lunadiag

The lunadiag utility is a diagnostic tool for the SafeNet Luna PCIe HSM.

In general, it is only used to confirm a successful SafeNet HSM installation, or to perform additional diagnostic tests as part of the troubleshooting process with Technical Support. Application developers may also use lunadiag during the software development process to help troubleshoot their code.

NOTE   This is a general-purpose tool intended for use across SafeNet HSM versions. It may reference mechanisms and features that are not available on all SafeNet products.

Syntax

lunadiag [-s=<slots>] [-o=<offset>] [  -c=<command>] [ <options>]

Argument(s) Description
-s= <slots>

Specifies the number of slots to test at once.

Range: 1 to n, where n is the number of slots available to the client.

Default: 1

-o= <offset>

Specifies the offset into slots to begin testing.

Range: 0 to n-1, where n is the number of slots available to the client.

Default: 0

-c= <command>

Specifies the command to run.

Range: 1 to 20. See Lunadiag Commands for a list of the available commands.

<options>

The following additional options can be executed, and exit immediately without user prompt.

-CHRYSTOKI - Perform the Chrystoki Library configuration test.

-FIPS - Test for FIPS setting for one token. Exit code 1 implies FIPS enabled.

Example

lunadiag  -s=1 -o=1 -c=11
 

NOTE   The spaces are required.

Using lunadiag

1.To get a list of available slots, run lunadiag with no arguments. This will return a list similar to the one below:

C:\Program Files\SafeNet\LunaClient>lunadiag
lunadiag  version 8.0  Date: Feb 13 2015 Time: 14:21:44
Detecting Luna devices ...
Detection complete.

Slots available:
        Slot #0 - Present     - LunaNet Slot
        Slot #1 - Present     - LunaNet Slot
        Slot #2 - Present     - LunaNet Slot
        Slot #3 - Present     - Viper PCI Card
        Slot #4 - Not present - Luna UHD Tunnel Slot
        Slot #5 - Present     - Luna UHD Slot
        Slot #6 - Not present - Luna UHD Slot
        Slot #7 - Not present - Luna UHD Slot
Enter slot to test:

 

In the above example:

Slots 0, 1, and 2 are listed as "LunaNet Slot", and correspond to SafeNet Luna Network HSM application partitions that are registered with this client/host.

Slot 3, "Viper PCI Card", is a locally contained SafeNet Luna PCIe HSM physical slot.

NOTE   While LunaCM shows a separate HSM administrative slot and application partition slot, lunadiag shows a single physical slot.

Slot 4 "Not present - Luna UHD Tunnel Slot", is reserved for a USB HSM Device (UHD) like a SafeNet Luna Backup HSM that could be directly connected to the SafeNet Luna PCIe HSM card.

Slot 5, "Present - Luna UHD Slot", is a SafeNet Luna USB HSM physical slot.

NOTE   The slots listed as "Not Present - Luna UHD Slot" are placeholders for other possible devices that could be USB-connected, but currently are not.

2.Once you have selected a slot to work on, lunadiag displays a menu of commands you can use:

C:\Program Files\SafeNet\LunaClient>lunadiag
lunadiag  version 8.0  Date: Feb 13 2015 Time: 14:21:44
Detecting Luna devices ...
Detection complete.

Slots available:
        Slot #0 - Present     - LunaNet Slot
        Slot #1 - Present     - LunaNet Slot
        Slot #2 - Present     - LunaNet Slot
        Slot #3 - Present     - Viper PCI Card
        Slot #4 - Not present - Luna UHD Tunnel Slot
        Slot #5 - Present     - Luna UHD Slot
        Slot #6 - Not present - Luna UHD Slot
        Slot #7 - Not present - Luna UHD Slot
Enter slot to test:

 

In order to see the lunadiag menu of commands, select a slot on which to act:

Enter slot to test: 0

Lunadiag Commands

lunadiag  version 8.0  Date: Aug 24 2016 Time: 14:20:03

                Main Menu

           1   Select slot to test
           2   Driver Test
           3   Communication Test
           4   Read Firmware Level
           5   Read Protocol Level
           6   Read Capabilities
           7   Read Token Policies
           8   Read TSV
           9   Read Dualport
          10   Read Dualport Command
          11   Token Info Test
          12   Mechanism Info Test
          16   Read Debug/Trace Information
          17   Display Environmental Monitoring Information
          18   Read Diagnostic Log
          19   Display Tamper State
          20   Monitor Tamper State

           0   Exit
----------------------------------------
 

Enter a number between 1 and 20 to run its corresponding command.

NOTE   Commands 13, 14, and 15 are not displayed. They are no longer supported.

For a description of each function available in the lunadiag utility, see Descriptions of lunadiag commands.

Table 1: Descriptions of lunadiag commands
Number Name Description
1 Select slot to test

Shows a list of available slots.

Enter a slot number to change which slot to work on.

2 Driver Test Detects and tests driver functionality on the current slot.
3 Communication Test Tests the connection between the utility and the HSM in the current slot.
4 Read Firmware Level Shows the firmware level, corresponding to firmware revision of the HSM in the current slot.
5 Read Protocol Level Shows the protocol level, corresponding to the available commands of the firmware version of the HSM in the current slot.
6 Read Capabilities Returns status (ENABLED or DISABLED) of HSM, SO, and User capabilities for the HSM in the current slot.
7 Read Token Policies Returns status (ENABLED or DISABLED) of HSM, SO, and User policies for the HSM/token in the current slot.
8 Read TSV Returns the Token State Vector for the HSM/token in the current slot.
9 Read Dualport This command is not supported by the SafeNet Luna HSM 7.0.
10 Read Dualport Command This command is not supported by the SafeNet Luna HSM 7.0.
11 Token Info Test

Shows information about the HSM/token in the current slot, including:

>Label

>Manufacturer

>Model and serial number

>Certificates

>Flags

>Open and max sessions

>PIN length

>Total memory and how much of it is free

>SO and User container status flags

12 Mechanism Info Test Retrieves and shows all available mechanisms for the HSM in the current slot.
16 Read Debug/Trace Information This command is not supported by the SafeNet Luna HSM 7.0. See 18 instead.
17 Display Environmental Monitoring Information

Returns the status of the environment in which the HSM is operating. Variables shown include:

>RTC (Real Time Clock) temperature

>DIE (RTC DIE) temperature

>SM (Security Module) temperature

>PKA (Public Key Accelerator) temperature

>PKA Warn Temp: critical PKA temperature at which a warning is issued

>Battery

>Battery Warn: critical battery level at which a warning is issued

>Fan statuses

18 Read Diagnostic Log

Shows diagnostic log for the HSM in the current slot.

1.Select a partition from the list by entering its corresponding number. Each partition is responsible for logging information pertaining to its particular focus. Select 9 to show all log information.

2.All log entries for the chosen partition are ordered by entry number, and show information such as:

Bytes read

Timestamp

Date of entry

Time of entry

Other information about the HSM; this varies between partitions

19 Display Tamper State

Checks the tamper state of the HSM in the current slot.

If no tamper is detected, "No active tampers" and current temperature are shown.

If a tamper is detected, its type, time it occurred, and live environmental values are shown.

20 Monitor Tamper State

Monitors the tamper state of the HSM in the current slot. Key tamper parameters are shown and updated periodically as they change over time.

To force the function to stop looping, press Ctrl + C on your keyboard.

0 Exit Exits and closes the lunadiag utility.

Verifying a Successful Installation

If you can run the tests listed below, and they do not return error messages, then the installation was successful.

 2  Driver Test 
 3  Communication Test
 4  Read Firmware Level

Troubleshooting

If you are experiencing problems, try the following:

1.Check the connections to your HSM.

2.Remove and re-install the SafeNet Luna HSM Client software.

If problems persist, contact Technical Support.