer *dc, gsize dc_size, const PvBuffer *hdr,
-		   struct ipl_parameter_block *ipib, GError **err);
-PvBuffer *stage3b_getblob(const gchar *filename, GError **err);
-void build_stage3b(PvBuffer *stage3b, const struct stage3b_args *args);
-void memblob_init(struct memblob *arg, uint64_t src, uint64_t size);
-
-#endif

genprotimg/src/utils/align.h

@@ -1,24 +0,0 @@
-/*
- * Alignment utils
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_UTILS_ALIGN_H
-#define PV_UTILS_ALIGN_H
-
-#include "lib/zt_common.h"
-#include "boot/page.h"
-
-#define IS_ALIGNED(addr, size) (!(addr & (size - 1)))
-
-/* align addr to the next page boundary */
-#define PAGE_ALIGN(addr) ALIGN((unsigned long)addr, PAGE_SIZE)
-
-/* test whether an address is aligned to PAGE_SIZE or not */
-#define IS_PAGE_ALIGNED(addr) IS_ALIGNED((unsigned long)(addr), PAGE_SIZE)
-
-#endif

genprotimg/src/utils/buffer.c

@@ -1,78 +0,0 @@
-/*
- * Buffer functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <errno.h>
-#include <glib.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "align.h"
-#include "buffer.h"
-#include "common.h"
-#include "file_utils.h"
-
-PvBuffer *pv_buffer_alloc(gsize size)
-{
-	PvBuffer *ret = g_new0(PvBuffer, 1);
-
-	ret->data = g_malloc0(size);
-	ret->size = size;
-	return ret;
-}
-
-PvBuffer *pv_buffer_take(char *data, gsize size)
-{
-	PvBuffer *ret = g_new0(PvBuffer, 1);
-
-	ret->data = data;
-	ret->size = size;
-	return ret;
-}
-
-PvBuffer *pv_buffer_dup(const PvBuffer *buf, gboolean page_aligned)
-{
-	PvBuffer *ret;
-	gsize size;
-
-	if (!buf)
-		return NULL;
-
-	size = buf->size;
-	if (page_aligned)
-		size = PAGE_ALIGN(size);
-
-	ret = pv_buffer_alloc(size);
-
-	/* content will be 0-right-padded */
-	memcpy(ret->data, buf->data, buf->size);
-	return ret;
-}
-
-gint pv_buffer_write(const PvBuffer *buf, FILE *file, GError **err)
-{
-	return file_write(file, buf->data, buf->size, 1, NULL, err);
-}
-
-void pv_buffer_free(PvBuffer *buf)
-{
-	if (!buf)
-		return;
-
-	g_free(buf->data);
-	g_free(buf);
-}
-
-void pv_buffer_clear(PvBuffer **buf)
-{
-	if (!buf || !*buf)
-		return;
-
-	pv_buffer_free(*buf);
-	*buf = NULL;
-}

genprotimg/src/utils/buffer.h

@@ -1,35 +0,0 @@
-/*
- * Buffer definition and functions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_UTILS_BUFFER_H
-#define PV_UTILS_BUFFER_H
-
-#include <glib.h>
-#include <stdio.h>
-
-#include "common.h"
-
-typedef struct PvBuffer {
-	void *data;
-	gsize size; /* in bytes */
-} PvBuffer;
-
-PvBuffer *pv_buffer_alloc(gsize size);
-/* After this call @data belongs to the PvBuffer and must no longer be modified
- * by the caller.
- */
-PvBuffer *pv_buffer_take(char *data, gsize size);
-void pv_buffer_free(PvBuffer *buf);
-void pv_buffer_clear(PvBuffer **buf);
-gint pv_buffer_write(const PvBuffer *buf, FILE *file, GError **err);
-PvBuffer *pv_buffer_dup(const PvBuffer *buf, gboolean page_aligned);
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(PvBuffer, pv_buffer_free)
-
-#endif

genprotimg/src/utils/crypto.h

@@ -1,174 +0,0 @@
-/*
- * General cryptography helper functions and definitions
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_UTILS_CRYPTO_H
-#define PV_UTILS_CRYPTO_H
-
-#include <glib.h>
-#include <openssl/asn1.h>
-#include <openssl/bio.h>
-#include <openssl/bn.h>
-#include <openssl/ec.h>
-#include <openssl/ecdh.h>
-#include <openssl/evp.h>
-#include <openssl/ossl_typ.h>
-#include <openssl/rand.h>
-#include <openssl/safestack.h>
-#include <openssl/sha.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-#include <stdint.h>
-
-#include "common.h"
-#include "include/pv_crypto_def.h"
-#include "lib/zt_common.h"
-
-#include "buffer.h"
-
-#define AES_256_GCM_IV_SIZE  12
-#define AES_256_GCM_TAG_SIZE 16
-
-#define AES_256_XTS_TWEAK_SIZE 16
-#define AES_256_XTS_KEY_SIZE   64
-
-#define CRL_DOWNLOAD_TIMEOUT_MS 3000
-#define CRL_DOWNLOAD_MAX_SIZE	(1024 * 1024) /* in bytes */
-
-enum PvCryptoMode {
-	PV_ENCRYPT,
-	PV_DECRYPT,
-};
-
-typedef GSList HostKeyList;
-
-/* play nice with g_autoptr */
-typedef STACK_OF(DIST_POINT) STACK_OF_DIST_POINT;
-typedef STACK_OF(X509) STACK_OF_X509;
-typedef STACK_OF(X509_CRL) STACK_OF_X509_CRL;
-
-void STACK_OF_DIST_POINT_free(STACK_OF_DIST_POINT *stack);
-void STACK_OF_X509_free(STACK_OF_X509 *stack);
-void STACK_OF_X509_CRL_free(STACK_OF_X509_CRL *stack);
-
-typedef struct {
-	X509 *cert;
-	const gchar *path;
-} x509_with_path;
-
-x509_with_path *x509_with_path_new(X509 *cert, const gchar *path);
-void x509_with_path_free(x509_with_path *cert);
-
-typedef struct {
-	X509 *cert;
-	STACK_OF_X509_CRL *crls;
-} x509_pair;
-
-x509_pair *x509_pair_new(X509 **cert, STACK_OF_X509_CRL **crls);
-void x509_pair_free(x509_pair *pair);
-
-/* Register auto cleanup functions */
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(ASN1_INTEGER, ASN1_INTEGER_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(ASN1_OCTET_STRING, ASN1_OCTET_STRING_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(AUTHORITY_KEYID, AUTHORITY_KEYID_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIGNUM, BN_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BIO, BIO_free_all)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(BN_CTX, BN_CTX_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_GROUP, EC_GROUP_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_KEY, EC_KEY_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EC_POINT, EC_POINT_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_CIPHER_CTX, EVP_CIPHER_CTX_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_MD_CTX, EVP_MD_CTX_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_PKEY, EVP_PKEY_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(EVP_PKEY_CTX, EVP_PKEY_CTX_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(STACK_OF_DIST_POINT, STACK_OF_DIST_POINT_free);
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(STACK_OF_X509, STACK_OF_X509_free);
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(STACK_OF_X509_CRL, STACK_OF_X509_CRL_free);
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509, X509_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_CRL, X509_CRL_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_LOOKUP, X509_LOOKUP_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_NAME, X509_NAME_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(x509_pair, x509_pair_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_STORE, X509_STORE_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_STORE_CTX, X509_STORE_CTX_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(X509_VERIFY_PARAM, X509_VERIFY_PARAM_free)
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(x509_with_path, x509_with_path_free)
-
-union cmp_index {
-	struct {
-		uint16_t idx;
-		guchar rand[6];
-	} __packed;
-	uint64_t data;
-};
-
-/* The tweak is always stored in big endian format */
-union tweak {
-	struct {
-		union cmp_index cmp_idx;
-		uint64_t page_idx; /* page index */
-	} __packed;
-	uint8_t data[AES_256_XTS_TWEAK_SIZE];
-};
-
-struct cipher_parms {
-	const EVP_CIPHER *cipher;
-	const PvBuffer *key;
-	const PvBuffer *iv_or_tweak;
-};
-
-int check_crl_valid_for_cert(X509_CRL *crl, X509 *cert,
-			     gint verify_flags, GError **err);
-void pv_crypto_init(void);
-void pv_crypto_cleanup(void);
-gint verify_host_key(X509 *host_key, GSList *issuer_pairs,
-		     gint verify_flags, int level, GError **err);
-X509 *load_cert_from_file(const char *path, GError **err);
-X509_CRL *load_crl_from_file(const gchar *path, GError **err);
-GSList *load_certificates(const gchar *const *cert_paths, GError **err);
-STACK_OF_X509 *get_x509_stack(const GSList *x509_with_path_list);
-X509_STORE *store_setup(const gchar *root_ca_path,
-			const gchar * const *crl_paths,
-			GError **err);
-int store_set_verify_param(X509_STORE *store, GError **err);
-X509_CRL *load_crl_by_cert(X509 *cert, GError **err);
-STACK_OF_X509_CRL *try_load_crls_by_certs(GSList *certs_with_path);
-gint check_chain_parameters(const STACK_OF_X509 *chain, GError **err);
-X509_NAME *c2b_name(const X509_NAME *name);
-
-STACK_OF_X509 *delete_ibm_signing_certs(STACK_OF_X509 *certs);
-STACK_OF_X509_CRL *store_ctx_find_valid_crls(X509_STORE_CTX *ctx, X509 *cert,
-					     GError **err);
-X509_STORE_CTX *create_store_ctx(X509_STORE *trusted, STACK_OF_X509 *chain,
-				 GError **err);
-gint verify_cert(X509 *cert, X509_STORE_CTX *ctx, GError **err);
-X509_CRL *get_first_valid_crl(X509_STORE_CTX *ctx, X509 *cert, GError **err);
-void store_setup_crl_download(X509_STORE *st);
-EVP_PKEY *read_ec_pubkey_cert(X509 *cert, gint nid, GError **err);
-
-PvBuffer *compute_exchange_key(EVP_PKEY *cust, EVP_PKEY *host, GError **err);
-PvBuffer *generate_aes_key(guint size, GError **err);
-PvBuffer *generate_aes_iv(guint size, GError **err);
-EVP_PKEY *generate_ec_key(gint nid, GError **err);
-gint generate_tweak(union tweak *tweak, uint16_t i, GError **err);
-union ecdh_pub_key *evp_pkey_to_ecdh_pub_key(EVP_PKEY *key, GError **err);
-EVP_MD_CTX *digest_ctx_new(const EVP_MD *md, GError **err);
-PvBuffer *digest_ctx_finalize(EVP_MD_CTX *ctx, GError **err);
-PvBuffer *sha256_buffer(const PvBuffer *buf, GError **err);
-int64_t gcm_encrypt(const PvBuffer *in, const PvBuffer *aad,
-		    const struct cipher_parms *parms, PvBuffer *out,
-		    PvBuffer *tag, GError **err);
-gint encrypt_file(const struct cipher_parms *parms, const gchar *in_path,
-		  const gchar *path_out, gsize *in_size, gsize *out_size,
-		  GError **err);
-PvBuffer *encrypt_buf(const struct cipher_parms *parms, const PvBuffer *in,
-		      GError **err);
-G_GNUC_UNUSED PvBuffer *decrypt_buf(const struct cipher_parms *parms,
-				    const PvBuffer *in, GError **err);
-
-#endif

genprotimg/src/utils/curl.c

@@ -1,121 +0,0 @@
-/*
- * Libcurl utils
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <stdio.h>
-#include <glib.h>
-#include <glib/gtypes.h>
-#include <curl/curl.h>
-
-#include "lib/zt_common.h"
-#include "pv/pv_error.h"
-
-#include "curl.h"
-
-struct UserData {
-	GByteArray *buffer;
-	guint max_size;
-};
-
-static size_t write_callback(char *ptr, size_t size, size_t nmemb, void *userdata)
-{
-	g_assert(userdata);
-	struct UserData *data = (struct UserData *)userdata;
-	GByteArray *buffer = data->buffer;
-	guint64 actual_size;
-	size_t err;
-
-	g_assert(buffer);
-
-	if (!g_uint64_checked_mul(&actual_size, size, nmemb))
-		g_abort();
-
-	/* Signal an error condition by returning a amount that differs
-	 * from the amount passed to the callback. This results in a
-	 * CURLE_WRITE_ERROR.
-	 */
-	err = actual_size + 1;
-
-	if (actual_size > G_MAXUINT)
-		return err;
-
-	data->buffer = g_byte_array_append(buffer, (guchar *)ptr, (guint)actual_size);
-	if (data->buffer->len > data->max_size)
-		return err;
-
-	return actual_size;
-}
-
-gint curl_init(void)
-{
-	if (curl_global_init(CURL_GLOBAL_ALL) != 0)
-		return -1;
-	return 0;
-}
-
-void curl_cleanup(void)
-{
-	curl_global_cleanup();
-}
-
-GByteArray *curl_download(const gchar *url, long timeout_ms, guint max_size,
-			  GError **err)
-{
-	g_autoptr(GByteArray) ret = NULL;
-	g_autoptr(CURL) handle = NULL;
-	g_autofree gchar *agent = NULL;
-	struct UserData userdata;
-	CURLcode rc;
-
-	/* set up curl session */
-	handle = curl_easy_init();
-	if (!handle)
-		g_abort();
-
-	/* follow redirection */
-	rc = curl_easy_setopt(handle, CURLOPT_FOLLOWLOCATION, 1l);
-	if (rc != CURLE_OK)
-		goto curl_err;
-	rc = curl_easy_setopt(handle, CURLOPT_TIMEOUT_MS, timeout_ms);
-	if (rc != CURLE_OK)
-		goto curl_err;
-	rc = curl_easy_setopt(handle, CURLOPT_NOSIGNAL, 1l);
-	if (rc != CURLE_OK)
-		goto curl_err;
-	agent = g_strdup_printf("%s/%s", tool_name, RELEASE_STRING);
-	rc = curl_easy_setopt(handle, CURLOPT_USERAGENT, agent);
-	if (rc != CURLE_OK)
-		goto curl_err;
-	rc = curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_callback);
-	if (rc != CURLE_OK)
-		goto curl_err;
-	ret = g_byte_array_new();
-	userdata.buffer = ret;
-	userdata.max_size = max_size;
-	rc =  curl_easy_setopt(handle, CURLOPT_WRITEDATA, (void *)&userdata);
-	if (rc != CURLE_OK)
-		goto curl_err;
-	rc =  curl_easy_setopt(handle, CURLOPT_URL, url);
-	if (rc != CURLE_OK)
-		goto curl_err;
-
-	rc = curl_easy_perform(handle);
-	if (rc != CURLE_OK) {
-		g_set_error(err, PV_ERROR, PV_ERROR_DOWNLOAD_FAILED,
-			    _("download failed: %s"), curl_easy_strerror(rc));
-		return NULL;
-	}
-
-	return g_steal_pointer(&ret);
-curl_err:
-	g_set_error(err, PV_ERROR,
-		    PV_ERROR_CURL_INIT_FAILED,
-		    _("cURL initialization failed: %s"),
-		    curl_easy_strerror(rc));
-	return NULL;
-}

genprotimg/src/utils/curl.h

@@ -1,25 +0,0 @@
-/*
- * Libcurl utils
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_UTILS_LIBCURL_H
-#define PV_UTILS_LIBCURL_H
-
-#include <glib.h>
-#include <curl/curl.h>
-
-#include "common.h"
-
-WRAPPED_G_DEFINE_AUTOPTR_CLEANUP_FUNC(CURL, curl_easy_cleanup)
-
-GByteArray *curl_download(const gchar *url, long timeout_ms, guint max_size,
-			  GError **err);
-gint curl_init(void);
-void curl_cleanup(void);
-
-#endif /* PV_UTILS_LIBCURL_H */

genprotimg/src/utils/file_utils.c

@@ -1,234 +0,0 @@
-/*
- * General file utils
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <glib.h>
-#include <glib/gstdio.h>
-#include <limits.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "pv/pv_error.h"
-
-#include "align.h"
-#include "buffer.h"
-#include "common.h"
-#include "file_utils.h"
-
-FILE *file_open(const gchar *filename, const gchar *mode, GError **err)
-{
-	FILE *f = fopen(filename, mode);
-
-	if (!f) {
-		g_set_error(err, G_FILE_ERROR,
-			    (gint)g_file_error_from_errno(errno),
-			    _("Failed to open file '%s': %s"), filename,
-			    g_strerror(errno));
-		return NULL;
-	}
-
-	return f;
-}
-
-gint file_size(const gchar *filename, gsize *size, GError **err)
-{
-	GStatBuf st_buf;
-
-	g_assert(size);
-
-	if (g_stat(filename, &st_buf) != 0) {
-		g_set_error(err, G_FILE_ERROR,
-			    (gint)g_file_error_from_errno(errno),
-			    _("Failed to get file status '%s': %s"), filename,
-			    g_strerror(errno));
-		return -1;
-	}
-
-	if (!S_ISREG(st_buf.st_mode)) {
-		g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
-			    _("File '%s' is not a regular file"), filename);
-		return -1;
-	}
-
-	if (st_buf.st_size < 0) {
-		g_set_error(err, G_FILE_ERROR, PV_ERROR_INTERNAL,
-			    _("Invalid file size for '%s': %zu"), filename,
-			    st_buf.st_size);
-		return -1;
-	}
-
-	*size = (gsize)st_buf.st_size;
-	return 0;
-}
-
-/* Returns 0 on success, otherwise -1. Stores the total number of
- * elements successfully read in @count_read
- */
-gint file_read(FILE *in, void *ptr, gsize size, gsize count,
-	       gsize *count_read, GError **err)
-{
-	gsize tmp_count_read;
-
-	tmp_count_read = fread(ptr, size, count, in);
-	if (count_read)
-		*count_read = tmp_count_read;
-
-	if (ferror(in)) {
-		g_set_error(err, G_FILE_ERROR, 0, _("Failed to read file"));
-		return -1;
-	}
-
-	return 0;
-}
-
-gint file_write(FILE *out, const void *ptr, gsize size, gsize count,
-		gsize *count_written, GError **err)
-{
-	gsize tmp_count_written;
-
-	tmp_count_written = fwrite(ptr, size, count, out);
-	if (count_written)
-		*count_written = tmp_count_written;
-
-	if (tmp_count_written != count || ferror(out)) {
-		g_set_error(err, G_FILE_ERROR, 0, _("Failed to write file"));
-		return -1;
-	}
-
-	return 0;
-}
-
-static gint file_seek(FILE *f, uint64_t offset, GError **err)
-{
-	gint rc;
-
-	if (offset > LONG_MAX) {
-		g_set_error(err, PV_ERROR, 0, _("Offset is too large"));
-		return -1;
-	}
-
-	rc = fseek(f, (long)offset, SEEK_SET);
-	if (rc != 0) {
-		g_set_error(err, G_FILE_ERROR,
-			    (gint)g_file_error_from_errno(errno),
-			    _("Failed to seek: '%s'"), g_strerror(errno));
-		return -1;
-	}
-
-	return 0;
-}
-
-gint seek_and_write_file(FILE *o, const CompFile *ifile, uint64_t offset,
-			 GError **err)
-{
-	gsize bytes_read, bytes_written;
-	gsize total_bytes_read = 0;
-	FILE *i = NULL;
-	gchar buf[4096];
-	gint ret = -1;
-
-	if (file_seek(o, offset, err) < 0)
-		return -1;
-
-	i = file_open(ifile->path, "rb", err);
-	if (!i)
-		return -1;
-
-	do {
-		if (file_read(i, buf, 1, sizeof(buf), &bytes_read, err) < 0) {
-			g_prefix_error(err, _("Failed to read file '%s': "),
-				       ifile->path);
-			goto err;
-		}
-
-		if (bytes_read == 0)
-			break;
-
-		total_bytes_read += bytes_read;
-
-		if (file_write(o, buf, bytes_read, 1, &bytes_written, err) < 0)
-			goto err;
-	} while (bytes_written != 0);
-
-	if (ifile->size != total_bytes_read) {
-		g_set_error(err, PV_ERROR, PV_ERROR_INTERNAL,
-			    _("'%s' has changed during the preparation"),
-			    ifile->path);
-		goto err;
-	}
-
-	ret = 0;
-err:
-	fclose(i);
-	return ret;
-}
-
-gint seek_and_write_buffer(FILE *o, const PvBuffer *buf, uint64_t offset,
-			   GError **err)
-{
-	if (file_seek(o, offset, err) < 0)
-		return -1;
-
-	if (pv_buffer_write(buf, o, err) < 0)
-		return -1;
-
-	return 0;
-}
-
-gint pad_file_right(const gchar *path_out, const gchar *path_in, gsize *size_out,
-		    guint padding, GError **err)
-{
-	FILE *f_in, *f_out = NULL;
-	guchar buf[padding];
-	gsize num_bytes_written;
-	gsize num_bytes_read;
-	uint64_t size_in = 0;
-	gint ret = -1;
-
-	*size_out = 0;
-	f_in = file_open(path_in, "rb", err);
-	if (!f_in)
-		goto err;
-
-	f_out = file_open(path_out, "wb", err);
-	if (!f_out)
-		goto err;
-
-	do {
-		memset(buf, 0, sizeof(buf));
-
-		if (file_read(f_in, buf, 1, sizeof(buf), &num_bytes_read, err) < 0) {
-			g_prefix_error(err, _("Failed to read file '%s': "),
-				       path_in);
-			goto err;
-		}
-
-		size_in += num_bytes_read;
-
-		if (file_write(f_out, buf, 1, sizeof(buf), &num_bytes_written, err)) {
-			g_prefix_error(err, _("Failed to write file '%s': "),
-				       path_out);
-			goto err;
-		}
-
-		*size_out += num_bytes_written;
-	} while (num_bytes_read == padding);
-
-	g_assert(num_bytes_written == ALIGN(num_bytes_read, padding));
-
-	ret = 0;
-err:
-	if (f_out)
-		fclose(f_out);
-	if (f_in)
-		fclose(f_in);
-	return ret;
-}

genprotimg/src/utils/file_utils.h

@@ -1,34 +0,0 @@
-/*
- * General file utils
- *
- * Copyright IBM Corp. 2020
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_FILE_UTILS_H
-#define PV_FILE_UTILS_H
-
-#include <glib.h>
-#include <stdint.h>
-#include <stdio.h>
-
-#include "pv/pv_comp.h"
-
-#include "buffer.h"
-
-FILE *file_open(const gchar *filename, const gchar *mode, GError **err);
-gint file_size(const gchar *filename, gsize *size, GError **err);
-gint file_read(FILE *in, void *ptr, gsize size, gsize count,
-	       gsize *count_read, GError **err);
-gint file_write(FILE *out, const void *ptr, gsize size, gsize count,
-		gsize *count_written, GError **err);
-gint pad_file_right(const gchar *path_out, const gchar *path_in,
-		    gsize *size_out, guint padding, GError **err);
-gint seek_and_write_buffer(FILE *out, const PvBuffer *buf, uint64_t offset,
-			   GError **err);
-gint seek_and_write_file(FILE *o, const CompFile *ifile, uint64_t offset,
-			 GError **err);
-
-#endif

genprotimg/src/utils/openssl_compat.h

@@ -1,33 +0,0 @@
-/*
- * OpenSSL compatibility utils
- *
- * Copyright IBM Corp. 2021
- *
- * s390-tools is free software; you can redistribute it and/or modify
- * it under the terms of the MIT license. See LICENSE for details.
- */
-
-#ifndef PV_UTILS_OPENSSL_COMPAT_H
-#define PV_UTILS_OPENSSL_COMPAT_H
-
-#include <openssl/opensslv.h>
-#include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
-
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-#define Pv_X509_STORE_CTX_get_current_cert(ctx)                                \
-	X509_STORE_CTX_get_current_cert((X509_STORE_CTX *)(ctx))
-#define Pv_X509_STORE_CTX_get1_crls(ctx, nm)                                   \
-	X509_STORE_CTX_get1_crls((X509_STORE_CTX *)(ctx), (X509_NAME *)(nm))
-#define Pv_X509_STORE_set_lookup_crls(st, cb)                                  \
-	X509_STORE_set_lookup_crls(st, (X509_STORE_CTX_lookup_crls_fn)(cb))
-#else
-#define Pv_X509_STORE_CTX_get_current_cert(ctx)                                \
-	X509_STORE_CTX_get_current_cert(ctx)
-#define Pv_X509_STORE_CTX_get1_crls(ctx, nm)                                   \
-	X509_STORE_CTX_get1_crls(ctx, nm)
-#define Pv_X509_STORE_set_lookup_crls(st, cb)                                  \
-	X509_STORE_set_lookup_crls(st, cb)
-#endif
-
-#endif

hyptop/helper.c

@@ -25,6 +25,9 @@
 #include <time.h>
 #include <unistd.h>
 
+#include "lib/util_fmt.h"
+#include "lib/util_libc.h"
+
 #include "helper.h"
 #include "hyptop.h"
 #include "sd.h"
@@ -354,17 +357,6 @@ out:
 	ht_reverse_off();
 }
 
-/*
- * Convert string to uppercase
- */
-void ht_str_to_upper(char *str)
-{
-	while (*str) {
-		*str = toupper(*str);
-		str++;
-	}
-}
-
 /*
  * Convert ext TOD to microseconds
  */
@@ -412,3 +404,40 @@ s64 ht_calculate_smt_util(u64 core_us, u64 thr_us, u64 mgm_us, int thread_per_co
 
 	return smt_us;
 }
+
+/*
+ * Add two new key value pairs containing the current time as UNIX epoch and formatted string to a
+ * structured output object.
+ */
+void ht_fmt_time(void)
+{
+	struct timeval tv;
+	struct tm *tm;
+	char str[30];
+
+	gettimeofday(&tv, NULL);
+	tm = localtime(&tv.tv_sec);
+	if (!tm)
+		return;
+	util_fmt_pair(FMT_PERSIST, "time_epoch", "%lld", mktime(tm));
+	strftime(str, sizeof(str), "%F %T%z", tm);
+	util_fmt_pair(FMT_PERSIST | FMT_QUOTE, "time", "%s", str);
+}
+
+/*
+ * Add a new object for available CPU types to a structured output object.
+ */
+void ht_fmt_cpu_types(void)
+{
+	struct sd_cpu_type *cpu_type;
+	int i;
+
+	util_fmt_obj_start(FMT_DEFAULT, "cputypes");
+	sd_cpu_type_iterate(cpu_type, i) {
+		char *cpu_type_str = sd_cpu_type_id(cpu_type);
+		util_str_tolower(cpu_type_str);
+		util_fmt_pair(FMT_PERSIST, cpu_type_str, "%i",
+			      sd_cpu_type_cpu_cnt(cpu_type));
+	}
+	util_fmt_obj_end(); /* cpus{} */
+}

hyptop/helper.h

@@ -66,6 +66,12 @@ void ht_print_scroll_bar(int row_cnt, int row_start, int row_bar_start,
 			 int row_bar_bottom, int can_scroll_up,
 			 int can_scroll_down, int with_boder);
 
+/*
+ * util_fmt helper functions
+ */
+void ht_fmt_time(void);
+void ht_fmt_cpu_types(void);
+
 /*
  * Error Macros
  */

hyptop/hyptop.8

@@ -71,6 +71,51 @@ Use batch mode (no curses). This can be useful for sending output from hyptop
 to another program, a file, or a line mode terminal.
 In this mode no user input is accepted.
 .TP
+.BR "\-\-format=<FORMAT>"
+.RS
+Use this option to show output in a machine-readable format. FORMAT can be
+one of:
+
+.IP \(bu 3
+.B json:
+Single JavaScript Object Notation (JSON) data structure
+
+Data for all iterations is formatted as one JSON data structure in multiple
+lines to make them more readable by humans.
+.BR
+
+See section "OUTPUT FORMAT" for more details.
+.BR
+.PP
+.IP \(bu 3
+.B json\-seq:
+Sequence of JSON data structures
+
+Data for each iteration is formatted as a separate JSON data structure prefixed
+with an ASCII Record Separator character (0x1e) and suffixed with an ASCII Line
+Feed character (0x0a) in accordance with RFC7464.
+.BR
+
+See section "OUTPUT FORMAT" for more details.
+.BR
+.PP
+.IP \(bu 3
+.B pairs:
+Textual key=value pairs
+
+.PP
+.IP \(bu 3
+.B csv:
+Comma-separated-value (CSV) list
+.BR
+
+All values are enclosed in double quotation marks and separated by commas. The
+first line of output contains a list of headings. Subsequent lines each
+represent data for one system in one iteration.
+.PP
+This option implies the "\-\-batch_mode" option.
+.RE
+.TP
 .BR "\-d <SECONDS>" " or " "\-\-delay=<SECONDS>"
 Specifies the delay between screen updates.
 .TP
@@ -216,6 +261,196 @@ For the online time field, the value is the time during which at least
 one CPU has been operational.
 Operating CPUs are shown with CPU identifier "0" and stopped CPUs with "1".
 
+.SH OUTPUT FORMATS
+This section contains additional information for some of the supported
+output formats.
+
+.SS json
+
+JSON output consists of a top-level object with the following properties
+(key-value pairs):
+
+.IP \(bu 3
+.BR meta :
+Tool meta-data including API level, version, host name, and time of invocation
+.PP
+.IP \(bu 3
+.BR hyptop :
+Hypervisor performance data
+.PP
+
+Performance data is stored as an array of iteration objects under the "hyptop"
+property in the top-level object. Iteration objects contain the following properties:
+
+.IP \(bu 3
+.BR iteration :
+sequential count of the current iteration
+.PP
+.IP \(bu 3
+.BR "time" " and " "time_epoch" :
+time when the iteration was recorded, in human-readable format and as Unix
+epoch.
+.PP
+.IP \(bu 3
+.BR cputypes :
+contains the number of CPUs hyptop detected, per CPU type. Possible properties
+are
+.BR "cp" ", " "ifl" " and " "un".
+.PP
+.IP \(bu 3
+.BR systems :
+when the "sys_list" window is selected, contains an array of system objects
+that contain the performance data per system. Each system object contains a
+"system" property and properties for its performance data (see below).
+.PP
+.IP \(bu 3
+.BR cpus :
+when the "sys" window is selected, contains an array of CPU objects
+that contain the performance data per CPU of the selected system. Each CPU
+object contains a "coreid" property and properties for its performance data
+(see below).
+.PP
+.IP \(bu 3
+.BR summary :
+contains aggregated performance data over all systems in the "systems" or
+"cpus" array.
+.PP
+
+All performance data available for the platform (LPAR, z/VM) hyptop is executed
+on is shown. Selecting specific fields with \-\-fields is not supported but it
+is possible to change the units of fields. Properties for performance data are
+labeled after their respective columns.
+
+Example JSON output for a single iteration:
+.br
+
+.RS
+{
+.br
+  "meta": {
+.br
+    "api_level": 1,
+.br
+    "version": "2.35.0",
+.br
+    "host": "mylpar.local",
+.br
+    "time_epoch": 1730787834,
+.br
+    "time": "2024-11-05 07:23:54+0100"
+.br
+  },
+.br
+  "hyptop": [
+.br
+    {
+.br
+      "iteration": 0,
+.br
+      "time_epoch": 1730787834,
+.br
+      "time": "2024-11-05 07:23:54+0100",
+.br
+      "cputypes": {
+.br
+        "ifl": 124,
+.br
+        "cp": 1,
+.br
+        "un": 0
+.br
+      },
+.br
+      "systems": [
+.br
+        {
+.br
+          "system": "MYLPAR",
+.br
+          "#core": 30,
+.br
+          "#the": 60,
+.br
+          "core": 379.57,
+.br
+          "the": 382.43,
+.br
+          "smt": 294.73,
+.br
+          "mgm": 2.09,
+.br
+          "core+": "1503:13",
+.br
+          "the+": "2060:45",
+.br
+          "mgm+": "22:19",
+.br
+          "online": "18:18:09"
+.br
+        }
+.br
+      ],
+.br
+      "summary": {
+.br
+        "#core": 30,
+.br
+        "#the": 60,
+.br
+        "core": 379.57,
+.br
+        "the": 382.43,
+.br
+        "smt": 294.73,
+.br
+        "mgm": 2.09,
+.br
+        "core+": "1503:13",
+.br
+        "the+": "2060:45",
+.br
+        "mgm+": "22:19",
+.br
+        "online": "18:18:09"
+.br
+      }
+.br
+    }
+.br
+  ]
+.br
+}
+.br
+.RE
+
+.SS json\-seq
+
+The json\-seq output format is a variation of the JSON output format described
+above with the following differences:
+
+.IP \(bu 3
+Output consists of a sequence of top-level JSON objects, each contained in
+single line with no indentation
+.br
+
+.IP \(bu 3
+Each top-level object is prefixed by an ASCII Record Separator character (0x1e)
+and suffixed with an ASCII Line Feed character (0x0a) in accordance with
+RFC7464
+.br
+.PP
+
+.IP \(bu 3
+The first object contains tool meta-data properties defined in the previous
+section
+.br
+.PP
+
+.IP \(bu 3
+Subsequent objects each represent performance data for one iteration
+.br
+.PP
+
 .SH EXAMPLES
 To start hyptop with the "sys_list" window in interactive mode, enter:
 .br
@@ -258,6 +493,14 @@ for CPU time calculation, enter:
 
   # hyptop -t ifl,cp
 
+.br
+To show a single iteration of performance data as a formatted JSON object for
+system "MYLPAR" and with fields CPU time, thread time, management time and
+online time in microseconds, enter:
+.br
+
+  # hyptop -f C:us,E:us,M:us,o:us --format json -n 1 -s MYLPAR
+
 .SH ENVIRONMENT
 .TP
 .B TERM

hyptop/hyptop.c

@@ -18,6 +18,8 @@
 #include <sys/types.h>
 #include <time.h>
 
+#include "lib/util_fmt.h"
+
 #include "dg_debugfs.h"
 #include "helper.h"
 #include "hyptop.h"
@@ -218,6 +220,22 @@ static void l_term_check(void)
 			" try \"--batch_mode\"\n");
 }
 
+/*
+ * Init util_fmt if --format is specified on the command line.
+ */
+static void l_fmt_init(void)
+{
+	unsigned int flags = FMT_WARN;
+
+	if (!g.o.format_specified)
+		return;
+	if (g.o.format == FMT_CSV)
+		flags |= FMT_QUOTEALL;
+	if (g.o.format == FMT_JSON || g.o.format == FMT_JSONSEQ)
+		flags |= FMT_HANDLEINT;
+	util_fmt_init(stdout, g.o.format, flags, 1);
+}
+
 /*
  * Init curses
  */
@@ -296,7 +314,6 @@ static void l_update_term_curses(void)
 static void l_update_term_batch(void)
 {
 	g.w.cur->update_term(g.w.cur);
-	printf("\n");
 }
 
 /*
@@ -360,6 +377,7 @@ void __noreturn hyptop_exit(int rc)
 int main(int argc, char *argv[])
 {
 	opts_parse(argc, argv);
+	l_fmt_init();
 	hyptop_helper_init();
 	sd_init();
 	l_dg_init();

hyptop/hyptop.h

@@ -17,6 +17,8 @@
 #include <stdlib.h>
 #include <termios.h>
 
+#include "lib/util_fmt.h"
+
 #include "helper.h"
 #include "nav_desc.h"
 #include "table.h"
@@ -52,6 +54,8 @@ struct hyptop_win_opts {
 struct hyptop_opts {
 	unsigned int			win_specified;
 	unsigned int			batch_mode_specified;
+	unsigned int			format_specified;
+	enum util_fmt_t			format;
 	unsigned int			iterations_specified;
 	unsigned int			iterations;
 	unsigned int			iterations_act;

hyptop/opts.c

@@ -12,6 +12,8 @@
 #include <ctype.h>
 #include <stdio.h>
 
+#include "lib/util_fmt.h"
+#include "lib/util_libc.h"
 #include "lib/zt_common.h"
 
 #include "getopt.h"
@@ -19,6 +21,7 @@
 #include "hyptop.h"
 #include "opts.h"
 #include "sd.h"
+#include "table.h"
 
 static const char l_copyright_str[] = "Copyright IBM Corp. 2010, 2017";
 
@@ -38,10 +41,16 @@ static char HELP_TEXT[] =
 "-S, --sort LETTER               Sort field for current window\n"
 "-t, --cpu_types TYPE[,..]       CPU types used for time calculations\n"
 "-b, --batch_mode                Use batch mode (no curses)\n"
+"    --format FORMAT             Output format (" FMT_TYPE_NAMES "), implies -b\n"
 "-d, --delay SECONDS             Delay time between screen updates\n"
 "-m, --smt_factor FACTOR         Machine generation dependent SMT speedup factor.\n"
 "-n, --iterations NUMBER         Number of iterations before ending\n";
 
+/*
+ * Options with long-name only
+ */
+#define OPT_FORMAT	256 /* --format */
+
 /*
  * Initialize default settings
  */
@@ -287,6 +296,23 @@ static void l_batch_mode_set(void)
 	g.o.batch_mode_specified = 1;
 }
 
+/*
+ * Set the "--format" option
+ */
+static void l_format_set(const char *str)
+{
+	enum util_fmt_t fmt;
+
+	if (!util_fmt_name_to_type(str, &fmt)) {
+		ERR_EXIT("Unknown format '%s', supported formats: "
+			 FMT_TYPE_NAMES "\n", str);
+	}
+
+	l_batch_mode_set();
+	g.o.format_specified = 1;
+	g.o.format = fmt;
+}
+
 /*
  * Make option consisteny checks at end of command line parsing
  */
@@ -322,6 +348,7 @@ void opts_parse(int argc, char *argv[])
 		{ "fields",      required_argument, NULL, 'f'},
 		{ "sort_field",  required_argument, NULL, 'S'},
 		{ "cpu_types",   required_argument, NULL, 't'},
+		{ "format",      required_argument, NULL, OPT_FORMAT },
 		{ NULL,          0,                 NULL, 0  }
 	};
 	static const char option_string[] = "vhbd:m:w:s:n:f:t:S:";
@@ -366,6 +393,9 @@ void opts_parse(int argc, char *argv[])
 		case 'S':
 			l_sort_field_set(optarg);
 			break;
+		case OPT_FORMAT:
+			l_format_set(optarg);
+			break;
 		default:
 			l_std_usage_exit();
 		}
@@ -404,7 +434,7 @@ static void l_verify_systems(struct hyptop_win *win)
 		if (sd_sys_get(sd_sys_root_get(), win->opts.sys.vec[i]))
 			continue;
 		sys_name = ht_strdup(win->opts.sys.vec[i]);
-		ht_str_to_upper(win->opts.sys.vec[i]);
+		util_str_toupper(win->opts.sys.vec[i]);
 		if (sd_sys_get(sd_sys_root_get(), win->opts.sys.vec[i])) {
 			ht_free(sys_name);
 			continue;
@@ -431,11 +461,11 @@ void opts_iterations_next(void)
 {
 	if (g.o.iterations_specified) {
 		g.o.iterations_act++;
-		if (g.o.iterations_act >= g.o.iterations)
+		if (g.o.iterations_act >= g.o.iterations) {
+			if (g.o.format_specified)
+				table_fmt_end();
 			hyptop_exit(0);
+		}
 	}
-	if (g.o.batch_mode_specified)
-		printf("---------------------------------------------------"
-		       "----------------------------\n");
 }
 

hyptop/table.c

@@ -16,6 +16,9 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "lib/util_fmt.h"
+#include "lib/util_libc.h"
+
 #include "helper.h"
 #include "hyptop.h"
 #include "table.h"
@@ -196,8 +199,8 @@ static void l_col_headline_init(struct table *t, struct table_col *col)
 	col->p->head_char[0] = col->hotkey;
 	strcpy(col->p->head_last, ++ptr);
 	if (!t->attr_sorted_table) {
-		ht_str_to_upper(col->p->head_first);
-		ht_str_to_upper(col->p->head_last);
+		util_str_toupper(col->p->head_first);
+		util_str_toupper(col->p->head_last);
 		col->p->head_char[0] = toupper(col->p->head_char[0]);
 	}
 }
@@ -948,6 +951,76 @@ static void l_table_print_all(struct table *t)
 		hyptop_print_nl();
 	}
 	l_row_print(t, t->row_last);
+	hyptop_print_nl();
+	hyptop_printf("------------------------------------------------------"
+		      "-------------------------\n");
+}
+
+/*
+ * Print one table row as structured output
+ *
+ * Note: column filtering and sorting is explicitly ignored because the
+ * assumption is that these operations can be trivially performed by the
+ * consumer.
+ */
+static void l_row_print_formatted(struct table *t, struct table_row *row)
+{
+	struct table_col *col;
+	int col_nr;
+
+	table_col_iterate(t, col, col_nr) {
+		unsigned int flags = 0;
+		struct table_entry *e = &row->entries[col_nr];
+
+		if (row == t->row_last && col_nr == 0)
+			continue;
+		if (table_col_needs_quotes(col))
+			flags = FMT_QUOTE;
+		util_fmt_pair(flags, col->head, "%s", e->str);
+	}
+}
+
+/*
+ * Print table as structured output
+ */
+static void l_table_print_all_formatted(struct table *t)
+{
+	struct table_row *row;
+
+	util_fmt_obj_start(FMT_ROW, "iteration");
+	util_fmt_pair(FMT_PERSIST, "iteration", "%u", g.o.iterations_act);
+	ht_fmt_time();
+	ht_fmt_cpu_types();
+	if (strcmp(g.o.cur_win->id, "sys_list") == 0)
+		util_fmt_obj_start(FMT_LIST, "systems");
+	else
+		util_fmt_obj_start(FMT_LIST, "cpus");
+	util_list_iterate(&t->row_list, row) {
+		util_fmt_obj_start(FMT_ROW, "entry");
+		l_row_print_formatted(t, row);
+		util_fmt_obj_end(); /* entry */
+	}
+	util_fmt_obj_end(); /* systems[] */
+	util_fmt_obj_start(FMT_DEFAULT, "summary");
+	l_row_print_formatted(t, t->row_last);
+	util_fmt_obj_end(); /* summary{} */
+	util_fmt_obj_end(); /* iteration */
+}
+
+void table_fmt_start(void)
+{
+	if (!g.o.format_specified)
+		return;
+	if (g.o.format != FMT_JSONSEQ)
+		util_fmt_obj_start(FMT_LIST, "hyptop");
+}
+
+void table_fmt_end(void)
+{
+	if (!g.o.format_specified)
+		return;
+	if (g.o.format != FMT_JSONSEQ)
+		util_fmt_obj_end(); /* hyptop[] */
 }
 
 /*
@@ -955,10 +1028,14 @@ static void l_table_print_all(struct table *t)
  */
 void table_print(struct table *t)
 {
-	if (g.o.batch_mode_specified)
-		l_table_print_all(t);
-	else
+	if (g.o.batch_mode_specified) {
+		if (!g.o.format_specified)
+			l_table_print_all(t);
+		else
+			l_table_print_all_formatted(t);
+	} else {
 		l_table_print_curses(t);
+	}
 }
 
 /*

hyptop/table.h

@@ -106,6 +106,7 @@ struct table_col_priv {
 	char		head_char[2];
 	char		head_last[TABLE_HEADING_SIZE];
 	int		rsort;
+	int		needs_quotes;
 };
 
 /*
@@ -135,6 +136,11 @@ static inline int table_col_enabled(struct table_col *col)
 	return col->p->enabled;
 }
 
+static inline int table_col_needs_quotes(struct table_col *col)
+{
+	return col->p->needs_quotes;
+}
+
 /*
  * Table Column Constructor Macros
  */
@@ -384,6 +390,9 @@ extern struct table_row *table_row_alloc(struct table *t);
 extern void table_scroll_down(struct table *t, enum table_scroll_unit unit);
 extern void table_scroll_up(struct table *t, enum table_scroll_unit unit);
 
+extern void table_fmt_start(void);
+extern void table_fmt_end(void);
+
 /*
  * Entry add functions
  */

hyptop/table_col_unit.c

@@ -63,7 +63,7 @@ static int l_unit_raw(struct table_col *col, struct table_entry *e)
  */
 static int l_str(struct table_col *col, struct table_entry *e)
 {
-	(void) col;
+	col->p->needs_quotes = 1;
 	return strlen(e->str);
 }
 
@@ -226,6 +226,8 @@ static int l_unit_hm_u64(char *str, u64 v1, int negative)
 
 static int l_unit_hm(struct table_col *col, struct table_entry *e)
 {
+	col->p->needs_quotes = 1;
+
 	if (!e->set)
 		return snprintf(e->str, sizeof(e->str), L_COL_NOT_SET_STR);
 
@@ -272,6 +274,8 @@ static int l_unit_dhm_u64(char *str, u64 v1, int negative)
 
 static int l_unit_dhm(struct table_col *col, struct table_entry *e)
 {
+	col->p->needs_quotes = 1;
+
 	if (!e->set)
 		return snprintf(e->str, sizeof(e->str), L_COL_NOT_SET_STR);
 

hyptop/win_sys.c

@@ -162,7 +162,8 @@ static void l_cpu_add(struct sd_cpu *cpu)
 			continue;
 		l_cpu_item_add(table_row, cpu, item);
 	}
-	l_cpu_add_visual(table_row, cpu);
+	if (!g.o.format_specified)
+		l_cpu_add_visual(table_row, cpu);
 	table_row_add(l_t, table_row);
 }
 
@@ -194,7 +195,8 @@ static void l_table_update_term(struct hyptop_win *win)
 {
 	(void) win;
 
-	ht_print_head(l_sys_id);
+	if (!g.o.format_specified)
+		ht_print_head(l_sys_id);
 	table_print(l_t);
 }
 
@@ -300,6 +302,7 @@ static void l_run(struct hyptop_win *win)
 
 	/* Reformat table when entering window */
 	table_rebuild(l_t);
+	table_fmt_start();
 	while (1) {
 		if (l_table_create()) {
 			if (g.o.batch_mode_specified)
@@ -363,9 +366,11 @@ void win_sys_init(void)
 		col_vec[i] = col;
 		col_desc_vec[i] = item->desc;
 	}
-	col_vec[i] = &l_vis_col;
-	col_desc_vec[i] = vis_str;
-	table_col_add(l_t, &l_vis_col);
+	if (!g.o.format_specified) {
+		col_vec[i] = &l_vis_col;
+		col_desc_vec[i] = vis_str;
+		table_col_add(l_t, &l_vis_col);
+	}
 
 	/* Enable fields */
 	if (win_sys.opts.fields.specified)

hyptop/win_sys_list.c

@@ -206,7 +206,8 @@ static void l_table_update_term(struct hyptop_win *win)
 {
 	(void) win;
 
-	ht_print_head(NULL);
+	if (!g.o.format_specified)
+		ht_print_head(NULL);
 	table_print(l_t);
 }
 
@@ -310,6 +311,7 @@ static void l_run(struct hyptop_win *win)
 
 	/* Reformat table when entering window */
 	table_rebuild(l_t);
+	table_fmt_start();
 	while (1) {
 		l_table_create();
 		hyptop_update_term();

include/boot/loaders_layout.h

@@ -21,19 +21,19 @@
 
 #define STAGE2_DESC			_AC(0x78, UL)
 #define STAGE2_ENTRY			_AC(0x2018, UL)
+#define ECKD2DUMP_MV_TAIL_ADDRESS	_AC(0x6000, UL)
 #define STAGE2_HEAP_ADDRESS		_AC(0x6000, UL)
-#define ECKD2DUMP_SV_HEAP_ADDRESS	_AC(0xb000, UL)
+#define ECKD2DUMP_HEAP_ADDRESS		_AC(0xb000, UL)
 #define STAGE2_HEAP_SIZE		_AC(0x3000, UL)
 #define STAGE2_STACK_ADDRESS		_AC(0xe400, UL)
 #define STAGE2_STACK_SIZE		_AC(0x1c00, UL)
-#define ECKD2DUMP_SV_STACK_ADDRESS	_AC(0xe000, UL)
-#define ECKD2DUMP_SV_STACK_SIZE		_AC(0x2000, UL)
+#define ECKD2DUMP_STACK_ADDRESS		_AC(0xe000, UL)
+#define ECKD2DUMP_STACK_SIZE		_AC(0x2000, UL)
 #define STAGE2_MAX_SIZE			_AC(0x3000, UL)
 
-#define STAGE2_DUMPER_SIZE_V1		_AC(0x1000, UL)
-#define STAGE2_DUMPER_SIZE_V2		_AC(0x2000, UL)
-#define STAGE2_DUMPER_SIZE_V3		_AC(0x3000, UL)
-#define STAGE2_DUMPER_SIZE_ZLIB		_AC(0x8000, UL)
+#define STAGE2_DUMPER_SIZE_SV		_AC(0x3000, UL)
+#define STAGE2_DUMPER_SIZE_MV		_AC(0x4000, UL)
+#define STAGE2_DUMPER_SIZE_SV_ZLIB	_AC(0x8000, UL)
 
 #define STAGE3_ENTRY			_AC(0xa000, UL)
 

include/dump/s390_dump.h

@@ -27,16 +27,9 @@
 #define DF_S390_CPU_MAX		512
 #define DF_S390_MAGIC_BLK_ECKD	3
 #define DF_S390_DUMPER_MAGIC_SIZE	7
-#define DF_S390_DUMPER_MAGIC32		"ZECKD31"
-#define DF_S390_DUMPER_MAGIC64		"ZECKD64"
 #define DF_S390_DUMPER_MAGIC_EXT	"XECKD64"
-#define DF_S390_DUMPER_MAGIC32_FBA	"ZDFBA31"
-#define DF_S390_DUMPER_MAGIC64_FBA	"ZDFBA64"
 #define DF_S390_DUMPER_MAGIC_FBA_EXT	"XDFBA64"
-#define DF_S390_DUMPER_MAGIC_MV		"ZMULT64"
 #define DF_S390_DUMPER_MAGIC_MV_EXT	"XMULT64"
-#define OLD_DUMPER_HEX_INSTR1 "\x0d\x10\x47\xf0" /* BASR + 1st halfword of BC */
-#define OLD_DUMPER_HEX_INSTR2 "\x0d\xd0" /* BASR 13,0 */
 
 /*
  * Architecture of dumped system

include/lib/libcpumf.h

@@ -10,16 +10,35 @@
 #include <sched.h>
 #include <stdbool.h>
 
-#define	S390_CPUMF_CF		"/sys/devices/cpum_cf/"
-#define	S390_CPUMF_CFDIAG	"/sys/devices/cpum_cf_diag/"
-#define	S390_CPUMF_SF		"/sys/devices/cpum_sf/"
-#define S390_CPUS_POSSIBLE	"/sys/devices/system/cpu/possible"
-#define S390_CPUS_ONLINE	"/sys/devices/system/cpu/online"
-#define S390_CPUMSF_BUFFERSZ	"/sys/module/kernel/parameters/cpum_sfb_size"
-#define S390_SYSFS_PAI_CRYPTO	"/sys/devices/pai_crypto/"
-#define S390_SYSFS_PAI_EXT	"/sys/devices/pai_ext/"
+#define	S390_CPUMF_CF		"devices/cpum_cf/"
+#define	S390_CPUMF_CFDIAG	"devices/cpum_cf_diag/"
+#define	S390_CPUMF_SF		"devices/cpum_sf/"
+#define S390_CPUS_ONLINE	"devices/system/cpu/online"
+#define S390_CPUMSF_BUFFERSZ	"module/kernel/parameters/cpum_sfb_size"
+#define S390_SYSFS_PAI_CRYPTO	"devices/pai_crypto/"
+#define S390_SYSFS_PAI_EXT	"devices/pai_ext/"
 #define S390_SYSFS_PAI_NNPA	S390_SYSFS_PAI_EXT "events/NNPA_ALL"
 
+#define CPUMF_CTRSET_NONE		0
+#define CPUMF_CTRSET_EXTENDED		1
+#define CPUMF_CTRSET_BASIC		2
+#define CPUMF_CTRSET_PROBLEM_STATE	4
+#define CPUMF_CTRSET_CRYPTO		8
+#define CPUMF_CTRSET_MT_DIAG		32
+
+/**
+ * Return counter set a counter belongs to.
+ *
+ * Return the counter set a given counter belongs to, given the
+ * CPU Measurement facility counter version first and second number.
+ *
+ * @param[in]    ctr   Counter number
+ * @param[in]    cfvn  CPUM Counter facility first version number
+ * @param[in]    csvn  CPUM Counter facility second version number
+ * @retval       >=0   Counter set number to counter belongs to
+ */
+int libcpumf_ctrset(int ctr, int cfvn, int csvn);
+
 /**
  * Read out the PMU type from a given file.
  *

include/lib/pci_list.h

@@ -0,0 +1,99 @@
+/**
+ * @defgroup pci_list_h libzpci: zPCI device handling
+ * @{
+ * @brief Work with zPCI devices
+ *
+ * Copyright IBM Corp. 2024
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef LIB_ZPCI_PCI_LIST_H
+#define LIB_ZPCI_PCI_LIST_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include "util_list.h"
+
+enum zpci_pft {
+	ZPCI_PFT_UNCLASSIFIED = 0x00,
+
+	ZPCI_PFT_ROCE_EXPRESS = 0x02,
+	ZPCI_PFT_ROCE_EXPRESS2 = 0x0a,
+	ZPCI_PFT_CNW = 0x0d,
+	ZPCI_PFT_NETH =	0x0c,
+	ZPCI_PFT_NETD = 0x0f,
+
+	ZPCI_PFT_NVME = 0x0b,
+	ZPCI_PFT_ISM = 0x05
+};
+
+/*
+ * Follows RFC 2863 operational states with the
+ * numeric values from IF_OPER_* in linux/if.h:
+ */
+typedef uint8_t operstate_t;
+
+struct zpci_netdev {
+	char *name;
+	operstate_t operstate;
+};
+
+struct zpci_dev {
+	struct util_list_node entry;
+	/* PCI Domain */
+	uint32_t domain_nr;
+	/* PCI Bus (8 bits), Device (5 bits), Function (3 bits) */
+	union {
+		uint16_t val;
+		struct {
+			uint16_t bus : 8;
+			uint16_t dev : 5;
+			uint16_t fn : 3;
+		};
+	} bdf;
+
+	/* Function attributes (see linux/Documentation/arch/s390/pci.rst) */
+	uint32_t fid;
+	uint32_t uid;
+	uint16_t pchid;
+	uint16_t vfn;
+	uint8_t port;
+	enum zpci_pft pft;
+	bool uid_is_unique;
+	/* Configuration state 0 - Standby, 1 Configured */
+	bool conf;
+
+	/* Associated netdevs if any */
+	int num_netdevs;
+	struct zpci_netdev *netdevs;
+};
+
+/**
+ * Get if a PCI device is a PCI Virtual Function
+ *
+ * @param[in]	zdev	The device in question
+ *
+ * @return true if the device is a VF false otherwise
+ */
+static inline bool zpci_is_vf(struct zpci_dev *zdev)
+{
+	return !!zdev->vfn;
+}
+
+struct util_list *zpci_dev_list(void);
+void zpci_free_dev_list(struct util_list *zpci_list);
+void zpci_free_dev(struct zpci_dev *zdev);
+
+char *zpci_pci_addr(struct zpci_dev *zdev);
+const char *zpci_pft_str(struct zpci_dev *zdev);
+
+const char *zpci_operstate_str(operstate_t state);
+operstate_t zpci_operstate_from_str(const char *oper_str);
+
+struct zpci_dev *zpci_find_by_netdev(struct util_list *zpci_list, char *netdev_name,
+				     struct zpci_netdev **netdev);
+
+#endif /* LIB_ZPCI_PCI_LIST_H */

include/lib/pci_sclp.h

@@ -0,0 +1,56 @@
+/**
+ * @defgroup pci_sclp_h libzpci: zPCI device handling
+ * @{
+ * @brief Issue SCLPs for zPCI devices
+ *
+ * Copyright IBM Corp. 2024
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef LIB_ZPCI_PCI_SCLP_H
+#define LIB_ZPCI_PCI_SCLP_H
+
+#include <linux/types.h>
+#include <stddef.h>
+
+#include "lib/zt_common.h"
+
+#define SCLP_ERRNOTIFY_AQ_RESET			0
+#define SCLP_ERRNOTIFY_AQ_DECONF		1
+#define SCLP_ERRNOTIFY_AQ_REPORT_ERR		2
+#define SCLP_ERRNOTIFY_AQ_OPTICS_DATA		3
+
+#define SCLP_ERRNOTIFY_ID_ZPCICTL		0x4713
+#define SCLP_ERRNOTIFY_ID_OPTICSMON		0x4714
+
+#define SCLP_ERRNOTIFY_DATA_SIZE		4054
+
+struct zpci_report_error_header {
+	__u8 version;	/* Interface version byte */
+	__u8 action;	/* Action qualifier byte
+			 * 0: Adapter Reset Request
+			 * 1: Deconfigure and repair action requested
+			 * 2: Informational Report
+			 * 3: Optics Data
+			 */
+	__u16 length;	/* Length of Subsequent Data (up to 4K – SCLP header) */
+} __packed;
+
+struct zpci_report_error_data {
+	__u64 timestamp;
+	__u64 err_log_id;
+	/* We cannot exceed a total of 4074 bytes (header + data) */
+	char log_data[SCLP_ERRNOTIFY_DATA_SIZE];
+} __packed;
+
+struct zpci_report_error {
+	struct zpci_report_error_header header;
+	struct zpci_report_error_data data;
+} __packed;
+
+int zpci_sclp_issue_action(char *pci_addr, int action,
+			   char *data, size_t length, u64 err_log_id);
+
+#endif /* LIB_ZPCI_PCI_SCLP_H */

include/lib/util_arch.h

@@ -28,6 +28,8 @@ enum util_arch_machine_type {
 	UTIL_ARCH_MACHINE_TYPE_Z15_T02	= 8562,
 	UTIL_ARCH_MACHINE_TYPE_Z16	= 3931,
 	UTIL_ARCH_MACHINE_TYPE_Z16_A02	= 3932,
+	UTIL_ARCH_MACHINE_TYPE_Z17	= 9175,
+	UTIL_ARCH_MACHINE_TYPE_Z17_2	= 9176,
 };
 
 int util_arch_machine_type(void);

include/lib/util_file.h

@@ -11,6 +11,8 @@
 #ifndef LIB_UTIL_FILE_H
 #define LIB_UTIL_FILE_H
 
+#include <stdio.h>
+
 #include "lib/util_exit_code.h"
 
 int util_file_read_line(char *str, size_t size, const char *fmt, ...);

include/lib/util_libc.h

@@ -129,6 +129,7 @@ int __util_vsprintf(const char *func, const char *file, int line,
 char *util_strcat_realloc(char *str1, const char *str2);
 void util_concatf(char **str1, const char *fmt, ...);
 void util_str_toupper(char *str);
+void util_str_tolower(char *str);
 
 char *util_strstrip(char *s);
 size_t util_strlcpy(char *dest, const char *src, size_t size);

include/lib/util_proc.h

@@ -14,7 +14,6 @@
 #include <ctype.h>
 #include <sys/types.h>
 
-
 struct util_proc_part_entry {
 	dev_t device;
 	size_t blockcount;
@@ -27,6 +26,13 @@ struct util_proc_dev_entry {
 	char *name;
 };
 
+#define UTIL_PROC_DEV_ENTRY_DASD     "dasd"
+#define UTIL_PROC_DEV_ENTRY_VIRTBLK  "virtblk"
+#define UTIL_PROC_DEV_ENTRY_SD       "sd"
+#define UTIL_PROC_DEV_ENTRY_BLKEXT   "blkext"
+#define UTIL_PROC_DEV_ENTRY_MD       "md"
+#define UTIL_PROC_DEV_ENTRY_DM       "device-mapper"
+
 int util_proc_part_get_entry(dev_t device, struct util_proc_part_entry *entry);
 void util_proc_part_free_entry(struct util_proc_part_entry *entry);
 int util_proc_dev_get_entry(dev_t dev, int blockdev,

ipl_tools/ccw.c

@@ -9,7 +9,6 @@
  * it under the terms of the MIT license. See LICENSE for details.
  */
 
-#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -49,19 +48,19 @@ static int device_sysfs_path(const char *device, char *path, const size_t path_s
  */
 int ccw_is_device(const char *busid)
 {
-	char path[PATH_MAX];
+	static const char *const driver_paths[] = { "dasd-eckd", "virtio_ccw", "dasd-fba" };
+	char *path;
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(driver_paths); i++) {
+		path = util_path_sysfs("bus/ccw/drivers/%s/%s", driver_paths[i], busid);
+		if (access(path, R_OK) == 0) {
+			free(path);
+			return 1;
+		}
+		free(path);
+	}
 
-	snprintf(path, sizeof(path),
-		 "/sys/bus/ccw/drivers/dasd-eckd/%s", busid);
-	if (access(path, R_OK) == 0)
-		return 1;
-	snprintf(path, sizeof(path),
-		 "/sys/bus/ccw/drivers/virtio_ccw/%s", busid);
-	if (access(path, R_OK) == 0)
-		return 1;
-	snprintf(path, sizeof(path), "/sys/bus/ccw/drivers/dasd-fba/%s", busid);
-	if (access(path, R_OK) == 0)
-		return 1;
 	return 0;
 }
 
@@ -72,6 +71,7 @@ int ccw_is_virtio_device(const char *device)
 {
 	char path[PATH_MAX] = { '\0' };
 	unsigned virtio = 0;
+	char *path_pattern;
 
 	if (device_sysfs_path(device, path, sizeof(path)) != 0)
 		return -1;
@@ -80,76 +80,37 @@ int ccw_is_virtio_device(const char *device)
 	 * The output has the following format:
 	 * /sys/devices/css0/0.0.0000/0.0.0000/virtio0/block/vda
 	 */
-	if (sscanf(path, "/sys/devices/css0/%*[0-9a-f.]/%*[0-9a-f.]/virtio%u", &virtio) != 1)
+	path_pattern = util_path_sysfs("devices/css0/%%*[0-9a-f.]/%%*[0-9a-f.]/virtio%%u");
+	if (sscanf(path, path_pattern, &virtio) != 1) {
+		free(path_pattern);
 		return -1;
+	}
+	free(path_pattern);
 	return 0;
 }
 
 /*
- * Return CCW Bus ID (old sysfs)
+ * Return CCW Bus ID
  */
-static int ccw_busid_get_sysfs_old(const char *device, char *busid)
-{
-	char path[PATH_MAX];
-	char buf[4096];
-	int rc = 0;
-	FILE *fh;
-
-	snprintf(path, sizeof(path), "/sys/block/%s/uevent", device);
-	fh = fopen(path, "r");
-	if (fh == NULL)
-		return -1;
-	/*
-	 * The uevent file contains an entry like this:
-	 * PHYSDEVPATH=/devices/css0/0.0.206a/0.0.7e78
-	 */
-	while (fscanf(fh, "%s", buf) >= 0) {
-		if (strstr(buf, "PHYSDEVPATH") != NULL) {
-			strcpy(busid, strrchr(buf, '/') + 1);
-			goto out_fclose;
-		}
-	}
-	rc = -1;
-out_fclose:
-	fclose(fh);
-	return rc;
-}
-
-/*
- * Return CCW Bus ID (new sysfs)
- */
-static int ccw_busid_get_sysfs_new(const char *device, char *busid)
+void ccw_busid_get(const char *device, char *busid)
 {
 	char path[PATH_MAX] = { '\0' };
+	char *path_pattern;
 
 	if (device_sysfs_path(device, path, sizeof(path)) != 0)
-		return -1;
+		ERR_EXIT("Could not lookup device number for \"%s\"", device);
 
 	/*
 	 * The output has the following format:
 	 * /sys/devices/css0/0.0.0119/0.0.3f19/block/dasda
 	 * /sys/devices/css0/0.0.0000/0.0.0000/virtio0/block/vda
 	 */
-	if (sscanf(path, "/sys/devices/css0/%*[0-9a-f.]/%[0-9a-f.]", busid) != 1)
-		return -1;
-	return 0;
-}
+	path_pattern = util_path_sysfs("devices/css0/%%*[0-9a-f.]/%%[0-9a-f.]");
+	if (sscanf(path, path_pattern, busid) != 1) {
+		free(path_pattern);
+		ERR_EXIT("Could not lookup device number for \"%s\"", device);
+	}
+	free(path_pattern);
 
-/*
- * Return the device number for a device
- * dasda can be found in /sys/block/dasda/uevent or in a
- * symbolic link in the same directory. the first file only
- * contains the relevant information if we run on a kernel with
- * has the following kernel option enabled:
- * CONFIG_SYSFS_DEPRECATED
- *
- * This does not work when booting from tape
- */
-void ccw_busid_get(const char *device, char *busid)
-{
-	if (ccw_busid_get_sysfs_old(device, busid) == 0)
-		return;
-	if (ccw_busid_get_sysfs_new(device, busid) == 0)
-		return;
-	ERR_EXIT("Could not lookup device number for \"%s\"", device);
+	return;
 }

ipl_tools/cmd_chreipl.c

@@ -12,12 +12,17 @@
 
 #include <ctype.h>
 #include <sys/sysmacros.h>
+#include <sys/ioctl.h>
 
 #include "lib/util_libc.h"
+#include "lib/util_proc.h"
+#include "lib/util_base.h"
 #include "lib/zt_common.h"
+#include "lib/util_path.h"
 
 #include "ipl_tools.h"
 #include "proc.h"
+#include <linux/raid/md_u.h>
 
 #define BOOTPARMS_NSS_MAX	56
 #define BOOTPARMS_CCW_MAX	64
@@ -25,6 +30,8 @@
 
 #define OPT_BRCHR		0x80
 
+#define MD_MAJOR		9
+
 enum target_type {
 	TT_CCW,
 	TT_FCP,
@@ -414,15 +421,38 @@ static int set_reipl_type(const char *dev_name)
 	return 0;
 }
 
-static int get_chreipl_helper_cmd(dev_t dev, char cmd[PATH_MAX])
+static int is_md_device(const char *dev_name)
+{
+	char abs_dev_name[PATH_MAX];
+	mdu_array_info_t array;
+	int is_md_device = 0;
+	int fd;
+
+	if (snprintf(abs_dev_name, PATH_MAX, "/dev/%s", dev_name) >= PATH_MAX)
+		return 0;
+	fd = open(abs_dev_name, O_RDONLY);
+	if (fd == -1)
+		return 0;
+	if (ioctl(fd, GET_ARRAY_INFO, &array) >= 0)
+		is_md_device = 1;
+	close(fd);
+	return is_md_device;
+}
+
+static int get_chreipl_helper_cmd(dev_t dev, char *dev_name, char cmd[PATH_MAX])
 {
-	char *chreipl_helper;
 	struct proc_dev_entry pde;
+	char *chreipl_helper;
+	char *driver_name;
 
 	if (proc_dev_get_entry(dev, 1, &pde) != 0)
 		return -1;
+	driver_name = pde.name;
+	if (strcmp(driver_name, UTIL_PROC_DEV_ENTRY_BLKEXT) == 0 &&
+	    is_md_device(dev_name))
+		driver_name = UTIL_PROC_DEV_ENTRY_MD;
 	util_asprintf(&chreipl_helper,
-		      "%s/%s.%s", TOOLS_LIBDIR, "chreipl_helper", pde.name);
+		      "%s.%s", util_libdir_path("chreipl_helper"), driver_name);
 	if (access(chreipl_helper, X_OK) != 0) {
 		proc_dev_free_entry(&pde);
 		free(chreipl_helper);
@@ -437,7 +467,7 @@ static int get_chreipl_helper_cmd(dev_t dev, char cmd[PATH_MAX])
 /*
  * Use chreipl_helper (E.g. for device mapper devices)
  */
-static int set_reipl_type_helper(int maj, int min)
+static int set_reipl_type_helper(int maj, int min, char *dev_name)
 {
 	char helper_cmd[PATH_MAX], buf[4096];
 	struct proc_part_entry ppe;
@@ -445,7 +475,7 @@ static int set_reipl_type_helper(int maj, int min)
 	dev_t dev;
 	FILE *fh;
 
-	if (get_chreipl_helper_cmd(makedev(maj, min), helper_cmd) != 0)
+	if (get_chreipl_helper_cmd(makedev(maj, min), dev_name, helper_cmd) != 0)
 		return -1;
 	fh = popen(helper_cmd, "r");
 	if (fh == NULL)
@@ -499,7 +529,7 @@ static void parse_node_args(char *nargv[], int nargc)
 		ERR_EXIT("Invalid device node \"%s\" specified", path);
 	if (set_reipl_type(ppe.name) == 0)
 		goto out;
-	if (set_reipl_type_helper(major(dev), minor(dev)) == 0)
+	if (set_reipl_type_helper(major(dev), minor(dev), ppe.name) == 0)
 		goto out;
 	ERR_EXIT("Unsupported device node \"%s\" specified", path);
 out:
@@ -719,11 +749,12 @@ static void parse_chreipl_options(int argc, char *argv[])
 
 static void check_exists(const char *path, const char *attr)
 {
-	char fpath[PATH_MAX];
+	char *fpath;
 
-	snprintf(fpath, sizeof(fpath), "/sys/firmware/%s", path);
+	fpath = util_path_sysfs("firmware/%s", path);
 	if (access(fpath, F_OK) != 0)
 		ERR_EXIT("System does not allow one to set %s", attr);
+	free(fpath);
 }
 
 static void write_str_optional(char *string, char *file, int exit_on_fail,
@@ -739,7 +770,7 @@ static void write_str_optional(char *string, char *file, int exit_on_fail,
  * IMPLEMENTATION:
  *
  * "cio_ignore --is-ignored <busid>" returns 0 if the device is ignored,
- * 1 for internal errrors, and 2 if the device is not ignored.
+ * 1 for internal errors, and 2 if the device is not ignored.
  *
  * We get the "cio_ignore" exit status by the return code of the system()
  * function via WEXITSTATUS().
@@ -920,13 +951,14 @@ static void chreipl_nss(void)
 
 static void chreipl_node(void)
 {
-	char path[PATH_MAX];
+	char *path;
 
 	if (!l.dev_set)
 		ERR_EXIT("No device node specified");
-	snprintf(path, sizeof(path), "/sys/block/%s/device", l.dev);
+	path = util_path_sysfs("block/%s/device", l.dev);
 	if (chdir(path) != 0)
 		ERR_EXIT("Could not find device \"%s\"", l.dev);
+	free(path);
 
 	switch (l.reipl_type) {
 	case REIPL_CCW:

ipl_tools/cmd_lsreipl.c

@@ -9,6 +9,10 @@
  * it under the terms of the MIT license. See LICENSE for details.
  */
 
+#include "lib/util_path.h"
+#include "lib/util_file.h"
+#include "lib/util_libc.h"
+
 #include "ipl_tools.h"
 
 static struct {
@@ -42,24 +46,23 @@ static const char *get_ipl_banner(int show_ipl)
 void print_nss(int show_ipl)
 {
 	char *dir = show_ipl ? "ipl" : "reipl/nss";
-	char *path_bootparms = show_ipl ? "/sys/firmware/ipl/parm" :
-		"/sys/firmware/reipl/nss/parm";
+	char *path_bootparms = util_path_sysfs("firmware/%s/parm", dir);
 
 	printf("%-12s nss\n", get_ipl_banner(show_ipl));
 	print_fw_str("Name:        %s\n", dir, "name");
 	if (access(path_bootparms, R_OK) == 0)
 		print_fw_str("Bootparms:   \"%s\"\n", dir, "parm");
+	free(path_bootparms);
 }
 
 void print_fcp(int show_ipl, int dump)
 {
 	char *dir = show_ipl ? "ipl" : "reipl/fcp";
-	char *path_bootparms = show_ipl ? "/sys/firmware/ipl/scp_data" :
-		"/sys/firmware/reipl/fcp/scp_data";
-	char *path_loadparm = show_ipl ? "/sys/firmware/ipl/loadparm" :
-		"/sys/firmware/reipl/fcp/loadparm";
-	char loadparm[9], loadparm_path[PATH_MAX];
-	char *path_reipl_clear = "/sys/firmware/reipl/fcp/clear";
+	char *path_bootparms = util_path_sysfs("firmware/%s/scp_data", dir);
+	char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
+	char *path_reipl_clear = util_path_sysfs("firmware/reipl/fcp/clear");
+	char *path_secure_boot = util_path_sysfs("firmware/ipl/secure");
+	char *loadparm;
 
 	if (dump)
 		printf("%-12s fcp_dump\n", get_ipl_banner(show_ipl));
@@ -72,27 +75,31 @@ void print_fcp(int show_ipl, int dump)
 	print_fw_str("bootprog:    %s\n", dir, "bootprog");
 	print_fw_str("br_lba:      %s\n", dir, "br_lba");
 	if (access(path_loadparm, R_OK) == 0) {
-		sprintf(loadparm_path, "%s/%s", dir, "loadparm");
-		read_fw_str(loadparm, loadparm_path, sizeof(loadparm));
-		if (strcmp(loadparm, "        ") == 0)
-			loadparm[0] = 0;
+		loadparm = util_file_read_text_file(path_loadparm, 1);
+		util_strstrip(loadparm);
 		printf("Loadparm:    \"%s\"\n", loadparm);
+		free(loadparm);
 	}
 	if (access(path_bootparms, R_OK) == 0)
 		print_fw_str("Bootparms:   \"%s\"\n", dir, "scp_data");
 	if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
 		print_fw_str("clear:       %s\n", dir, "clear");
+	if (access(path_secure_boot, R_OK) == 0)
+		print_fw_str("Secure boot: %s\n", "ipl", "secure");
+	free(path_bootparms);
+	free(path_loadparm);
+	free(path_reipl_clear);
+	free(path_secure_boot);
 }
 
 void print_nvme(int show_ipl, int dump)
 {
 	char *dir = show_ipl ? "ipl" : "reipl/nvme";
-	char *path_bootparms = show_ipl ? "/sys/firmware/ipl/scp_data" :
-		"/sys/firmware/reipl/nvme/scp_data";
-	char *path_loadparm = show_ipl ? "/sys/firmware/ipl/loadparm" :
-		"/sys/firmware/reipl/nvme/loadparm";
-	char loadparm[9], loadparm_path[PATH_MAX];
-	char *path_reipl_clear = "/sys/firmware/reipl/nvme/clear";
+	char *path_bootparms = util_path_sysfs("firmware/%s/scp_data", dir);
+	char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
+	char *path_reipl_clear = util_path_sysfs("firmware/reipl/nvme/clear");
+	char *path_secure_boot = util_path_sysfs("firmware/ipl/secure");
+	char *loadparm;
 
 	if (dump)
 		printf("%-12s nvme_dump\n", get_ipl_banner(show_ipl));
@@ -104,49 +111,54 @@ void print_nvme(int show_ipl, int dump)
 	print_fw_str("bootprog:    %s\n", dir, "bootprog");
 	print_fw_str("br_lba:      %s\n", dir, "br_lba");
 	if (access(path_loadparm, R_OK) == 0) {
-		sprintf(loadparm_path, "%s/%s", dir, "loadparm");
-		read_fw_str(loadparm, loadparm_path, sizeof(loadparm));
-		if (strcmp(loadparm, "        ") == 0)
-			loadparm[0] = 0;
+		loadparm = util_file_read_text_file(path_loadparm, 1);
+		util_strstrip(loadparm);
 		printf("Loadparm:    \"%s\"\n", loadparm);
+		free(loadparm);
 	}
 	if (access(path_bootparms, R_OK) == 0)
 		print_fw_str("Bootparms:   \"%s\"\n", dir, "scp_data");
 	if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
 		print_fw_str("clear:       %s\n", dir, "clear");
+	if (access(path_secure_boot, R_OK) == 0)
+		print_fw_str("Secure boot: %s\n", "ipl", "secure");
+	free(path_bootparms);
+	free(path_loadparm);
+	free(path_reipl_clear);
+	free(path_secure_boot);
 }
 
 void print_ccw(int show_ipl)
 {
-	char loadparm[9], loadparm_path[PATH_MAX];
 	char *dir = show_ipl ? "ipl" : "reipl/ccw";
-	char *path_loadparm = show_ipl ? "/sys/firmware/ipl/loadparm" :
-		"/sys/firmware/reipl/ccw/loadparm";
-	char *path_bootparms = show_ipl ? "/sys/firmware/ipl/parm" :
-		"/sys/firmware/reipl/ccw/parm";
-	char *path_reipl_clear = "/sys/firmware/reipl/ccw/clear";
+	char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
+	char *path_bootparms = util_path_sysfs("firmware/%s/parm", dir);
+	char *path_reipl_clear = util_path_sysfs("firmware/reipl/ccw/clear");
+	char *loadparm;
 
 	printf("%-12s ccw\n", get_ipl_banner(show_ipl));
 	print_fw_str("Device:      %s\n", dir, "device");
 	if (access(path_loadparm, R_OK) == 0) {
-		sprintf(loadparm_path, "%s/%s", dir, "loadparm");
-		read_fw_str(loadparm, loadparm_path, sizeof(loadparm));
-		if (strcmp(loadparm, "        ") == 0)
-			loadparm[0] = 0;
+		loadparm = util_file_read_text_file(path_loadparm, 1);
+		util_strstrip(loadparm);
 		printf("Loadparm:    \"%s\"\n", loadparm);
+		free(loadparm);
 	}
 	if (access(path_bootparms, R_OK) == 0)
 		print_fw_str("Bootparms:   \"%s\"\n", dir, "parm");
 	if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
 		print_fw_str("clear:       %s\n", dir, "clear");
+	free(path_loadparm);
+	free(path_bootparms);
+	free(path_reipl_clear);
 }
 
 void print_eckd(int show_ipl, const char *name)
 {
-	char *path_loadparm = show_ipl ? "/sys/firmware/ipl/loadparm" :
-		"/sys/firmware/reipl/eckd/loadparm";
 	char *dir = show_ipl ? "ipl" : "reipl/eckd";
-	char loadparm[9], loadparm_path[PATH_MAX];
+	char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
+	char *path_secure_boot = util_path_sysfs("firmware/ipl/secure");
+	char *loadparm;
 
 	printf("%-12s %s\n", get_ipl_banner(show_ipl), name);
 
@@ -155,14 +167,17 @@ void print_eckd(int show_ipl, const char *name)
 	print_fw_str("br_chr:      %s\n", dir, "br_chr");
 	print_fw_str("Bootparm:    \"%s\"\n", dir, "scp_data");
 	if (access(path_loadparm, R_OK) == 0) {
-		sprintf(loadparm_path, "%s/%s", dir, "loadparm");
-		read_fw_str(loadparm, loadparm_path, sizeof(loadparm));
-		if (strcmp(loadparm, "        ") == 0)
-			loadparm[0] = 0;
+		loadparm = util_file_read_text_file(path_loadparm, 1);
+		util_strstrip(loadparm);
 		printf("Loadparm:    \"%s\"\n", loadparm);
+		free(loadparm);
 	}
 	if (!show_ipl)
 		print_fw_str("clear:       %s\n", dir, "clear");
+	if (access(path_secure_boot, R_OK) == 0)
+		print_fw_str("Secure boot: %s\n", "ipl", "secure");
+	free(path_loadparm);
+	free(path_secure_boot);
 }
 
 static void parse_lsreipl_options(int argc, char *argv[])
@@ -196,16 +211,14 @@ static void parse_lsreipl_options(int argc, char *argv[])
 
 void cmd_lsreipl(int argc, char *argv[])
 {
-	char reipl_type_str[1024];
+	char *reipl_type_str;
 
 	parse_lsreipl_options(argc, argv);
 
 	if (l.ipl_set)
-		read_fw_str(reipl_type_str, "ipl/ipl_type",
-			    sizeof(reipl_type_str));
+		reipl_type_str = read_fw_str("ipl/ipl_type");
 	else
-		read_fw_str(reipl_type_str, "reipl/reipl_type",
-			    sizeof(reipl_type_str));
+		reipl_type_str = read_fw_str("reipl/reipl_type");
 
 	if (strcmp(reipl_type_str, "fcp") == 0)
 		print_fcp(l.ipl_set, 0);
@@ -225,5 +238,6 @@ void cmd_lsreipl(int argc, char *argv[])
 	else
 		printf("%s: %s (unknown)\n", get_ipl_banner(l.ipl_set),
 		       reipl_type_str);
+	free(reipl_type_str);
 	exit(0);
 }

ipl_tools/cmd_lsshut.c

@@ -9,6 +9,8 @@
  * it under the terms of the MIT license. See LICENSE for details.
  */
 
+#include "lib/util_path.h"
+#include "lib/util_file.h"
 #include "ipl_tools.h"
 
 static const char *const usage_lsshut =
@@ -60,12 +62,13 @@ static void parse_lsshut_options(int argc, char *argv[])
  */
 static void read_vmcmd(char *str, const char *path)
 {
-	char buf[128], tmp[512];
 	char *ptr_old, *ptr;
+	char tmp[512];
+	char *buf;
 
 	*str = 0;
+	buf = read_fw_str(path);
 	ptr_old = ptr = buf;
-	read_fw_str(buf, path, sizeof(buf));
 	while ((ptr = strchr(ptr_old, '\n'))) {
 		*ptr = 0;
 		sprintf(tmp, "\"%s\",", ptr_old);
@@ -74,23 +77,31 @@ static void read_vmcmd(char *str, const char *path)
 	}
 	sprintf(tmp, "\"%s\"", ptr_old);
 	strcat(str, tmp);
+	free(buf);
 }
 
 static void print_kdump(void)
 {
 	struct stat sb;
-	char tmp[1024];
+	char *path;
+	char *tmp;
 
-	if (stat("/sys/kernel/kexec_crash_loaded", &sb) != 0)
+	path = util_path_sysfs("kernel/kexec_crash_loaded");
+	if (stat(path, &sb) != 0) {
+		free(path);
 		return;
-	read_str(tmp, "/sys/kernel/kexec_crash_loaded", sizeof(tmp));
+	}
+	tmp = util_file_read_text_file(path, 1);
 	if (strncmp(tmp, "1", 1) == 0)
 		printf("kdump,");
+	free(path);
+	free(tmp);
 }
 
 static void shutdown_trigger_print(struct shutdown_trigger *trigger)
 {
-	char tmp[1024], cmd[1024], path[PATH_MAX];
+	char cmd[1024], path[PATH_MAX];
+	char *tmp;
 
 	sprintf(path, "shutdown_actions/%s", trigger->name_sysfs);
 
@@ -99,7 +110,7 @@ static void shutdown_trigger_print(struct shutdown_trigger *trigger)
 	if ((trigger == &shutdown_trigger_panic ||
 	     trigger == &shutdown_trigger_restart))
 		print_kdump();
-	read_fw_str(tmp, path, sizeof(tmp));
+	tmp = read_fw_str(path);
 	if (strncmp(tmp, "vmcmd", strlen("vmcmd")) == 0) {
 		sprintf(path, "vmcmd/%s", trigger->name_sysfs);
 		read_vmcmd(cmd, path);
@@ -107,6 +118,7 @@ static void shutdown_trigger_print(struct shutdown_trigger *trigger)
 	} else {
 		printf("%s\n", tmp);
 	}
+	free(tmp);
 }
 
 void cmd_lsshut(int argc, char *argv[])

ipl_tools/fcp.c

@@ -10,6 +10,7 @@
  */
 
 #include "lib/util_libc.h"
+#include "lib/util_path.h"
 #include "ipl_tools.h"
 
 /*
@@ -18,11 +19,14 @@
  */
 int fcp_is_device(const char *devno)
 {
-	char path[PATH_MAX];
+	char *path;
 
-	snprintf(path, sizeof(path), "/sys/bus/ccw/drivers/zfcp/%s", devno);
-	if (chdir(path) != 0)
+	path = util_path_sysfs("bus/ccw/drivers/zfcp/%s", devno);
+	if (chdir(path) != 0) {
+		free(path);
 		return 0;
+	}
+	free(path);
 	return 1;
 }
 
@@ -31,11 +35,12 @@ int fcp_is_device(const char *devno)
  */
 void fcp_wwpn_get(const char *device, char *wwpn)
 {
-	char path[PATH_MAX], buf[20];
+	char buf[20];
+	char *path;
 	FILE *fh;
 	int rc;
 
-	snprintf(path, sizeof(path), "/sys/block/%s/device/wwpn", device);
+	path = util_path_sysfs("block/%s/device/wwpn", device);
 	fh = fopen(path, "r");
 	if (fh == NULL)
 		ERR_EXIT_ERRNO("Could not open \"%s\"", path);
@@ -44,19 +49,20 @@ void fcp_wwpn_get(const char *device, char *wwpn)
 		ERR_EXIT("Could not lookup WWPN \"%s\"", path);
 	util_strlcpy(wwpn, buf, 20);
 	fclose(fh);
+	free(path);
 }
 
-
 /*
  * Return the lun of a device
  */
 void fcp_lun_get(const char *device, char *lun)
 {
-	char path[PATH_MAX], buf[20];
+	char buf[20];
+	char *path;
 	FILE *fh;
 	int rc;
 
-	snprintf(path, sizeof(path), "/sys/block/%s/device/fcp_lun", device);
+	path = util_path_sysfs("block/%s/device/fcp_lun", device);
 	fh = fopen(path, "r");
 	if (fh == NULL)
 		ERR_EXIT_ERRNO("Could not open \"%s\"", path);
@@ -65,6 +71,7 @@ void fcp_lun_get(const char *device, char *lun)
 		ERR_EXIT("Could not lookup LUN \"%s\"", path);
 	util_strlcpy(lun, buf, 20);
 	fclose(fh);
+	free(path);
 }
 
 /*
@@ -72,11 +79,12 @@ void fcp_lun_get(const char *device, char *lun)
  */
 void fcp_busid_get(const char *device, char *devno)
 {
-	char buf[4096], path[PATH_MAX];
+	char buf[4096];
+	char *path;
 	FILE *fh;
 	int rc;
 
-	snprintf(path, sizeof(path), "/sys/block/%s/device/hba_id", device);
+	path = util_path_sysfs("block/%s/device/hba_id", device);
 	fh = fopen(path, "r");
 	if (fh == NULL)
 		ERR_EXIT_ERRNO("Could not open \"%s\"", path);
@@ -85,4 +93,5 @@ void fcp_busid_get(const char *device, char *devno)
 		ERR_EXIT("Could not find device \"%s\"", path);
 	strcpy(devno, buf);
 	fclose(fh);
+	free(path);
 }

ipl_tools/ipl_tools.h

@@ -12,7 +12,6 @@
 #ifndef IPL_TOOLS_H
 #define IPL_TOOLS_H
 
-#include <ctype.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <getopt.h>
@@ -36,41 +35,38 @@ extern struct globals {
 /*
  * Commands
  */
-extern void cmd_lsshut(int argc, char *argv[]);
-extern void cmd_chshut(int argc, char *argv[]);
-extern void cmd_lsreipl(int argc, char *argv[]);
-extern void cmd_chreipl(int argc, char *argv[]);
+void cmd_lsshut(int argc, char *argv[]);
+void cmd_chshut(int argc, char *argv[]);
+void cmd_lsreipl(int argc, char *argv[]);
+void cmd_chreipl(int argc, char *argv[]);
 
-extern void print_ccw(int show_ipl);
-extern void print_fcp(int show_ipl, int dump);
-extern void print_nvme(int show_ipl, int dump);
-extern void print_nss(int show_ipl);
-extern void print_eckd(int show_ipl, const char *name);
+void print_ccw(int show_ipl);
+void print_fcp(int show_ipl, int dump);
+void print_nvme(int show_ipl, int dump);
+void print_nss(int show_ipl);
+void print_eckd(int show_ipl, const char *name);
 
 /*
  * Helper
  */
-extern int is_lpar(void);
-extern int is_root(void);
+int is_lpar(void);
+int is_root(void);
 
-extern void strlow(char *s);
+void write_str(char *string, char *file);
+int write_str_errno(char *string, char *file);
+char *read_fw_str(const char *file);
+void print_fw_str(const char *fmt, const char *dir, const char *file);
 
-extern void write_str(char *string, char *file);
-extern int write_str_errno(char *string, char *file);
-extern void read_str(char *string, const char *file, size_t len);
-extern void read_fw_str(char *string, const char *file, size_t len);
-extern void print_fw_str(const char *fmt, const char *dir, const char *file);
-
-extern void __noreturn print_version_exit(void);
-extern void __noreturn print_help_hint_exit(void);
+void __noreturn print_version_exit(void);
+void __noreturn print_help_hint_exit(void);
 
 /*
  * FCP
  */
-extern int fcp_is_device(const char *devno);
-extern void fcp_lun_get(const char *device, char *lun);
-extern void fcp_wwpn_get(const char *device, char *wwpn);
-extern void fcp_busid_get(const char *device, char *devno);
+int fcp_is_device(const char *devno);
+void fcp_lun_get(const char *device, char *lun);
+void fcp_wwpn_get(const char *device, char *wwpn);
+void fcp_busid_get(const char *device, char *devno);
 
 /*
  * NVME
@@ -79,16 +75,16 @@ extern void fcp_busid_get(const char *device, char *devno);
 #define NVME_DEV_MAX_LEN	15	/* "nvme" + u32 in decimal + null */
 #define NVME_PATH_MAX	(PATH_MAX + NAME_MAX + 1)
 
-extern void nvme_fid_get(const char *device, char *fid);
-extern void nvme_nsid_get(const char *device, char *nsid);
+void nvme_fid_get(const char *device, char *fid);
+void nvme_nsid_get(const char *device, char *nsid);
 int nvme_is_device(char *fid_str, char *nsid_str);
 
 /*
  * CCW
  */
-extern int ccw_is_device(const char *devno);
-extern int ccw_is_virtio_device(const char *device);
-extern void ccw_busid_get(const char *device, char *devno);
+int ccw_is_device(const char *devno);
+int ccw_is_virtio_device(const char *device);
+void ccw_busid_get(const char *device, char *devno);
 
 /*
  * Shutdown trigger

ipl_tools/nvme.c

@@ -16,6 +16,7 @@
 
 #include "lib/util_libc.h"
 #include "lib/util_file.h"
+#include "lib/util_path.h"
 #include "ipl_tools.h"
 
 static void nvme_dev_from_bdev(char *dev_name)
@@ -31,8 +32,9 @@ static void nvme_dev_from_bdev(char *dev_name)
  */
 void nvme_fid_get(const char *device, char *fid)
 {
-	char path[PATH_MAX], buf[FID_MAX_LEN];
 	char nvme_dev[NVME_DEV_MAX_LEN];
+	char buf[FID_MAX_LEN];
+	char *path;
 
 	/*
 	 * An NVMe may present multiple namespaces and thus block devices, even
@@ -42,24 +44,27 @@ void nvme_fid_get(const char *device, char *fid)
 	util_strlcpy(nvme_dev, device, sizeof(nvme_dev));
 	nvme_dev_from_bdev(nvme_dev);
 
-	snprintf(path, PATH_MAX, "/sys/class/nvme/%s/device/function_id", nvme_dev);
+	path = util_path_sysfs("class/nvme/%s/device/function_id", nvme_dev);
 	if (util_file_read_line(buf, FID_MAX_LEN, path))
 		ERR_EXIT_ERRNO("Could not read from \"%s\"", path);
 
 	util_strlcpy(fid, buf, FID_MAX_LEN);
+	free(path);
 }
 /*
  * Return the nsid of a device
  */
 void nvme_nsid_get(const char *device, char *nsid)
 {
-	char path[PATH_MAX], buf[FID_MAX_LEN];
+	char buf[FID_MAX_LEN];
+	char *path;
 
-	snprintf(path, PATH_MAX, "/sys/block/%s/nsid", device);
+	path = util_path_sysfs("block/%s/nsid", device);
 	if (util_file_read_line(buf, FID_MAX_LEN, path))
 		ERR_EXIT_ERRNO("Could not read from \"%s\"", path);
 
 	util_strlcpy(nsid, buf, FID_MAX_LEN);
+	free(path);
 }
 
 static int next_entry(DIR *dir, char *in_path, char *out_path,
@@ -93,13 +98,14 @@ static int next_entry(DIR *dir, char *in_path, char *out_path,
 
 static int nvme_getdev_by_fid(char *fidstr, char *devpath)
 {
-	char temp_path[PATH_MAX+19], real_path[PATH_MAX];
-	char *sys_path = "/sys/class/nvme";
+	char temp_path[PATH_MAX + 19], real_path[PATH_MAX];
 	u_int64_t target_fid, curfid;
+	char *sys_path;
 	DIR *dir;
 	char *end;
 	int rc = -1;
 
+	sys_path = util_path_sysfs("class/nvme");
 	target_fid = strtoul(fidstr, &end, 16);
 	if (*end)
 		ERR_EXIT("Invalid function_id given %s", fidstr);
@@ -126,6 +132,7 @@ static int nvme_getdev_by_fid(char *fidstr, char *devpath)
 	}
 
 	closedir(dir);
+	free(sys_path);
 	return rc;
 }
 

ipl_tools/proc.c

@@ -16,6 +16,7 @@
 #include <sys/stat.h>
 #include <sys/sysmacros.h>
 #include <unistd.h>
+#include <ctype.h>
 
 #include "ipl_tools.h"
 #include "proc.h"

ipl_tools/proc.h

@@ -12,7 +12,6 @@
 #ifndef PROC_H
 #define PROC_H
 
-#include <ctype.h>
 #include <sys/types.h>
 
 struct proc_part_entry {

ipl_tools/system.c

@@ -9,7 +9,8 @@
  * it under the terms of the MIT license. See LICENSE for details.
  */
 
-#include "lib/util_libc.h"
+#include "lib/util_path.h"
+#include "lib/util_file.h"
 #include "ipl_tools.h"
 
 /*
@@ -46,47 +47,18 @@ int is_root(void)
 		return 0;
 }
 
-/*
- * Convert a string to lower case
- */
-void strlow(char *s)
-{
-	while (*s) {
-		*s = tolower(*s);
-		s++;
-	}
-}
-
-/*
- * Read a string from a particular file
- */
-void read_str(char *string, const char *path, size_t len)
-{
-	size_t rc;
-	FILE *fh;
-
-	fh = fopen(path, "rb");
-	if (fh == NULL)
-		ERR_EXIT_ERRNO("Could not open \"%s\"", path);
-	rc = fread(string, 1, len - 1, fh);
-	if (rc == 0 && ferror(fh))
-		ERR_EXIT_ERRNO("Could not read \"%s\"", path);
-	fclose(fh);
-	string[rc] = 0;
-	if (string[strlen(string) - 1] == '\n')
-		string[strlen(string) - 1] = 0;
-}
-
 /*
  * Read a string from a particular /sys/firmware file
  */
-void read_fw_str(char *string, const char *file, size_t len)
+char *read_fw_str(const char *file)
 {
+	char *string;
 	char *path;
 
-	util_asprintf(&path, "/sys/firmware/%s", file);
-	read_str(string, path, len);
+	path = util_path_sysfs("firmware/%s", file);
+	string = util_file_read_text_file(path, 1);
 	free(path);
+	return string;
 }
 
 /*
@@ -94,11 +66,13 @@ void read_fw_str(char *string, const char *file, size_t len)
  */
 void print_fw_str(const char *fmt, const char *dir, const char *file)
 {
-	char path[PATH_MAX], str[4096];
+	char path[PATH_MAX];
+	char *str;
 
 	snprintf(path, sizeof(path), "%s/%s", dir, file);
-	read_fw_str(str, path, sizeof(str));
+	str = read_fw_str(path);
 	printf(fmt, str);
+	free(str);
 }
 
 /*
@@ -106,17 +80,19 @@ void print_fw_str(const char *fmt, const char *dir, const char *file)
  */
 void write_str(char *string, char *file)
 {
-	char path[PATH_MAX], value[4096];
+	char value[4096];
+	char *path;
 	int fh;
 
+	path = util_path_sysfs("firmware/%s", file);
 	snprintf(value, sizeof(value), "%s\n", string);
-	snprintf(path, sizeof(path), "/sys/firmware/%s", file);
 	fh = open(path, O_WRONLY);
 	if (fh < 0)
 		ERR_EXIT_ERRNO("Could not open \"%s\"", file);
 	if (write(fh, value, strlen(value)) < 0)
 		ERR_EXIT_ERRNO("Could not set \"%s\"", file);
 	close(fh);
+	free(path);
 }
 
 /*
@@ -124,17 +100,18 @@ void write_str(char *string, char *file)
  */
 int write_str_errno(char *string, char *file)
 {
-	char path[PATH_MAX], value[4096];
+	char value[4096];
+	char *path;
 	int fh;
 
+	path = util_path_sysfs("firmware/%s", file);
 	snprintf(value, sizeof(value), "%s\n", string);
-	snprintf(path, sizeof(path), "/sys/firmware/%s", file);
 	fh = open(path, O_WRONLY);
 	if (fh < 0)
 		return errno;
 	if (write(fh, value, strlen(value)) < 0)
 		return errno;
 	close(fh);
+	free(path);
 	return 0;
 }
-

libcpumf/Makefile

@@ -7,7 +7,8 @@ examples = libcpumf_example
 all: $(lib)
 examples: $(lib) $(examples)
 
-objects = libcpumf_pmutype.o libcpumf_cpuset.o libcpumf_support.o
+objects = libcpumf_pmutype.o libcpumf_cpuset.o libcpumf_support.o \
+	  libcpumf_ctrset.o
 
 $(lib): $(objects)
 

libcpumf/libcpumf_cpuset.c

@@ -5,20 +5,23 @@
  */
 
 #include <errno.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
+#include <limits.h>
 #include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 
 #include "lib/libcpumf.h"
+#include "lib/util_file.h"
+#include "lib/util_libc.h"
+#include "lib/util_path.h"
 
 int libcpumf_cpuset(const char *parm, cpu_set_t *mask)
 {
-	char *cp, *buffer = strdup(parm);
+	char *cp, *buffer = util_strdup(parm);
+	char *cp2 = buffer;
 	int to, from, rc;
 
-	if (!buffer)			/* Errno set to ENOMEM */
-		return -1;
 	/* Check for invalid characters, such as 11.12 instead 11-12
 	 * but allow blanks and newline. Newline is appended
 	 * when the string is taken from sysfs files, for example
@@ -26,7 +29,8 @@ int libcpumf_cpuset(const char *parm, cpu_set_t *mask)
 	 */
 	if (strspn(buffer, "0123456789-,\n ") != strlen(buffer)) {
 		errno = EINVAL;
-		return -1;
+		rc = -1;
+		goto out;
 	}
 	CPU_ZERO(mask);
 	for (; (cp = strtok(buffer, ",")); buffer = NULL) {
@@ -51,25 +55,19 @@ int libcpumf_cpuset(const char *parm, cpu_set_t *mask)
 	}
 	rc = 0;
 out:
-	free(buffer);
+	free(cp2);
 	return rc;
 }
 
 int libcpumf_cpuset_fn(const char *filename, cpu_set_t *mask)
 {
-	char *txt = NULL;
-	ssize_t ret = -1;
-	size_t len = 0;
-	FILE *fp;
+	char *path = util_path_sysfs(filename);
+	char txt[PATH_MAX];
+	int ret = util_file_read_line(txt, sizeof(txt), "%s", path);
 
-	fp = fopen(filename, "r");
-	if (!fp)
-		return ret;
+	free(path);
 	/* Read out file, one line expected */
-	ret = getline(&txt, &len, fp);
-	fclose(fp);
-	if (ret > 0)
+	if (!ret)
 		ret = libcpumf_cpuset(txt, mask);
-	free(txt);
 	return ret;
 }

libcpumf/libcpumf_ctrset.c

@@ -0,0 +1,53 @@
+/* Copyright IBM Corp. 2022, 2024
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdbool.h>
+
+#include "lib/libcpumf.h"
+
+int libcpumf_ctrset(int ctr, int cfvn, int csvn)
+{
+	/* Governs basic and problem state counters */
+	switch (cfvn) {
+	case 1:
+		if (ctr >= 0 && ctr < 32)
+			return CPUMF_CTRSET_BASIC;
+		if (ctr >= 32 && ctr < 38)
+			return CPUMF_CTRSET_PROBLEM_STATE;
+		break;
+	case 3:
+		if (ctr >= 0 && ctr < 32)
+			return CPUMF_CTRSET_BASIC;
+		if (ctr >= 32 && ctr < 34)
+			return CPUMF_CTRSET_PROBLEM_STATE;
+		break;
+	}
+
+	/* Governs crypto, extended and MT-Diagnositc counters */
+	switch (csvn) {
+	case 1 ... 5:
+		if (ctr >= 64 && ctr < 80)
+			return CPUMF_CTRSET_CRYPTO;
+		if ((csvn == 1 && ctr >= 128 && ctr < 160) ||
+		    (csvn == 2 && ctr >= 128 && ctr < 176) ||
+		    (ctr >= 128 && ctr < 256))
+			return CPUMF_CTRSET_EXTENDED;
+		break;
+	case 6 ... 8:
+		if (ctr >= 64 && ctr < 84)
+			return CPUMF_CTRSET_CRYPTO;
+		if (ctr >= 128 && ctr < 288)
+			return CPUMF_CTRSET_EXTENDED;
+		break;
+	}
+	if (csvn >= 3 && ctr >= 448 && ctr < 496)
+		return CPUMF_CTRSET_MT_DIAG;
+	return CPUMF_CTRSET_NONE;
+}

libcpumf/libcpumf_pmutype.c

@@ -1,4 +1,4 @@
-/* Copyright IBM Corp. 2022
+/* Copyright IBM Corp. 2022, 2025
  *
  * s390-tools is free software; you can redistribute it and/or modify
  * it under the terms of the MIT license. See LICENSE for details.
@@ -18,16 +18,13 @@
 
 int libcpumf_pmutype(const char *dirname)
 {
+	int ret = -1;
 	FILE *file;
 	char *fn;
-	int ret;
 
-	ret = asprintf(&fn, "%s/type", dirname);
-	if (ret == -1)		/* No memory, errno set */
-		return ret;
+	fn = util_path_sysfs("%s/type", dirname);
 	file = fopen(fn, "r");
 	free(fn);
-	ret = -1;		/* Errno set on file open error */
 	if (file) {
 		/* Read out a single number from that file */
 		if (fscanf(file, "%u", &ret) != 1)

libcpumf/libcpumf_support.c

@@ -13,6 +13,7 @@
 #include <sys/stat.h>
 
 #include "lib/libcpumf.h"
+#include "lib/util_path.h"
 
 #define	SERVICELEVEL	"/proc/service_levels"
 
@@ -129,34 +130,42 @@ bool libcpumf_have_sfb(void)
 bool libcpumf_sfb_info(unsigned long *min, unsigned long *max)
 {
 	int rc = false;
+	char *path;
 	FILE *fp;
 
-	fp = fopen(S390_CPUMSF_BUFFERSZ, "r");
+	path = util_path_sysfs(S390_CPUMSF_BUFFERSZ);
+	fp = fopen(path, "r");
 	if (!fp)
-		err(EXIT_FAILURE, "%s", S390_CPUMSF_BUFFERSZ);
+		err(EXIT_FAILURE, "%s", path);
 	if (fscanf(fp, "%lu,%lu", min, max) == 2)
 		rc = true;
 	fclose(fp);
+	free(path);
 	return rc;
 }
 
+static bool libcpumf_have_pai_sysfs(char *p)
+{
+	char *path;
+	bool ret;
+
+	path = util_path_sysfs(p);
+	ret = util_path_exists(path);
+	free(path);
+	return ret;
+}
+
 bool libcpumf_have_pai_crypto(void)
 {
-	struct stat statbuf;
-
-	return (stat(S390_SYSFS_PAI_CRYPTO, &statbuf) == -1) ? false : true;
+	return libcpumf_have_pai_sysfs(S390_SYSFS_PAI_CRYPTO);
 }
 
 bool libcpumf_have_pai_ext(void)
 {
-	struct stat statbuf;
-
-	return (stat(S390_SYSFS_PAI_EXT, &statbuf) == -1) ? false : true;
+	return libcpumf_have_pai_sysfs(S390_SYSFS_PAI_EXT);
 }
 
 bool libcpumf_have_pai_nnpa(void)
 {
-	struct stat statbuf;
-
-	return (stat(S390_SYSFS_PAI_NNPA, &statbuf) == -1) ? false : true;
+	return libcpumf_have_pai_sysfs(S390_SYSFS_PAI_NNPA);
 }

libkmipclient/attribute.c

@@ -2432,7 +2432,7 @@ out:
 	kmip_node_free(iv);
 	kmip_node_free(tag);
 	kmip_node_free(ffl);
-	kmip_node_free(ffl);
+	kmip_node_free(ifl);
 	kmip_node_free(cnt);
 	kmip_node_free(icv);
 	kmip_node_free(salt);

libkmipclient/kmip.c

@@ -1471,7 +1471,7 @@ retry:
 	chain = SSL_get_peer_cert_chain(conn->plain_tls.ssl);
 	if (chain == NULL) {
 		kmip_debug(debug, "SSL_get_peer_cert_chain failed");
-		return -EIO;
+		rc = -EIO;
 		goto out;
 	}
 

libkmipclient/request.c

@@ -210,6 +210,8 @@ struct kmip_node *kmip_new_request_header(const struct kmip_version *version,
 out:
 	kmip_node_free(ver);
 	kmip_node_free(max);
+	kmip_node_free(ccorr);
+	kmip_node_free(scorr);
 	kmip_node_free(async);
 	kmip_node_free(err);
 	kmip_node_free(ord);

libkmipclient/response.c

@@ -1369,7 +1369,7 @@ int kmip_get_get_response_payload(const struct kmip_node *node,
 	return 0;
 
 error:
-	if (*unique_id != NULL) {
+	if (unique_id != NULL && *unique_id != NULL) {
 		kmip_node_free(*unique_id);
 		*unique_id = NULL;
 	}

libkmipclient/tls.c

@@ -351,7 +351,6 @@ int kmip_connection_tls_init(struct kmip_connection *conn, bool debug)
 		if (tok == NULL) {
 			kmip_debug(debug, "malformed IPv6 address");
 			rc = -EINVAL;
-			free(hostname);
 			goto out;
 		}
 		tok++;