linux-azure: CONFIG_FB_EFI=y

[Tim Gardner]

SRU Justification

[Impact]

Secure boot instances of linux-azure require an EFI framebuffer in some cases in order for the VM to boot.

The issue was noticed in Ubuntu 18.04 linux-azure kernel, but actually exists in the latest mainline kernel. The issue happens when the below conditions are met:

hyperv_pci is built into the kernel and hyperv_fb is not, i.e., this means hyperv_pci loads before hyperv_fb loads.
CONFIG_FB_EFI is not defined, i.e., the efifb driver is not used.

Here is how the bug happens:

Linux VM starts, and vmbus_reserve_fb() reserves the VRAM [base=0xf8000000, length=8MB].
hyper-pci loads, gets MMIO [base=0xf8800000, lengh=8KB] as the bridge config window, and may get some other 64-bit MMIO ranges, and some 32-bit MMIO ranges (if needed.)
hyperv-fb loads, and gets MMIO [base=0xf8000000, lengh=8MB or a different length], and sets screen_info.lfb_base = 0.
VM panics.
The kdump kernel starts to run, and vmbus_reserve_fb() is not reserving [base=0xf8000000, length=8MB] due to the lfb_base==0.
hyperv-pci loads and gets [base=0xf8000000, lengh=8KB] and the host PCI VSP driver rejects this address as the bridge config window.

The crux of the problem is that Linux vmbus driver itself is unable to detect the VRAM base/length (it looks like a video BIOS call is needed to get this info and such a BIOS call is inappropriate or impossible in hv_vmbus) and has to rely on screen_info.lfb_base (which is set by grub or the kdump/kexec tool and can be reset to zero by hyperv_fb/drm).

Solution: Enable CONFIG_FB_EFI=y

[Test Case]

Microsoft tested. This config is also enabled on the master branch.

[Where things could go wrong]

VMs on certain instance types could fail to boot.

[Other Info]

SF: #00327005

[Tim Gardner (timg-tpi)]

https://lists.ubuntu.com/archives/kernel-team/2022-January/127528.html

[Dexuan Cui (decui)]

The 5.4-based linux-azure kenel (https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-azure/+git/bionic/log/?h=azure-5.4) is also affected by the bug. Will it be fixed as well? I see the 4.15, 5.11, 5.13 linux-azure kernels are explicited listed at the top of this page, but the 5.14-based one is not listed.

[Dexuan Cui (decui)]

typo... By "but the 5.14-based one is not listed.", I meant the "... 5.4-based ...", not 5.14-based.

[Tim Gardner (timg-tpi)]

Dexuan - focal/linux-azure is the 5.4 based kernel.

[Dexuan Cui (decui)]

Hi Tim, thanks! I saw the CONFIG_FB_EFI=y change to the v5.4 linux-azure focal/master-next branch here:
https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-azure/+git/focal/log/?h=master-next

My Ubuntu 18.04 (Bionic) VM, which was created from the Azure marketplace Ubuntu 18.04 image, has the kernel 5.4 kernel by default:

root@decui-u1804-cifs-101:~# cat /etc/os-release
NAME="Ubuntu"
VERSION="18.04.6 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.6 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

root@decui-u1804-cifs-101:~# uname -a
Linux decui-u1804-cifs-101 5.4.0-1068-azure #71~18.04.1-Ubuntu SMP Thu Jan 20 08:21:40 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

I suppose my 18.04 VM will automatically get a new 5.4 kernel that has CONFIG_FB_EFI=y.

[Tim Gardner (timg-tpi)]

Dexuan - that is correct. Bionic/azure-5.4 inherits from Focal/azure.

[Dexuan Cui (decui)]

Got it. I apprecite the clarification. Obviously I was not clear on this :-)

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/5.4.0-1070.73 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Tim Gardner (timg-tpi)]

wget https://launchpad.net/~canonical-kernel-team/+archive/ubuntu/ppa/+files/linux-buildinfo-5.4.0-1070-azure_5.4.0-1070.73_amd64.deb
dpkg -x linux-buildinfo-5.4.0-1070-azure_5.4.0-1070.73_amd64.deb .
grep CONFIG_FB_EFI ./usr/lib/linux/5.4.0-1070-azure/config
CONFIG_FB_EFI=y

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure/5.13.0-1014.16 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-impish' to 'verification-done-impish'. If the problem still exists, change the tag 'verification-needed-impish' to 'verification-failed-impish'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ian May (ian-may)]

wget https://launchpad.net/~canonical-kernel-team/+archive/ubuntu/ppa/+files/linux-buildinfo-5.13.0-1014-azure_5.13.0-1014.16_amd64.deb
dpkg -x linux-buildinfo-5.13.0-1014-azure_5.13.0-1014.16_amd64.deb .
grep CONFIG_FB_EFI ./usr/lib/linux/5.13.0-1014-azure/config
CONFIG_FB_EFI=y

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 5.4.0-1070.73

---------------
linux-azure (5.4.0-1070.73) focal; urgency=medium

  * focal/linux-azure: 5.4.0-1070.73 -proposed tracker (LP: #1959251)

  * Packaging resync (LP: #1786013)
    - [Packaging] azure: config resync

  * Focal update: v5.4.165 upstream stable release (LP: #1957007)
    - HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option

  * linux-azure: CONFIG_FB_EFI=y (LP: #1959216)
    - [Config] CONFIG_FB_EFI=y

  * Add sunrpc module parameters for NFSv3 nconnect (LP: #1958990)
    - SAUCE: Add sunrpc module parameters for NFSv3 nconnect

  [ Ubuntu: 5.4.0-100.113 ]

  * focal/linux: 5.4.0-100.113 -proposed tracker (LP: #1959900)
  * CVE-2022-22942
    - SAUCE: drm/vmwgfx: Fix stale file descriptors on failed usercopy
  * CVE-2022-0330
    - drm/i915: Flush TLBs before releasing backing store
  * Focal update: v5.4.166 upstream stable release (LP: #1957008)
    - netfilter: selftest: conntrack_vrf.sh: fix file permission
    - Linux 5.4.166
    - net/packet: rx_owner_map depends on pg_vec
    - USB: gadget: bRequestType is a bitfield, not a enum
    - HID: holtek: fix mouse probing
    - udp: using datalen to cap ipv6 udp max gso segments
    - selftests: Calculate udpgso segment count without header adjustment
  * Focal update: v5.4.165 upstream stable release (LP: #1957007)
    - serial: tegra: Change lower tolerance baud rate limit for tegra20 and
      tegra30
    - ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type
    - HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
    - HID: google: add eel USB id
    - HID: add hid_is_usb() function to make it simpler for USB detection
    - HID: add USB_HID dependancy to hid-prodikeys
    - HID: add USB_HID dependancy to hid-chicony
    - HID: add USB_HID dependancy on some USB HID drivers
    - HID: bigbenff: prevent null pointer dereference
    - HID: wacom: fix problems when device is not a valid USB device
    - HID: check for valid USB device for many HID drivers
    - can: kvaser_usb: get CAN clock frequency from device
    - can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct
      stats->{rx,tx}_errors counter
    - can: sja1000: fix use after free in ems_pcmcia_add_card()
    - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    - selftests: netfilter: add a vrf+conntrack testcase
    - vrf: don't run conntrack on vrf with !dflt qdisc
    - bpf: Fix the off-by-two error in range markings
    - ice: ignore dropped packets during init
    - bonding: make tx_rebalance_counter an atomic
    - nfp: Fix memory leak in nfp_cpp_area_cache_add()
    - seg6: fix the iif in the IPv6 socket control block
    - udp: using datalen to cap max gso segments
    - iavf: restore MSI state on reset
    - iavf: Fix reporting when setting descriptor count
    - IB/hfi1: Correct guard on eager buffer deallocation
    - mm: bdi: initialize bdi_min_ratio when bdi is unregistered
    - ALSA: ctl: Fix copy of updated id with element read/write
    - ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
    - ALSA: pcm: oss: Fix negative period/buffer sizes
    - A...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 5.13.0-1014.16

---------------
linux-azure (5.13.0-1014.16) impish; urgency=medium

  * impish/linux-azure: 5.13.0-1014.16 -proposed tracker (LP: #1960044)

  * linux-azure: CONFIG_FB_EFI=y (LP: #1959216)
    - [Config] azure: CONFIG_FB_EFI=y

  * Add sunrpc module parameters for NFSv3 nconnect (LP: #1958990)
    - SAUCE: Add sunrpc module parameters for NFSv3 nconnect

  * MANA updates (LP: #1959012)
    - net: mana: Add RX fencing
    - net: mana: Fix memory leak in mana_hwc_create_wq

  * Enable arm64 for Hyper-V guests (LP: #1949770)
    - [Packaging] linux-azure: Add basic packaging support for arm64
    - [Config] azure: CONFIG_CMA=n [arm64]
    - Drivers: hv: Move Hyper-V extended capability check to arch neutral code
    - asm-generic/hyperv: Add missing #include of nmi.h
    - Drivers: hv: Make portions of Hyper-V init code be arch neutral
    - Drivers: hv: Add arch independent default functions for some Hyper-V
      handlers
    - kernel.h: split out panic and oops helpers
    - Drivers: hv: Move Hyper-V misc functionality to arch-neutral code
    - drivers: hv: Decouple Hyper-V clock/timer code from VMbus drivers
    - arm64: hyperv: Add Hyper-V hypercall and register access utilities
    - arm64: hyperv: Add panic handler
    - arm64: hyperv: Initialize hypervisor on boot
    - arm64: efi: Export screen_info
    - Drivers: hv: Enable Hyper-V code to be built on ARM64
    - PCI: hv: Support for create interrupt v3
    - PCI: Introduce domain_nr in pci_host_bridge
    - PCI: Support populating MSI domains of root buses via bridges
    - arm64: PCI: Restructure pcibios_root_bridge_prepare()
    - arm64: PCI: Support root bridge preparation for Hyper-V
    - PCI: hv: Generify PCI probing
    - PCI: hv: Set ->domain_nr of pci_host_bridge at probing time
    - PCI: hv: Turn on the host bridge probing on ARM64
    - PCI: hv: Set up MSI domain at bridge probing time
    - arm64: smccc: Add support for SMCCCv1.2 extended input/output registers
    - [Config] azure: Ignore initial arm64 ABI
    - PCI: hv: Make the code arch neutral by adding arch specific interfaces
    - PCI: hv: Add arm64 Hyper-V vPCI support
    - [Config] azure: Update arm64 policy for CONFIG_PCI_HYPERV

  * Support networking XDP (LP: #1958252)
    - net: mana: Use kcalloc() instead of kzalloc()
    - net: mana: Allow setting the number of queues while the NIC is down
    - net: mana: Fix the netdev_err()'s vPort argument in mana_init_port()
    - net: mana: Report OS info to the PF driver
    - net: mana: Improve the HWC error handling
    - net: mana: Support hibernation and kexec
    - net: mana: Fix spelling mistake "calledd" -> "called"
    - net: mana: Add XDP support

  [ Ubuntu: 5.13.0-30.33 ]

  * impish/linux: 5.13.0-30.33 -proposed tracker (LP: #1960055)
  * systemd/248.3-1ubuntu8.2 ADT test failure with linux/5.13.0-29.32
    (LP: #1960034)
    - Revert "block: avoid to quiesce queue in elevator_init_mq"
    - Revert "blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and
      disk_release()"

  [ Ubuntu: 5.13.0-29.32 ]

  * impish/linux: 5.13.0-29.32 -proposed tracker (LP: #1959238)
  * Packagi...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-azure-4.15/4.15.0-1132.145 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure-5.13 - 5.13.0-1014.16~20.04.1

---------------
linux-azure-5.13 (5.13.0-1014.16~20.04.1) focal; urgency=medium

  * focal/linux-azure-5.13: 5.13.0-1014.16~20.04.1 -proposed tracker
    (LP: #1960043)

  * Enable arm64 for Hyper-V guests (LP: #1949770)
    - [Packaging] linux-azure-5.13: Add basic packaging support for arm64
    - [Config] azure-5.13: CONFIG_CMA=n [arm64]
    - [Config] azure-5.13: Ignore initial arm64 ABI

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

  * linux-azure: CONFIG_FB_EFI=y (LP: #1959216)
    - [Config] azure-5.13: CONFIG_FB_EFI=y

  * Miscellaneous Ubuntu changes
    - [Config] azure-5.13: Automatic cc config updates.

  [ Ubuntu: 5.13.0-1014.16 ]

  * impish/linux-azure: 5.13.0-1014.16 -proposed tracker (LP: #1960044)
  * linux-azure: CONFIG_FB_EFI=y (LP: #1959216)
    - [Config] azure: CONFIG_FB_EFI=y
  * Add sunrpc module parameters for NFSv3 nconnect (LP: #1958990)
    - SAUCE: Add sunrpc module parameters for NFSv3 nconnect
  * MANA updates (LP: #1959012)
    - net: mana: Add RX fencing
    - net: mana: Fix memory leak in mana_hwc_create_wq
  * Enable arm64 for Hyper-V guests (LP: #1949770)
    - [Packaging] linux-azure: Add basic packaging support for arm64
    - [Config] azure: CONFIG_CMA=n [arm64]
    - Drivers: hv: Move Hyper-V extended capability check to arch neutral code
    - asm-generic/hyperv: Add missing #include of nmi.h
    - Drivers: hv: Make portions of Hyper-V init code be arch neutral
    - Drivers: hv: Add arch independent default functions for some Hyper-V
      handlers
    - kernel.h: split out panic and oops helpers
    - Drivers: hv: Move Hyper-V misc functionality to arch-neutral code
    - drivers: hv: Decouple Hyper-V clock/timer code from VMbus drivers
    - arm64: hyperv: Add Hyper-V hypercall and register access utilities
    - arm64: hyperv: Add panic handler
    - arm64: hyperv: Initialize hypervisor on boot
    - arm64: efi: Export screen_info
    - Drivers: hv: Enable Hyper-V code to be built on ARM64
    - PCI: hv: Support for create interrupt v3
    - PCI: Introduce domain_nr in pci_host_bridge
    - PCI: Support populating MSI domains of root buses via bridges
    - arm64: PCI: Restructure pcibios_root_bridge_prepare()
    - arm64: PCI: Support root bridge preparation for Hyper-V
    - PCI: hv: Generify PCI probing
    - PCI: hv: Set ->domain_nr of pci_host_bridge at probing time
    - PCI: hv: Turn on the host bridge probing on ARM64
    - PCI: hv: Set up MSI domain at bridge probing time
    - arm64: smccc: Add support for SMCCCv1.2 extended input/output registers
    - [Config] azure: Ignore initial arm64 ABI
    - PCI: hv: Make the code arch neutral by adding arch specific interfaces
    - PCI: hv: Add arm64 Hyper-V vPCI support
    - [Config] azure: Update arm64 policy for CONFIG_PCI_HYPERV
  * Support networking XDP (LP: #1958252)
    - net: mana: Use kcalloc() instead of kzalloc()
    - net: mana: Allow setting the number of queues while the NIC is down
    - net: mana: Fix the netdev_err()'s vPort argument in mana_init_port()
    - net: mana: Report OS info to the PF driver
    - net: mana: Improv...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure-4.15 - 4.15.0-1134.147

---------------
linux-azure-4.15 (4.15.0-1134.147) bionic; urgency=medium

  * bionic/linux-azure-4.15: 4.15.0-1134.147 -proposed tracker (LP: #1964222)

  * linux-azure: CONFIG_FB_EFI=y (LP: #1959216)
    - [Config] azure-4.15: CONFIG_FB_EFI=y

  [ Ubuntu: 4.15.0-172.181 ]

  * CVE-2022-0847
    - lib/iov_iter: initialize "flags" in new pipe_buffer
  * Bionic update: upstream stable patchset 2022-02-11 (LP: #1960681)
    - Bluetooth: bfusb: fix division by zero in send path
    - USB: core: Fix bug in resuming hub's handling of wakeup requests
    - USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
    - mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
    - can: gs_usb: fix use of uninitialized variable, detach device on reception
      of invalid USB data
    - can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
    - random: fix data race on crng_node_pool
    - random: fix data race on crng init time
    - staging: wlan-ng: Avoid bitwise vs logical OR warning in
      hfa384x_usb_throttlefn()
    - drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
    - orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
    - media: uvcvideo: fix division by zero at stream start
    - rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with
      interrupts enabled
    - Bluetooth: schedule SCO timeouts with delayed_work
    - Bluetooth: fix init and cleanup of sco_conn.timeout_work
    - HID: uhid: Fix worker destroying device without any protection
    - HID: wacom: Ignore the confidence flag when a touch is removed
    - HID: wacom: Avoid using stale array indicies to read contact count
    - nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed
      bind()
    - rtc: cmos: take rtc_lock while reading from CMOS
    - media: flexcop-usb: fix control-message timeouts
    - media: mceusb: fix control-message timeouts
    - media: em28xx: fix control-message timeouts
    - media: cpia2: fix control-message timeouts
    - media: s2255: fix control-message timeouts
    - media: dib0700: fix undefined behavior in tuner shutdown
    - media: redrat3: fix control-message timeouts
    - media: pvrusb2: fix control-message timeouts
    - media: stk1160: fix control-message timeouts
    - can: softing_cs: softingcs_probe(): fix memleak on registration failure
    - shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
    - PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
    - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
    - clk: bcm-2835: Pick the closest clock rate
    - clk: bcm-2835: Remove rounding up the dividers
    - wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
    - media: em28xx: fix memory leak in em28xx_init_dev
    - Bluetooth: stop proccessing malicious adv data
    - media: dmxdev: fix UAF when dvb_register_device() fails
    - crypto: qce - fix uaf on qce_ahash_register_one
    - tty: serial: atmel: Check return code of dmaengine_submit()
    - tty: serial: atmel: ...