[21.10 FEAT] zcrypt DD: CEX8 toleration

[bugproxy]

The CEX8 adapter shall support quantum-safe crypto and therefore requires message sizes > 12kB.
This change is mainly required to support EP11 responses to admin requests at zNext which due to QS certificates can grow larger than 12kB.

This is to cover a minimal patch to provide toleration support for this feature which shall be back-ported to all distribution releases in service at zNext

Kernel level >= 5.14

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-08-12 16:46 EDT-------
Fix available upstream in kernel 5.14
upstream commit: bd39654a2282 s390/AP: support new dynamic AP bus size limit

[Frank Heimes (fheimes)]

A patched impish kernel 5.13 is being build here for further testing:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1933805

[Frank Heimes (fheimes)]

Patch request submitted:
https://lists.ubuntu.com/archives/kernel-team/2021-August/thread.html#123207
changing status to 'In Progress'.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Andy Whitcroft (apw)]

Though this is not at all clear, this focal verification request is for focal:linux-oem-5.13.

[Frank Heimes (fheimes)]

Ok, since there is no linux-oem-5.13 for s390x, I'm setting the tags to "verification done on focal", to unblock this ticket. (Thx for the clarification apw.)

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-09-14 08:09 EDT-------
(In reply to comment #9)
> This bug is awaiting verification that the kernel in -proposed solves the
> problem. Please test the kernel and update this bug with the results. If the
> problem is solved, change the tag 'verification-needed-focal' to
> 'verification-done-focal'. If the problem still exists, change the tag
> 'verification-needed-focal' to 'verification-failed-focal'.
>
> If verification is not done by 5 working days from today, this fix will be
> dropped from the source code, and this bug will be closed.
>
> See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to
> enable and use -proposed. Thank you!

It would be nice to have something to verify ...
Could you please give me a git repo to pick and build from or a kernel package which I could install ? And please note that as of now I don't have any access to a 21.10 ubuntu either. However, I think I could use a 21.04 for the verification if I would get something to verify.

[Frank Heimes (fheimes)]

Hi Harald,
you can test the patched kernel packages that I created and referenced in comment #2:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1933805/comments/2

Or in case you want to have a look at the code, you may have a look at the submission mails that I've sent to the kernel teams mailing list and that I referened in comment #3:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1933805/comments/3
which actually points to:
https://lists.ubuntu.com/archives/kernel-team/2021-August/thread.html#123207

But there can be challenges to install an 21.10 5.13 kernel on a different Ubuntu release, due to glibc updates.

And btw. Impish daily build ISO images can be found here:
https://cdimage.ubuntu.com/ubuntu-server/daily-live/current/

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-09-15 11:54 EDT-------
Ok, with the help of Christian I finally could upgrade a system to Ubuntu 21.10.
Then I downloaded the dep files from franks build and installed them. Here is the uname output:
root@t8314009:~# uname -a
Linux t8314009.lnxne.boe 5.13.0-14-generic #14~lp1933805-Ubuntu SMP Mon Aug 16 07:17:43 UTC 2021 s390x s390x s390x GNU/Linux
So Frank's kernel is running.

I ran my zcrypt tests and also checked that everything I would expect is there (for example the new /sys/devices/ap/cardxx/max_msg_size sysfs attributes).

However, as there is currently worldwide no s390 Linux system running with access to the new crypto card generation this part of the test needs to be postponed to a later time ... I guess, I'll have access in about 4 weeks.

I take this as 'verified' now.

[Frank Heimes (fheimes)]

Looks like did the best that is currently possible.
So thx for the verification, Harald!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.13.0-16.16

---------------
linux (5.13.0-16.16) impish; urgency=medium

  * impish/linux: 5.13.0-16.16 -proposed tracker (LP: #1942611)

  * Miscellaneous Ubuntu changes
    - [Config] update toolchain in configs

  * Miscellaneous upstream changes
    - Revert "UBUNTU: [Config] Enable CONFIG_UBSAN_BOUNDS"

 -- Andrea Righi <email address hidden> Fri, 03 Sep 2021 16:21:14 +0200

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-09-17 04:59 EDT-------
Fix verified and landed in impish / U21.10, hence closing the bug.
IBM BZ status: ->CLOSED