zfcpdump kernel can not be IPLed, wrong file name
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Ubuntu on IBM z Systems |
Fix Released
|
High
|
Skipper Bug Screeners | ||
s390-tools (Ubuntu) |
Invalid
|
Undecided
|
Canonical Foundations Team | ||
zfcpdump-kernel (Ubuntu) |
Fix Released
|
Undecided
|
Canonical Kernel Team | ||
Focal |
Fix Released
|
Undecided
|
Canonical Kernel Team | ||
Groovy |
Fix Released
|
Undecided
|
Canonical Kernel Team |
Bug Description
[Impact]
* zfcpdump-kernel incompatible with s390-tools in focal, due to wrong file name, needed in focal and up
* zfcpdump-kernel incompatible with SIPL (secure IPL), and will not be fixed.
* Upgrade to the v5.4 kernel
* Signing will not be enabled
* Update the path of the image, to the one that `zipl -d` in focal expects
[Test Case]
* Prepare sda1 drive for SCSI dump
* Stop all processes from the HMC
* Perform SCSI dump load from HMC
* Observe that dump is successful and used v5.4 kernel from the Operating System Messages
* Perform regular boot
* Mount the dump, and observe it is there in full
* Can be performed on the canonical z13 hmc without SIPL
* zfcpdump with secureboot will not be possible
[Publication]
* zfcpdump-kernel image is OS series independant, and thus can be build in focal with copies up to groovy.
[Regression Potential]
* The kernel image used for zfcpdump is fairly static, doesn't have loadable modules, but it does allow reading kernel memory which in theory is not in the same spirit as lockdown. However, stopping all processes and triggering scsi-dump is a priviledged HMC operation that is otheriwse has a much higher access restrictions than lockdown can provide.
[Other Info]
* Original bug report
I installed Ubuntu 20.04 on IBM z15 with secure=1 in zipl conf.
System can be secure booted, /sys/firmware/
I prepared zfcp dump disk as described in LTC bug 185713.
Stopped the system and performed a SCSI dump with "Enable Secure Boot for Linux" enabled.
Operating System Messages on HMC:
Preparing system.
Starting system.
System version 8.
Watchdog enabled.
Running 'ZBootLoader' version '1.0.0' level 'D41C.D41C_0014'.
ZBootLoader 2.1.0.
MLOLOA6269064E Secure IPL: There are no signed components available on device HB
A=0.0.1800, WWPN=5005076303
IPL failed.
Without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.
Then I tried to rewrite the zfcp dump kernel with explicite setting of --secure=1:
root@t35lp25:~# zipl --secure=1 -d /dev/disk/
Building bootmap directly on partition '/dev/disk/
Adding dump section
initial ramdisk...: /lib/s390-
kernel image......: /lib/s390-
kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_
component address:
heap area.......: 0x00002000-
stack area......: 0x0000f000-
internal loader.: 0x0000a000-
parameters.
kernel image....: 0x00010000-
parmline.
initial ramdisk.: 0x001c0000-
Preparing boot device: sde.
Done.
...and tried to SCSI dump this device again. But the same failure occured.
Again, without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.
tags: | added: architecture-s39064 bugnameltc-185720 severity-high targetmilestone-inin2004 |
Changed in ubuntu: | |
assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
affects: | ubuntu → linux (Ubuntu) |
Changed in ubuntu-z-systems: | |
importance: | Undecided → High |
Changed in zfcpdump-kernel (Ubuntu): | |
assignee: | nobody → Canonical Kernel Team (canonical-kernel-team) |
Changed in s390-tools (Ubuntu): | |
assignee: | nobody → Canonical Foundations Team (canonical-foundations) |
Changed in ubuntu-z-systems: | |
assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
Changed in ubuntu-z-systems: | |
status: | New → Triaged |
Changed in zfcpdump-kernel (Ubuntu Focal): | |
assignee: | nobody → Canonical Kernel Team (canonical-kernel-team) |
Changed in ubuntu-z-systems: | |
status: | Triaged → Confirmed |
description: | updated |
description: | updated |
Changed in ubuntu-z-systems: | |
status: | Confirmed → In Progress |
Changed in zfcpdump-kernel (Ubuntu Focal): | |
status: | Confirmed → In Progress |
Changed in zfcpdump-kernel (Ubuntu Groovy): | |
status: | Confirmed → In Progress |
Changed in zfcpdump-kernel (Ubuntu Groovy): | |
status: | In Progress → Won't Fix |
Changed in zfcpdump-kernel (Ubuntu Focal): | |
status: | In Progress → Won't Fix |
Changed in ubuntu-z-systems: | |
status: | In Progress → Won't Fix |
Changed in zfcpdump-kernel (Ubuntu): | |
status: | In Progress → Won't Fix |
Changed in zfcpdump-kernel (Ubuntu): | |
status: | Won't Fix → Confirmed |
Changed in zfcpdump-kernel (Ubuntu Focal): | |
status: | Won't Fix → Confirmed |
Changed in zfcpdump-kernel (Ubuntu Groovy): | |
status: | Won't Fix → Confirmed |
summary: |
- zfcpdump kernel can not be IPLed when secure boot is requested + zfcpdump kernel can not be IPLed, wrong file name |
description: | updated |
description: | updated |
Changed in ubuntu-z-systems: | |
status: | Won't Fix → In Progress |
Changed in ubuntu-z-systems: | |
status: | In Progress → Fix Committed |
Changed in ubuntu-z-systems: | |
status: | Fix Committed → Fix Released |
We can either revert the path change in s390-tools or rebuild the zfcpdump kernel flavour with the new name.