[22.04 FEAT] [KRN1918] Long kernel command line on s390x

[bugproxy]

Feature: Long kernel command line

Description:
Allow to handle command lines with a length of up to 4096 bytes by kernel. It happened in the past that our supported command line size of 896 bytes was sometimes too short - while x86, powerpc, and arm each support 2048 bytes.

This requires:
- an ABI interface to the kernel image, so that tools can figure out if the kernel supports large command lines (might be a feature bitmap at a fixed location)
- zipl, genprotimg, qemu, kexec-tools and changes (depending on the kernel side implementation)
- in-kernel ipl support changes (IPL from reader)

[Frank Heimes (fheimes)]

According to discussion at LP#1959984,
the following commits need to be cherry-picked (in this order):
277c8389386e ("390/kexec_file: move kernel image size check") - prereq
5ecb2da660ab ("s390: support command lines longer than 896 bytes")

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2022-02-11 05:24 EDT-------
(In reply to comment #6)
> According to discussion at LP#1959984,
> the following commits need to be cherry-picked (in this order):
> 277c8389386e ("390/kexec_file: move kernel image size check") - prereq
> 5ecb2da660ab ("s390: support command lines longer than 896 bytes")

Yes, this should apply cleanly.
The other parts for this item went into s390-tool v2.20 which will land in jammy (see Bugzilla 196184 - LP#1959420 : [22.04 FEAT] Upgrade s390utils/s390-tools to latest version)

[Frank Heimes (fheimes)]

A patched test build of kernel 5.15.0-22.22 (based on jammy master-next) is done at the following PPA:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1959984

[Frank Heimes (fheimes)]

Patch request submitted:
https://lists.ubuntu.com/archives/kernel-team/2022-February/thread.html#128144
Updating status to 'In Progress'.
Assigning kernel entry to 'Canonical Kernel Team'.

[Frank Heimes (fheimes)]

Submitted a v2, since I had to converted 277c8389386e ("390/kexec_file: move kernel image size check") into a backport, due to some context adjustments, to get the patch properly in.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.15.0-23.23

---------------
linux (5.15.0-23.23) jammy; urgency=medium

  * jammy/linux: 5.15.0-23.23 -proposed tracker (LP: #1964573)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync dkms-build{,--nvidia-N} from LRMv5
    - debian/dkms-versions -- update from kernel-versions (main/master)

  * [22.04 FEAT] KVM: Enable GISA support for Secure Execution guests
    (LP: #1959977)
    - KVM: s390: pv: make use of ultravisor AIV support

  * intel_iommu breaks Intel IPU6 camera: isys port open ready failed -16
    (LP: #1958004)
    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs

  * CVE-2022-23960
    - ARM: report Spectre v2 status through sysfs
    - ARM: early traps initialisation
    - ARM: use LOADADDR() to get load address of sections
    - ARM: Spectre-BHB workaround
    - ARM: include unprivileged BPF status in Spectre V2 reporting
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
    - arm64: Add HWCAP for self-synchronising virtual counter
    - arm64: Add Cortex-X2 CPU part definition
    - arm64: add ID_AA64ISAR2_EL1 sys register
    - arm64: cpufeature: add HWCAP for FEAT_AFP
    - arm64: cpufeature: add HWCAP for FEAT_RPRES
    - arm64: entry.S: Add ventry overflow sanity checks
    - arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit
    - KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
    - arm64: entry: Make the trampoline cleanup optional
    - arm64: entry: Free up another register on kpti's tramp_exit path
    - arm64: entry: Move the trampoline data page before the text page
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors
    - arm64: entry: Move trampoline macros out of ifdef'd section
    - arm64: entry: Make the kpti trampoline's kpti sequence optional
    - arm64: entry: Allow the trampoline text to occupy multiple pages
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
    - arm64: entry: Add vectors that have the bhb mitigation sequences
    - arm64: entry: Add macro for reading symbol addresses from the trampoline
    - arm64: Add percpu vectors for EL1
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
    - arm64: Mitigate spectre style branch history side channels
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
    - arm64: Use the clearbhb instruction in mitigations
    - arm64: proton-pack: Include unprivileged eBPF status in Spectre v2
      mitigation reporting
    - ARM: fix build error when BPF_SYSCALL is disabled

  * CVE-2021-26401
    - x86/speculation: Use generic retpoline by default on AMD
    - x86/speculation: Update link to AMD speculation whitepaper
    - x86/speculation: Warn about Spectre v2 LFENCE mitigation
    - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT

  * CVE-2022-0001
    - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
    - x86/speculation: Add eIBRS + Retpoline options
    - Document...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-oracle-5.15/5.15.0-1006.8~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Frank Heimes (fheimes)]

This bug is already Fix Released and closed and was requested for jammy only.
So it wasn't requested for focal, hence updating the tags to 'verification-done-focal' to unblock any processes.