[22.04 FEAT] KVM: Improve SIGP architectural compliance

[bugproxy]

Linux as a guest operating system often doesn't have as stringent requirements to architectural compliance as traditional operating systems that rely on it. Specifically, KVM implements the SIGP RESTART in a non-compliant way, as it reports a CPU state to be stopped after SIGP RESTART was issued, while it should report a busy condition until the CPU is really started. This feature covers the necessary fixes/improvements to KVM SIGP processing.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2022-02-01 21:31 EDT-------
The following three patches are needed:

[1] 812de04661c4 KVM: s390: Clarify SIGP orders versus STOP/RESTART

This one was added to linux-stable, and exists beginning with 5.4.173
eric:linux-stable$ git log --oneline --max-count=1 origin/linux-5.4.y -- arch/s390/kvm/sigp.c
70ae85ca124e KVM: s390: Clarify SIGP orders versus STOP/RESTART
eric:linux-stable$ git tag --contains=70ae85ca124e
v5.4.173
v5.4.174

[2] 67cf68b6a5cc KVM: s390: Add a routine for setting userspace CPU state

[3] 8eeba194a32e KVM: s390: Simplify SIGP Set Arch handling

[Frank Heimes (fheimes)]

A build of a patched jammy kernel 5.15.0-19.19 is currently ongoing at PPA:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1959735/+packages
and is soon available for additional testing.

[Frank Heimes (fheimes)]

Patch request submitted:
https://lists.ubuntu.com/archives/kernel-team/2022-February/thread.html#127657
Updating status to 'In Progress'.

[Frank Heimes (fheimes)]

submitted a
v2: fixed hash, cherry picked from linux (instead of linux-next), based on 5.15.0-20.20
v3: reordered
https://lists.ubuntu.com/archives/kernel-team/2022-February/thread.html#127691

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2022-02-11 09:52 EDT-------
(In reply to comment #12)
> submitted a
> v2: fixed hash, cherry picked from linux (instead of linux-next), based on
> 5.15.0-20.20
> https://lists.ubuntu.com/archives/kernel-team/2022-February/thread.
> html#127691

@Frank, sorry about my ignorance. In the link above I see patches [2] and [3], but not [1] (although I see it's part of your PPA build). Is this because [1] is in stable or an oversight?

[Frank Heimes (fheimes)]

Hi Viktor, well, the views on this ticket from BZ and LP are different which can be sometimes confusing - especially the numbering of the comments is different.
And especially in this case I had to re-send the patch request to the kernel teams mailing list.
So let me summarize again:

This is the patch request (v3) as it got accepted and included:
https://lists.ubuntu.com/archives/kernel-team/2022-February/thread.html#127697
(The above link is to the thread view and consists of:
cover-letter:
https://lists.ubuntu.com/archives/kernel-team/2022-February/127697.html
patch/commit 1/2:
https://lists.ubuntu.com/archives/kernel-team/2022-February/127698.html
patch/commit 2/2:
https://lists.ubuntu.com/archives/kernel-team/2022-February/127699.html
)

And this is the PPA where the test kernel can be found:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1959735

[Frank Heimes (fheimes)]

I should have added that it is for now accepted by the kernel team and got applied to jammy's master-next tree.
It's not yet available via the common archive until the kernel SRU cycle is fully completed (hence the PPA).

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2022-02-11 10:43 EDT-------
(In reply to comment #16)
> Hi Viktor, well, the views on this ticket from BZ and LP are different which
> can be sometimes confusing - especially the numbering of the comments is
> different.
> And especially in this case I had to re-send the patch request to the kernel
> teams mailing list.
> So let me summarize again:
>
> This is the patch request (v3) as it got accepted and included:
> https://lists.ubuntu.com/archives/kernel-team/2022-February/thread.
> html#127697
> (The above link is to the thread view and consists of:
> cover-letter:
> https://lists.ubuntu.com/archives/kernel-team/2022-February/127697.html
> patch/commit 1/2:
> https://lists.ubuntu.com/archives/kernel-team/2022-February/127698.html
> patch/commit 2/2:
> https://lists.ubuntu.com/archives/kernel-team/2022-February/127699.html
> )
>
> And this is the PPA where the test kernel can be found:
> https://launchpad.net/~fheimes/+archive/ubuntu/lp1959735

Hi Frank, I was referring to
[1] 812de04661c4 KVM: s390: Clarify SIGP orders versus STOP/RESTART
which was not contained in the series you posted. But I can see it is contained in the PPA's diff and that is what's puzzling me.

[Frank Heimes (fheimes)]

Hi Viktor,
that is because 812de04661c4 "KVM: s390: Clarify SIGP orders versus STOP/RESTART" was already included jammy's master-next tree - it obviously came in with a different ticket.
I just looked it up it came in via this upstream stable ticket LP#1958977, with that this particular patch is included since kernel Ubuntu-5.15.0-19.19.
(Hence IBM must have that marked as upstream stable, and we picked it from there.)
Hence I only needed to pick and sent the remaining two:
435d17955519 "KVM: s390: Add a routine for setting userspace CPU state"
and
4563bcad46bf "KVM: s390: Simplify SIGP Set Arch handling"

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2022-02-14 03:14 EDT-------
Perfect, thanks for clarifying, Frank.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.15.0-23.23

---------------
linux (5.15.0-23.23) jammy; urgency=medium

  * jammy/linux: 5.15.0-23.23 -proposed tracker (LP: #1964573)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync dkms-build{,--nvidia-N} from LRMv5
    - debian/dkms-versions -- update from kernel-versions (main/master)

  * [22.04 FEAT] KVM: Enable GISA support for Secure Execution guests
    (LP: #1959977)
    - KVM: s390: pv: make use of ultravisor AIV support

  * intel_iommu breaks Intel IPU6 camera: isys port open ready failed -16
    (LP: #1958004)
    - SAUCE: iommu: intel-ipu: use IOMMU passthrough mode for Intel IPUs

  * CVE-2022-23960
    - ARM: report Spectre v2 status through sysfs
    - ARM: early traps initialisation
    - ARM: use LOADADDR() to get load address of sections
    - ARM: Spectre-BHB workaround
    - ARM: include unprivileged BPF status in Spectre V2 reporting
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
    - arm64: Add HWCAP for self-synchronising virtual counter
    - arm64: Add Cortex-X2 CPU part definition
    - arm64: add ID_AA64ISAR2_EL1 sys register
    - arm64: cpufeature: add HWCAP for FEAT_AFP
    - arm64: cpufeature: add HWCAP for FEAT_RPRES
    - arm64: entry.S: Add ventry overflow sanity checks
    - arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit
    - KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
    - arm64: entry: Make the trampoline cleanup optional
    - arm64: entry: Free up another register on kpti's tramp_exit path
    - arm64: entry: Move the trampoline data page before the text page
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors
    - arm64: entry: Move trampoline macros out of ifdef'd section
    - arm64: entry: Make the kpti trampoline's kpti sequence optional
    - arm64: entry: Allow the trampoline text to occupy multiple pages
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
    - arm64: entry: Add vectors that have the bhb mitigation sequences
    - arm64: entry: Add macro for reading symbol addresses from the trampoline
    - arm64: Add percpu vectors for EL1
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
    - arm64: Mitigate spectre style branch history side channels
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
    - arm64: Use the clearbhb instruction in mitigations
    - arm64: proton-pack: Include unprivileged eBPF status in Spectre v2
      mitigation reporting
    - ARM: fix build error when BPF_SYSCALL is disabled

  * CVE-2021-26401
    - x86/speculation: Use generic retpoline by default on AMD
    - x86/speculation: Update link to AMD speculation whitepaper
    - x86/speculation: Warn about Spectre v2 LFENCE mitigation
    - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT

  * CVE-2022-0001
    - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
    - x86/speculation: Add eIBRS + Retpoline options
    - Document...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-oracle-5.15/5.15.0-1006.8~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Frank Heimes (fheimes)]

This bug is already Fix Released and closed and was requested for jammy only.
So it wasn't requested for focal, hence updating the tags to 'verification-done-focal' to unblock any processes.