Azure: Add PCI pass-thru support to Hyper-V Confidential VMs

Bug #2015369 reported by Tim Gardner
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-azure (Ubuntu)
Fix Released
Medium
Tim Gardner
Jammy
Won't Fix
Medium
Tim Gardner
Kinetic
Fix Released
Medium
Tim Gardner
Lunar
Fix Released
Medium
Tim Gardner

Bug Description

SRU Justification

[Impact]

Microsoft has requested the inclusion of this patch set:

https://lore.kernel<email address hidden>/T/

[Regression Potential]

Private memory mappings could be incorrect.

[Test Plan]

Microsoft tested.

[Other Info]

SF: #00355859

Tim Gardner (timg-tpi)
affects: linux (Ubuntu) → linux-azure (Ubuntu)
Changed in linux-azure (Ubuntu):
status: New → Fix Released
Changed in linux-azure (Ubuntu Lunar):
assignee: nobody → Tim Gardner (timg-tpi)
importance: Undecided → Medium
status: Fix Released → In Progress
Tim Gardner (timg-tpi)
Changed in linux-azure (Ubuntu Jammy):
assignee: nobody → Tim Gardner (timg-tpi)
importance: Undecided → Medium
status: New → In Progress
Changed in linux-azure (Ubuntu Kinetic):
assignee: nobody → Tim Gardner (timg-tpi)
importance: Undecided → Medium
status: New → In Progress
Changed in linux-azure (Ubuntu Lunar):
status: In Progress → Fix Committed
Tim Gardner (timg-tpi)
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (86.4 KiB)

This bug was fixed in the package linux-azure - 6.2.0-1003.3

---------------
linux-azure (6.2.0-1003.3) lunar; urgency=medium

  * lunar/linux-azure: 6.2.0-1003.3 -proposed tracker (LP: #2015432)

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/master)

  * Azure: Add PCI pass-thru support to Hyper-V Confidential VMs (LP: #2015369)
    - x86/ioremap: Add hypervisor callback for private MMIO mapping in coco VM

  * Azure: Add new MANA VF performance counters for easier troubleshooting
    (LP: #2014015)
    - net: mana: Add new MANA VF performance counters for easier troubleshooting

  * Azure: smb3: allow deferred close timeout to be configurable (LP: #2013349)
    - keys: Do not cache key in task struct if key is requested from kernel thread

  * Azure: not enough RAM under 4GB for CVM (LP: #1967166)
    - SAUCE: azure: Swiotlb: Add swiotlb_alloc_from_low_pages switch
    - SAUCE: azure: x86/hyperv: Make swiotlb bounce buffer allocation not just
      from low pages

  * Miscellaneous Ubuntu changes
    - [Config] azure: update annotations after rebase to the latest 6.2

  [ Ubuntu: 6.2.0-20.20 ]

  * lunar/linux: 6.2.0-20.20 -proposed tracker (LP: #2015429)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/master)
  * FTBFS with different dkms or when makeflags are set (LP: #2015361)
    - [Packaging] FTBFS with different dkms or when makeflags are set
  * expoline.o is packaged unconditionally for s390x (LP: #2013209)
    - [Packaging] Copy expoline.o only when produced by the build
  * net:l2tp.sh failure with lunar:linux 6.2 (LP: #2013014)
    - SAUCE: l2tp: generate correct module alias strings
  * Miscellaneous Ubuntu changes
    - [Packaging] annotations: prevent duplicate include lines

  [ Ubuntu: 6.2.0-19.19 ]

  * lunar/linux: 6.2.0-19.19 -proposed tracker (LP: #2012488)
  * Neuter signing tarballs (LP: #2012776)
    - [Packaging] neuter the signing tarball
  * LSM stacking and AppArmor refresh for 6.2 kernel (LP: #2012136)
    - Revert "UBUNTU: [Config] define CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS"
    - Revert "UBUNTU: SAUCE: apparmor: add user namespace creation mediation"
    - Revert "UBUNTU: SAUCE: apparmor: Add fine grained mediation of posix
      mqueues"
    - Revert "UBUNTU: SAUCE: Revert "apparmor: make __aa_path_perm() static""
    - Revert "UBUNTU: SAUCE: LSM: Specify which LSM to display (using struct cred
      as input)"
    - Revert "UBUNTU: SAUCE: apparmor: Fix build error, make sk parameter const"
    - Revert "UBUNTU: SAUCE: LSM: Use lsmblob in smk_netlbl_mls()"
    - Revert "UBUNTU: SAUCE: LSM: change ima_read_file() to use lsmblob"
    - Revert "UBUNTU: SAUCE: apparmor: rename kzfree() to kfree_sensitive()"
    - Revert "UBUNTU: SAUCE: AppArmor: Remove the exclusive flag"
    - Revert "UBUNTU: SAUCE: LSM: Add /proc attr entry for full LSM context"
    - Revert "UBUNTU: SAUCE: Audit: Fix incorrect static inline function
      declration."
    - Revert "UBUNTU: SAUCE: Audit: Fix for missing NULL check"
    - Revert "UBUNTU: SAUCE: Audit: Add a new record for multiple object LSM
      attributes"
    - Reve...

Changed in linux-azure (Ubuntu Lunar):
status: Fix Committed → Fix Released
Revision history for this message
Tim Gardner (timg-tpi) wrote :
Tim Gardner (timg-tpi)
Changed in linux-azure (Ubuntu Kinetic):
status: In Progress → Fix Committed
Tim Gardner (timg-tpi)
Changed in linux-azure (Ubuntu Lunar):
status: Fix Released → Fix Committed
Changed in linux-azure (Ubuntu Jammy):
status: In Progress → Won't Fix
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-azure/5.19.0-1028.31 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-kinetic' to 'verification-done-kinetic'. If the problem still exists, change the tag 'verification-needed-kinetic' to 'verification-failed-kinetic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-kinetic-linux-azure verification-needed-kinetic
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (383.7 KiB)

This bug was fixed in the package linux-azure - 5.19.0-1028.31

---------------
linux-azure (5.19.0-1028.31) kinetic; urgency=medium

  * kinetic/linux-azure: 5.19.0-1028.31 -proposed tracker (LP: #2019814)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync getabis

  * Azure: Add PCI pass-thru support to Hyper-V Confidential VMs (LP: #2015369)
    - x86/ioremap: Add hypervisor callback for private MMIO mapping in coco VM
    - x86/hyperv: Reorder code to facilitate future work
    - Drivers: hv: Explicitly request decrypted in vmap_pfn() calls
    - x86/mm: Handle decryption/re-encryption of bss_decrypted consistently
    - init: Call mem_encrypt_init() after Hyper-V hypercall init is done
    - x86/hyperv: Change vTOM handling to use standard coco mechanisms
    - SAUCE: swiotlb: Remove bounce buffer remapping for Hyper-V
    - SAUCE: Drivers: hv: vmbus: Remove second mapping of VMBus monitor pages
    - SAUCE: Drivers: hv: vmbus: Revert Dexuan's changes to hv_ringbuffer_init()
    - Drivers: hv: vmbus: Remove second way of mapping ring buffers
    - hv_netvsc: Remove second mapping of send and recv buffers
    - x86/hyperv: Block root partition functionality in a Confidential VM
    - x86/hyperv: Add support for detecting nested hypervisor
    - Drivers: hv: Setup synic registers in case of nested root partition
    - x86/hyperv: Add an interface to do nested hypercalls
    - Drivers: hv: Enable vmbus driver for nested root partition
    - Drivers: hv: Don't remap addresses that are above shared_gpa_boundary
    - PCI: hv: Enable PCI pass-thru devices in Confidential VMs
    - SAUCE: Drivers: hv: vmbus: Hardcode MMIO resources in vmbus_walk_resources()
      when necessary
    - SAUCE: x86/hyperv: Support hypercalls for TDX guests (part 2)
    - Drivers: hv: vmbus: Remove the per-CPU post_msg_page
    - PCI: hv: Replace retarget_msi_interrupt_params with hyperv_pcpu_input_arg

  * Azure: Limit Hyperv error messages (LP: #2019009)
    - drm/hyperv: Don't overwrite dirt_needed value set by host
    - drm/hyperv: Add ratelimit on error message

  * Azure: Enable MANA Jumbo Frame Support reprise (LP: #2018593)
    - net: mana: Rename mana_refill_rxoob and remove some empty lines
    - net: mana: Check if netdev/napi_alloc_frag returns single page

  [ Ubuntu: 5.19.0-44.45 ]

  * kinetic/linux: 5.19.0-44.45 -proposed tracker (LP: #2019827)
  * Linux 5.19 amdgpu: NULL pointer on GCN2 and invalid load on GCN1
    (LP: #2018470)
    - drm/amdgpu: Fix for BO move issue
  * CVE-2023-32233
    - netfilter: nf_tables: deactivate anonymous set from preparation phase
  * CVE-2023-2612
    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()
  * CVE-2023-31436
    - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  * CVE-2023-1380
    - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  * conntrack mark is not advertised via netlink (LP: #2016269)
    - netfilter: ctnetlink: revert to dumping mark regardless of event type
  * 5.19 not reporting cgroups v1 blkio.throttle.io_serviced (LP: #2016186)
    - SAUCE: blk-throttle: Fix io statistics for cgroup v...

Changed in linux-azure (Ubuntu Kinetic):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (74.4 KiB)

This bug was fixed in the package linux-azure - 6.2.0-1005.5

---------------
linux-azure (6.2.0-1005.5) lunar; urgency=medium

  * lunar/linux-azure: 6.2.0-1005.5 -proposed tracker (LP: #2019837)

  * Kernel 6.1 bumped the disk consumption on default images by 15%
    (LP: #2015867)
    - [Packaging] azure: introduce a separate linux-lib-rust package

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync getabis
    - debian/dkms-versions -- update from kernel-versions (main/master)

  * Azure: Add PCI pass-thru support to Hyper-V Confidential VMs (LP: #2015369)
    - x86/hyperv: Reorder code to facilitate future work
    - Drivers: hv: Explicitly request decrypted in vmap_pfn() calls
    - x86/mm: Handle decryption/re-encryption of bss_decrypted consistently
    - init: Call mem_encrypt_init() after Hyper-V hypercall init is done
    - x86/hyperv: Change vTOM handling to use standard coco mechanisms
    - swiotlb: Remove bounce buffer remapping for Hyper-V
    - Drivers: hv: vmbus: Remove second mapping of VMBus monitor pages
    - SAUCE: Drivers: hv: vmbus: Revert Dexuan's changes to hv_ringbuffer_init()
    - Drivers: hv: vmbus: Remove second way of mapping ring buffers
    - hv_netvsc: Remove second mapping of send and recv buffers
    - x86/hyperv: Block root partition functionality in a Confidential VM
    - x86/hyperv: Add support for detecting nested hypervisor
    - Drivers: hv: Setup synic registers in case of nested root partition
    - x86/hyperv: Add an interface to do nested hypercalls
    - Drivers: hv: Enable vmbus driver for nested root partition
    - Drivers: hv: Don't remap addresses that are above shared_gpa_boundary
    - PCI: hv: Enable PCI pass-thru devices in Confidential VMs
    - SAUCE: Drivers: hv: vmbus: Hardcode MMIO resources in vmbus_walk_resources()
      when necessary
    - SAUCE: x86/hyperv: Support hypercalls for TDX guests (part 2)
    - Drivers: hv: vmbus: Remove the per-CPU post_msg_page
    - PCI: hv: Replace retarget_msi_interrupt_params with hyperv_pcpu_input_arg
    - x86/hyperv: Fix hyperv_pcpu_input_arg handling when CPUs go online/offline
    - arm64/hyperv: Use CPUHP_AP_HYPERV_ONLINE state to fix CPU online sequencing

  * Azure: Enable MANA Jumbo Frame Support reprise (LP: #2018593)
    - net: mana: Rename mana_refill_rxoob and remove some empty lines
    - net: mana: Check if netdev/napi_alloc_frag returns single page

  * Azure: Enable MANA Jumbo Frame Support (LP: #2016898)
    - net: mana: Use napi_build_skb in RX path
    - net: mana: Refactor RX buffer allocation code to prepare for various MTU
    - net: mana: Enable RX path to handle various MTU sizes
    - net: mana: Add support for jumbo frame

  * Azure: Build-in TDX guest driver (LP: #2016995)
    - [Config] Azure: Build in TDX guest driver

  [ Ubuntu: 6.2.0-23.23 ]

  * lunar/linux: 6.2.0-23.23 -proposed tracker (LP: #2019845)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
    - debian/dkms-versions -- update from kernel-versions (main/2023.05.15)
  * Fix flicker display problem on some panels which support PSR2 (LP: #2002968)
    - drm/i915/psr: Add cont...

Changed in linux-azure (Ubuntu Lunar):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-azure/6.2.0-1009.9 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar' to 'verification-done-lunar'. If the problem still exists, change the tag 'verification-needed-lunar' to 'verification-failed-lunar'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-lunar-linux-azure verification-needed-lunar
Tim Gardner (timg-tpi)
tags: added: verification-done-kinetic verification-done-lunar
removed: verification-needed-kinetic verification-needed-lunar
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.