[22.04 FEAT] KVM: Attestation support for Secure Execution (crypto)
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Ubuntu on IBM z Systems |
Fix Released
|
High
|
Skipper Bug Screeners | ||
| linux (Ubuntu) |
Invalid
|
High
|
Unassigned | ||
| Jammy |
Fix Released
|
High
|
Canonical Kernel Team | ||
Bug Description
SRU Justification:
==================
[Impact]
* This is a hardware enablement SRU in support of
IBM z15 and LinuxONE III (FC 115) secure execution feature.
* It adds a misc character device to expose some Ultravisor
functions to userspace.
* The device is only available if the (optional) Ultravisor
Facility (158) is present in the system.
* Two Ultravisor calls are supported:
- Query Ultravisor Information (QUI) and
- Receive Attestation Measurement (Attest[ation])
* This is in support of for example. external frameworks,
specific deployment models or especially
potentially regulatory requirements.
[Fix]
* 4689752c79fa 4689752c79fa30e
* eb3de2d8f78d eb3de2d8f78d893
* patch to set kernel config option 'CONFIG_
[Test Plan]
* An IBM z15 or LinuxONE III LPAR with FC 115 enabled is required.
* Installation of Ubuntu Server 22.04 LTS on top.
* Install a kernel that incl. the above patches/commits
(that has the kernel config option 'CONFIG_
* Activate the kernel (reboot) and look for the existence of
the uvdevice '/dev/uv'.
* Use a userspace test program that makes use of the new
misc device by exploiting 'ATTEST'.
* Due to hardware requirements this test needs to be conducted by IBM.
[Where problems could occur]
* The definitions in uv_cmds_inst and uv_feat_ind could be wrong
and the codes wrong or mixed up, which would lead to a broken
functionalit
* The uvdevice header definitions could be erroneous,
defining an wrong interface.
* The newly added kernel options could be implemented in a wrong way,
so that it doesn't enable the 'uvdevice', but unlikely.
* The implementation of the device itself in 'uvdevice.c' could be broken
by wrong or broken pointer arithmetics, wrong method arguments,
wrong sizeof/length calculations, which - in worst case - could entirely
crash a system.
* The ioctl control block implementation could be wrong in a way,
that it doesn't properly handle the case where the facility is not
available in the system.
* Entry point, copy and check routines could be wrong,
allowing non-desired calls.
* This is an s390x-only functionality,
that is only available on IBM z15 / LinuxONE III systems and newer,
and only is the optional feature 'FC 115' in place,
which is limited to 'secure-execution' workloads.
[Other Info]
* The above commit is marked to be merged into 5.19-rc2,
and since the planned target kernel for kinetic is
5.19, the SRU is not needed for kinetic.
__________
KVM: Attestation support for Secure Execution (crypto)
Description:
Provide attestations support, e.g. for external frameworks, specific deployment models or potentially regulatory requirements.
Request Type: Kernel - Enhancement from IBM
Upstream Acceptance: In Progress
CVE References
| tags: | added: architecture-s39064 bugnameltc-196320 severity-high targetmilestone-inin2204 |
| Changed in ubuntu: | |
| assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
| affects: | ubuntu → linux (Ubuntu) |
| Frank Heimes (fheimes) wrote | #1 |
| Changed in ubuntu-z-systems: | |
| assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
| Changed in linux (Ubuntu): | |
| importance: | Undecided → High |
| Changed in ubuntu-z-systems: | |
| importance: | Undecided → High |
| Changed in linux (Ubuntu): | |
| status: | New → Incomplete |
| Changed in ubuntu-z-systems: | |
| status: | New → Incomplete |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #2 |
| Frank Heimes (fheimes) wrote | #3 |
| bugproxy (bugproxy) wrote | #4 |
| bugproxy (bugproxy) wrote VS2021 upstream patch file | #5 |
| Frank Heimes (fheimes) wrote | #6 |
| Changed in ubuntu-z-systems: | |
| status: | Incomplete → New |
| Changed in linux (Ubuntu): | |
| status: | Incomplete → New |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #7 |
| Frank Heimes (fheimes) wrote | #8 |
| description: | updated |
| Frank Heimes (fheimes) wrote | #9 |
| bugproxy (bugproxy) wrote | #10 |
| Frank Heimes (fheimes) wrote | #11 |
| Frank Heimes (fheimes) wrote | #12 |
| information type: | Private → Public |
| Changed in linux (Ubuntu): | |
| status: | New → In Progress |
| Changed in ubuntu-z-systems: | |
| status: | New → In Progress |
| Changed in linux (Ubuntu Jammy): | |
| status: | New → In Progress |
| importance: | Undecided → High |
| assignee: | nobody → Canonical Kernel Team (canonical-kernel-team) |
| Changed in linux (Ubuntu): | |
| status: | In Progress → Invalid |
| assignee: | Skipper Bug Screeners (skipper-screen-team) → nobody |
| Changed in linux (Ubuntu Jammy): | |
| status: | In Progress → Fix Committed |
| Changed in ubuntu-z-systems: | |
| status: | In Progress → Fix Committed |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote | #13 |
| tags: | added: verification-needed-jammy |
| bugproxy (bugproxy) wrote | #14 |
| tags: |
added: verification-done-jammy removed: verification-needed-jammy |
| Frank Heimes (fheimes) wrote | #15 |
| Launchpad Janitor (janitor) wrote | #16 |
| Changed in linux (Ubuntu Jammy): | |
| status: | Fix Committed → Fix Released |
| Changed in ubuntu-z-systems: | |
| status: | Fix Committed → Fix Released |
| Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote | #17 |
| Frank Heimes (fheimes) wrote | #18 |
| tags: | added: verification-done-focal |
Changing to Incomplete for now, until kernel version and or commits are shared for integration.