A fix is available
APAR status
Closed as program error.
Error description
Start CHINIT with TCPCHL=0 which uses SSL channels, it fails with ABN=UFFD-00000090. When the CHINIT starts, it performs some initialization tasks to prepare for channel processing. If TCPCHL is 0, some configuration related to Unix System Services sockets is skipped as it is not needed. Later in initialization, the chinit detects that SSL tasks have been requested, and creates the appropriate number of tasks for this work. The code which runs on these SSL tasks uses Unix System Services functions when depend on the earlier configuration which was bypassed. Since these calls are not running in an appropriate environment, the tasks abend.
Local fix
It is possible to avoid the problem and allow the chinit to start cleanly by setting SSLTASKS(0) as well as TCPCHL(0). Note: to re-enable TCP sockets and SSL, you will need to alter the settings back to non-zero values and then restart the chinit.
Problem summary
**************************************************************** * USERS AFFECTED: All users of WebSphere MQ for z/OS Version 7 * * Release 0 Modification 1 and All users of * * WebSphere MQ for z/OS Version 7 Release 1 * * Modification 0. * **************************************************************** * PROBLEM DESCRIPTION: The channel initiator may abend * * ABN=UFFD-00000090 with message * * CEE5101C and fail to start if SSLTASKS * * is greater than 0 and TCPCHL is set to * * 0. * **************************************************************** * RECOMMENDATION: * **************************************************************** If TCPCHL(0) and SSLTASKS > 0 are set, when the channel initiator is started abends may occur within the chinit when the SSLTASKS are started. This may also cause the channel initiator to fail to start correctly. During the initialization of the channel initiator, the initialization for TCP channels is skipped, as TCPCHL(0) is set TCP cannot be used. In the later stages of the initialization, calls to USS services are made to initialize SSL server, as SSLTASKS > 0. These calls rely upon USS calls made by the TCP initialization. If TCP initialization is not carried out, the call during the initialization of SSL will cause an abend within the chinit.
Problem conclusion
Conditions have been amended to the initialization of the channel initiator to restrict the initialization required for SSL to only occur if TCPCHL has a non-zero value. The infocenter (for V701 and V710) will be updated for a new message: WebSphere MQ > Reference > Messages > Messages and reason codes for z/OS > Messages for WebSphere MQ for z/OS CSQX167E: CSQX167E: <csect-name> SSL server subtasks not started, TCPCHL must be non-zero Explaination- The value set for the SSLTASKS queue manager attribute has been ignored, as SSL server subtasks require TCP channels (TCPCHL queue manager attribute) to be set to a value larger than 0. SSL can only be used the TCP channel. Severity- 0 System action- No SSL server subtasks will be started, processing will continue. System programmer response- If SSL server subtasks should be started, a requirement to use SSL, modify the TCPCHL queue manager attribute prior to starting the channel initiator. The channel initiator requires to be restarted for these attributes to take effect. Additonally the Infocenter documentation will be updated to describe the correct configuration: ======================= DOC Changes for V701 Infocenter ======= Reference- http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/topic/com.i bm.mq.csqzas.doc/sy12450_.htm At Section- WebSphere MQ > Security > WebSphere MQ SSL and TLS support > Working with SSLor TLS on z/OS > Setting the SSLTASKS parameter Under the example ALTER command add a line to the effect of : The value of TCPCHL on the queue manager must be set to a value greater than 0, otherwise the value set for SSLTASKS will be ignored. --------- Reference- http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/index.jsp? topic=%2Fcom.ibm.mq.csqzas.doc%2Fsy10950_.htm At Section- WebSphere MQ > Security > WebSphere MQ SSL and TLS support > Queue manager attributes Under the SSLTASKS heading, make an addition to the end of the sentence:'If you use SSL or TLS channels you must have at least two of these tasks' to add: ", and TCPCHL must be greater than 0 otherwise the SSLTASKS value is ignored.' ======================= DOC Changes for V710 Infocenter ======= Reference- http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/index.jsp? topic=%2Fcom.ibm.mq.doc%2Fsy12450_.htm At Section- WebSphere MQ > Security > Setting up security > Working with SSL or TLS > Working with SSL or TLS on z/OS > Setting the SSLTASKS parameter Under the example ALTER command add a line to the effect of : The value of TCPCHL on the queue manager must be set to a value greater than 0, otherwise the value set for SSLTASKS will be ignored. --------- Reference- http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/index.jsp? topic=%2Fcom.ibm.mq.csqzas.doc%2Fsy10920_.htm At Section- WebSphere MQ > Security > Security overview > WebSphere MQ security mechanisms > Security protocols in WebSphere MQ Under the SSLTASKS heading, make an addition to the end of the sentence: 'If you use SSL or TLS channels you must have at least two of these tasks' to add: ", and TCPCHL must be greater than 0 otherwise the SSLTASKS value is ignored.' 010Y 011Y 012Y 013Y 014Y 100Y 101Y 102Y 103Y 104Y 105Y CSQFXTXC CSQFXTXE CSQFXTXF CSQFXTXK CSQFXTXU CSQXGIMP
Temporary fix
Comments
APAR Information
APAR number
PM85154
Reported component name
WMQ Z/OS V7
Reported component ID
5655R3600
Reported release
010
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2013-03-19
Closed date
2013-04-24
Last modified date
2013-07-03
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
UK93729 UK93730 UK93731 UK93732 UK93733 UK93734 UK93735 UK93736
UK93737 UK93738 UK93739
Modules/Macros
CSQFXTXC CSQFXTXE CSQFXTXF CSQFXTXK CSQFXTXU CSQXGIMP
Fix information
Fixed component name
WMQ Z/OS V7
Fixed component ID
5655R3600
Applicable component levels
R010 PSY UK93729
UP13/06/14 P F306
R011 PSY UK93730
UP13/06/14 P F306
R012 PSY UK93731
UP13/06/14 P F306
R013 PSY UK93732
UP13/06/14 P F306
R014 PSY UK93733
UP13/06/14 P F306
R100 PSY UK93734
UP13/06/14 P F306
R101 PSY UK93735
UP13/06/14 P F306
R102 PSY UK93736
UP13/06/14 P F306
R103 PSY UK93737
UP13/06/14 P F306
R104 PSY UK93738
UP13/06/14 P F306
R105 PSY UK93739
UP13/06/14 P F306
Fix is available
Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.
[{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0.1","Edition":"","Line of Business":{"code":"","label":""}}]
Document Information
Modified date:
03 July 2013