After dist-upgrade, s390x running X-fips/B-fips kernel will boot into generic kernel

[Po-Hsu Lin]

Issue found on s390x KVM

Steps:
1. Deploy a s390x KVM with Xenial
2. Enable -proposed
3. Enable FIPS ppa
4. Install the FIPS kernel with linux-fips meta package
5. reboot
6. dist-upgrade
7. reboot

The system will boot into the correct fips kernel on step 5, but it will boot into the generic kernel in proposed on step 7.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1845632

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Po-Hsu Lin (cypressyew)]

This issue is still affecting us.

We're now using a workaround (install meta package after dist-upgrade).
It's better to get this solved in the kernel.

[Sean Feole (sfeole)]

Hi Sam,

I think your more or less running into a workflow problem here, can you explain why you are running dist-upgrade , (step6). You should not need to do that. Steps 6 and 7 should be eliminated completely.

S390x Does not use grub as you are familiar with on other arches, zipl manages the kernels, most likely what is happening is another kernel is being installed during the dist upgrade at step 6 and re-writing zipl.conf.

[Sean Feole (sfeole)]

I've enabled all fips to be handled in ckct, marking bug invalid

[Po-Hsu Lin (cypressyew)]

This issue indicates that if any user try to run dist-upgrade for their system, they will likely boot into generic kernel instead of the FIPS kernel.

I would like to have this issue opened.

[Po-Hsu Lin (cypressyew)]

Or, if dist-upgrade is not something what a FIPS user should do, we can close this.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1845632

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Po-Hsu Lin (cypressyew)]

Oh btw,
IIRC this issue does not exist before I file this bug.

[Sean Feole (sfeole)]

Hey Sam,

As I mentioned in comment #4, this occurred due to the fact a newer kernel (4.15~94.95), was installed as a result from the dist upgrade. It would appear that you have enabled -proposed in /etc/apt/sources.list, which is the reason why in your logs. the 4.15.0-94.95 kernel is trying to install.

zipl.conf updated the configs to boot from the newly installed kernel.

As a result the linux-fips kernel takes a back seat and is moved up in the boot order from kernel #0 -> kernel #1

DEBUG - Processing triggers for ureadahead (0.100.0-21) ...
DEBUG - Processing triggers for ureadahead (0.100.0-21) ...
DEBUG - Processing triggers for linux-image-4.15.0-94-generic (4.15.0-94.95) ...
DEBUG - Processing triggers for linux-image-4.15.0-94-generic (4.15.0-94.95) ...
DEBUG - /etc/kernel/postinst.d/initramfs-tools:
DEBUG - /etc/kernel/postinst.d/initramfs-tools:
DEBUG - update-initramfs: Generating /boot/initrd.img-4.15.0-94-generic
DEBUG - update-initramfs: Generating /boot/initrd.img-4.15.0-94-generic
DEBUG - Using config file '/etc/zipl.conf'
DEBUG - Using config file '/etc/zipl.conf'
DEBUG - Building bootmap in '/boot'
DEBUG - Building bootmap in '/boot'
DEBUG - Adding IPL section 'ubuntu' (default)
DEBUG - Adding IPL section 'ubuntu' (default)
DEBUG - Preparing boot device: vda (0000).
DEBUG - Preparing boot device: vda (0000).
DEBUG - Done.
DEBUG - Done.
DEBUG - /etc/kernel/postinst.d/zz-zipl:
DEBUG - /etc/kernel/postinst.d/zz-zipl:
DEBUG - Using config file '/etc/zipl.conf'
DEBUG - Using config file '/etc/zipl.conf'
DEBUG - Building bootmap in '/boot'
DEBUG - Building bootmap in '/boot'
DEBUG - Adding IPL section 'ubuntu' (default)
DEBUG - Adding IPL section 'ubuntu' (default)
DEBUG - Preparing boot device: vda (0000).
DEBUG - Preparing boot device: vda (0000).
DEBUG - Done.
DEBUG - Done.
DEBUG - Leave Shell::ssh

This is not a bug and working as expected, moving testing of thie kernel to ckct.