[Bug 1877089] Comment bridged from LTC Bugzilla

[bugproxy]

------- Comment From PRudo at de.ibm.com 2020-05-12 11:56 EDT-------
Hi xnox,

we need a separate flavor because zfcpdump kernels (on pre z15) are
limited to 64M of memory. Any stock kernel would run oom in such a
constrained environment.

(In reply to comment #11)
> Hm, I'm not sure we can sign the zfcpdump-kernel.
>
> By convention, in Focal, signed kernels enforce signed module loading &
> lockdown that prevents unsigned module loading, kexec unsigned kernels or
> reading arbitrary kernel memory from userspace. And I am under impression
> that zfcpdump kernel/initrd rely on being able to read kernel memory.

hmm... not sure if this is really a problem
* the kernel is build without CONFIG_MODULES so all of the non existing kernel modules are automatically signed
* not sure how lockdown works in detail but zfcpdump only needs access to /proc/vmcore which should still be possible. Otherwise kdump would be broken as well.
* kexec is not needed. init is replaced by a piece of code that simply copies /proc/vmcore to disc and reboots.

> The zfcpdump-kernel flavour currently is built using zfcpdump_defconfig. I
> would be more comfortable if we could use the stock signed kernel image as
> the zfcpdump one, instead of the purpose built one. And include any missing
> modules in the zfcpdump initrd and/or adjust the cmdline to do things like
> PANIC_ON_OOPS=y. But i guess we will not get CONFIG_CC_OPTIMIZE_FOR_SIZE=y
> with the stock kernel image.

As said before the stock kernel won't run on a pre z15 machine. On z15
(needed for secure boot anyway) that might be an option as the HSA area
(the piece of memory the zfcpdump kernel runs in) was increased to 512M.
That's more than usually reserved for a kdump kernel, and should be
enough for any stock kernel.

The problem is that zfcpdumps design never considered such an option so
it won't run out of the box. Furthermore you would then need to support
two different dump methods depending on the machine generation you are
running on as long as any pre z15 machine is supported.

I must admit that getting rid of this monstrosity would be great but I
don't think it will happen any time soon.

> Does zfcdump work with locked-down kernels?

Not sure never tried.

Philipp

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to s390-tools in Ubuntu.
https://bugs.launchpad.net/bugs/1877089

Title:
  zfcpdump kernel can not be IPLed when secure boot is requested

Status in Ubuntu on IBM z Systems:
  Triaged
Status in s390-tools package in Ubuntu:
  Invalid
Status in zfcpdump-kernel package in Ubuntu:
  Confirmed
Status in zfcpdump-kernel source package in Focal:
  Confirmed
Status in zfcpdump-kernel source package in Groovy:
  Confirmed

Bug description:
  I installed Ubuntu 20.04 on IBM z15 with secure=1 in zipl conf.
  System can be secure booted, /sys/firmware/ipl/secure shows "1".
  I prepared zfcp dump disk as described in LTC bug 185713.
  Stopped the system and performed a SCSI dump with "Enable Secure Boot for Linux" enabled.

  Operating System Messages on HMC:
  Preparing system.
  Starting system.
  System version 8.
  Watchdog enabled.
  Running 'ZBootLoader' version '1.0.0' level 'D41C.D41C_0014'.
  ZBootLoader 2.1.0.
  MLOLOA6269064E Secure IPL: There are no signed components available on device HB
  A=0.0.1800, WWPN=500507630309D327, LUN=4046400900000000.
  IPL failed.

  Without "Enable Secure Boot for Linux" the dump kernel was IPLed and a
  dump created.

  Then I tried to rewrite the zfcp dump kernel with explicite setting of --secure=1:
  root at t35lp25:~# zipl --secure=1 -d /dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1
  Building bootmap directly on partition '/dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1'
  Adding dump section
    initial ramdisk...: /lib/s390-tools/zfcpdump/zfcpdump-initrd
    kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
    kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_disable=memory '
    component address:
      heap area.......: 0x00002000-0x00005fff
      stack area......: 0x0000f000-0x0000ffff
      internal loader.: 0x0000a000-0x0000dfff
      parameters......: 0x00009000-0x000091ff
      kernel image....: 0x00010000-0x001b9fff
      parmline........: 0x001ba000-0x001ba1ff
      initial ramdisk.: 0x001c0000-0x0020edff
  Preparing boot device: sde.
  Done.

  ...and tried to SCSI dump this device again. But the same  failure occured.
  Again, without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1877089/+subscriptions