[Bug 1877089] Re: zfcpdump kernel can not be IPLed, wrong file name

[Frank Heimes]

@brian-murray and @acb
This bug is in between 'Fix Released' for groovy.
Please see also zfcpdump-kernel changelog:
zfcpdump-kernel (5.4-0ubuntu2) groovy; urgency=medium
  * Switch to 5.4 base from focal (5.4.0-49.53).
  * Drop fix to zfcpdump config, included in 5.4.
  * Rename zfcpdump_part.image, to zfcpdump-image, to match current
    s390-tools expectations. LP: #1877089
The zfcpdump kernel got now updated to the focal kernel.

I think that this bug was raised right after focal was released (and probably before groovy development was really open) - it had initially only a series entry for focal and it was at the beginning assumed that only focal is affected (groovy s390-tool was not there yet).
It took a while to get this topics discussed and achieve more clarification (and the bug states changed quite a bit).
At some point in time a first upload was done on focal - that got dropped then and replaced by a revised version that still sits in focal unapproved (since 2020-09-17)
https://launchpad.net/ubuntu/focal/+queue?queue_state=1&queue_text=zfcpdump-kernel

Meanwhile groovy evolved and it became clear that this needs to be
tacked too, but the first focal upload was already out. Hence the groovy
upload came late, means after focal (so too late according to the SRU
process, hence comment #15).

Since the zfcpdump-kernel package/image is quite self sufficient and
static, the regression risk is very low, since the zfcpdump-kernel image
is even independent from the OS series, hence it can be build in one
series (now focal) and then be used in focal or newer. Please see also
bug description: [Publication] and [Regression Potential]

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to s390-tools in Ubuntu.
https://bugs.launchpad.net/bugs/1877089

Title:
  zfcpdump kernel can not be IPLed, wrong file name

Status in Ubuntu on IBM z Systems:
  In Progress
Status in s390-tools package in Ubuntu:
  Invalid
Status in zfcpdump-kernel package in Ubuntu:
  Fix Released
Status in zfcpdump-kernel source package in Focal:
  Confirmed
Status in zfcpdump-kernel source package in Groovy:
  Fix Released

Bug description:
  [Impact]

   * zfcpdump-kernel incompatible with s390-tools in focal, due to wrong file name, needed in focal and up
   * zfcpdump-kernel incompatible with SIPL (secure IPL), and will not be fixed.

   * Upgrade to the v5.4 kernel
   * Signing will not be enabled
   * Update the path of the image, to the one that `zipl -d` in focal expects

  [Test Case]

   * Prepare sda1 drive for SCSI dump
   * Stop all processes from the HMC
   * Perform SCSI dump load from HMC
   * Observe that dump is successful and used v5.4 kernel from the Operating System Messages
   * Perform regular boot
   * Mount the dump, and observe it is there in full

   * Can be performed on the canonical z13 hmc without SIPL
   * zfcpdump with secureboot will not be possible

  [Publication]

   * zfcpdump-kernel image is OS series independant, and thus can be
  build in focal with copies up to groovy.

  [Regression Potential]

   * The kernel image used for zfcpdump is fairly static, doesn't have
  loadable modules, but it does allow reading kernel memory which in
  theory is not in the same spirit as lockdown. However, stopping all
  processes and triggering scsi-dump is a priviledged HMC operation that
  is otheriwse has a much higher access restrictions than lockdown can
  provide.

  [Other Info]

   * Original bug report

  I installed Ubuntu 20.04 on IBM z15 with secure=1 in zipl conf.
  System can be secure booted, /sys/firmware/ipl/secure shows "1".
  I prepared zfcp dump disk as described in LTC bug 185713.
  Stopped the system and performed a SCSI dump with "Enable Secure Boot for Linux" enabled.

  Operating System Messages on HMC:
  Preparing system.
  Starting system.
  System version 8.
  Watchdog enabled.
  Running 'ZBootLoader' version '1.0.0' level 'D41C.D41C_0014'.
  ZBootLoader 2.1.0.
  MLOLOA6269064E Secure IPL: There are no signed components available on device HB
  A=0.0.1800, WWPN=500507630309D327, LUN=4046400900000000.
  IPL failed.

  Without "Enable Secure Boot for Linux" the dump kernel was IPLed and a
  dump created.

  Then I tried to rewrite the zfcp dump kernel with explicite setting of --secure=1:
  root at t35lp25:~# zipl --secure=1 -d /dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1
  Building bootmap directly on partition '/dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1'
  Adding dump section
    initial ramdisk...: /lib/s390-tools/zfcpdump/zfcpdump-initrd
    kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
    kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_disable=memory '
    component address:
      heap area.......: 0x00002000-0x00005fff
      stack area......: 0x0000f000-0x0000ffff
      internal loader.: 0x0000a000-0x0000dfff
      parameters......: 0x00009000-0x000091ff
      kernel image....: 0x00010000-0x001b9fff
      parmline........: 0x001ba000-0x001ba1ff
      initial ramdisk.: 0x001c0000-0x0020edff
  Preparing boot device: sde.
  Done.

  ...and tried to SCSI dump this device again. But the same  failure occured.
  Again, without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1877089/+subscriptions