CHZCRYPT(8)

💅 CHZCRYPT(8) — the zcrypt glow-up command, bestie

okay so real talk: this is chzcrypt from the System Manager's Manual, section 8. she's a system admin girlie and she's here to rearrange your crypto devices. let's get into it 🎀

---

✨ NAME ✨

chzcrypt — modify zcrypt configuration. that's it, that's the vibe. she tweaks stuff. 💅

---

🦋 SYNOPSIS 🦋

chzcrypt -e | -d ( -a | <device id> [...] )

chzcrypt --config-on | --config-off ( -a | <device id> [...] )

chzcrypt [ -p | -n ] [ -t <timeout> ]

chzcrypt [ -c <timeout> ]

chzcrypt [ -q <domain> ]

chzcrypt -h

chzcrypt -v

like yes she has a lot of modes. main character energy fr. ⭐

---

🌸 DESCRIPTION 🌸

so chzcrypt is the command you use to configure the cryptographic devices that zcrypt manages, and to modify zcrypt's AP bus attributes. lowkey iconic.

here's the tea though: attributes may vary depending on the kernel version. 🙈 and chzcrypt requires that the sysfs filesystem is mounted. no sysfs, no slay. periodt.

---

👑 OPTIONS 👑

• -e, --enable — set the given cryptographic device(s) online. wake them up bestie ✨
• -d, --disable — set the given cryptographic device(s) offline. nap time 😴
• -a, --all — set all available cryptographic device(s) online or offline. all of them. every single one. 🔥
• --config-on — set the given cryptographic card device(s) config on ('configured'). yes the quotes are part of the lore.
• --config-off — set the given cryptographic card device(s) config off ('deconfigured').
• -p, --poll-thread-enable — enable zcrypt's poll thread. let her poll 🫶
• -n, --poll-thread-disable — disable zcrypt's poll thread. she's done polling.
• -c, --config-time <timeout> — set the configuration timer for re-scanning the AP bus to <timeout> seconds. ⏱️
• --se-associate <association-index> <queue-device> — associate the given queue device with the given association index. > ⚠️ this one is only valid within a Secure Execution guest with AP pass-through support enabled. no cap.
• --se-bind <queue-device> — bind the given queue device. same deal: only valid within a Secure Execution guest with AP pass-through support enabled. 💜
• --se-unbind <queue-device> — unbind the given queue device. also only valid within a Secure Execution guest with AP pass-through support enabled. consistency queen 💅
• -t, --poll-timeout <poll_timeout> — set the poll timer to run the poll tasklet all <poll_timeout> nanoseconds. nanoseconds!! tiny!! 🧚
• -q, --default-domain <domain> — set the new default domain of the AP bus to <domain>. the number of available domains can be retrieved with the lszcrypt command (the '-d' option). iykyk 🌈
• -V, --verbose — print verbose messages. she will tell you EVERYTHING. 😭
• -h, --help — print help text and exit. 🎀
• -v, --version — print version information and exit. 🎀

🍓 the arguments 🍓

• <device id> — specifies a cryptographic device which will be set either online or offline or configured on or off. for online and offline the device can either be a card device or a queue device. a queue device can only get switched online when the providing card is online. 👀 for config on/off the device needs to be a card device. a card or queue device cannot get switched online if the card is in deconfigured state. so like… order of operations matters bestie.

📌 please note that the card device and queue device representation are both in hexadecimal notation. don't come in here with decimal, i'm begging 🙈

• <queue-device> — an APQN queue device given as xy.abcd as it is listed by lszcrypt -V. cute little dotted format, obsessed. 🦋

---

💖 EXAMPLES 💖

chzcrypt -e 0 1 12

will set the cryptographic card devices 0, 1 and 12 online. trio slay ✨

chzcrypt -e 10.0038

will set the cryptographic device '10.0038' respectively card id 16 (0x10) with domain 56 (0x38) online. see? hex. told you. 💅

chzcrypt -d -a

will set all available cryptographic devices offline. goodbye everyone 😭

chzcrypt --config-on -a -V

set all available crypto cards to config on, be verbose. loud and proud 🗣️

chzcrypt -V --config-off card01 card03

switch the two crypto cards 1 and 3 to deconfigured, be verbose. note that card01 and card03 are exactly how it's written here, character for character, do not come for me 👑

chzcrypt -c 60 -n

will set configuration timer for re-scanning the AP bus to 60 seconds and disable zcrypt's poll thread. multitasking icon ⏱️

chzcrypt -q 67

will set the default domain to 67. new default, who dis 🌸

---

🧚 NOTES 🧚

support for crypto cards to get switched config on or off requires a Linux kernel supporting this. if the required sysfs attribute file does not exist, it is assumed there is an older kernel running and chzcrypt exits with an appropriate message. so like, don't blame her, blame your kernel 💀

even more: config on/off may require support from a hypervisor like KVM or zVM and may fail if the Linux kernel is unable to perform the SCLP command. check syslog on failure. fr fr. 🔍

🫶 bind, associate and unbind command on a queue device are only available and valid within a Secure Execution environment with AP pass-through enabled and a Linux kernel providing the low level sysfs API. if these conditions are not fulfilled, the command will fail with an appropriate error messages. not me warning you twice 💜

---

⭐ SEE ALSO ⭐

• lszcrypt(8) — go read her too, she's the whole reason you know your -V output 🦋

---

so yeah, that's the whole page. go forth and configure, bestie. and remember: if it breaks, check syslog before you check your group chat. 😭💖

sign-off 🎀 — brought to you by s390-tools, dated MAY 2023. version of record, frozen in time like a little time capsule. mwah. 💅✨