September 2022 - openSUSE Kernel Bugs - openSUSE Mailing Lists

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c20 --- Comment #20 from Joey Lee <jlee(a)suse.com> --- How about change the kernel scripts? To avoid the "255" return value to expose: suse-module-tools/kernel-scriptlets/cert-script ... # XXX: Only call mokutil if UEFI and shim are used for cert in $certs; do cert="/etc/uefi/certs/${cert}.crt" run_mokutil --import "$cert" --root-pw ${MOK_ARGS} rc=$? if [ $rc != 0 ] ; then script_rc=$rc # hide 255 here? echo "Failed to import $cert" >&2 fi done -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c19 --- Comment #19 from Joey Lee <jlee(a)suse.com> --- (In reply to Joey Lee from comment #15) > A f88814cc25 patch be introduced to v5.8 kernel to set flag to read only if > SetVariable not be supported by firmware: > > commit f88814cc2578c121e6edef686365036db72af0ed [v5.8-rc7~14] > Author: Ard Biesheuvel <ardb(a)kernel.org> > Date: Wed Jul 8 13:01:57 2020 +0300 > > efi/efivars: Expose RT service availability via efivars abstraction > > > fs/efivarfs/super.c > static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc) > { > ... > if (!efivar_supports_writes()) > sb->s_flags |= SB_RDONLY; > ... Kernel detected the EFI runtime properties table, and set s_flags to read only. It can block the writing job from userland. But it doesn't expose "Read Only" property to userland. By the way, I was sent patch to upstream for creating efivars mount point when efivarfs is available: https://lore.kernel.org/lkml/20200924095157.GA304421@kroah.com/T/#m1442b0ab… Follow Greg's suggestion, we use /proc/filesystems to detect the existence of efivarfs in userland. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c18 --- Comment #18 from Kilian Hanich <khanich.opensource(a)gmx.de> --- (In reply to Chester Lin from comment #17) > BTW, MokUtil shouldn't be able to create any EFI variable to uboot because > uboot has not yet supported SetVariable [EFI_RT_SUPPORTED_SET_VARIABLE, > 0x0040] in its real-time services table. See: > > https://github.com/u-boot/u-boot/blob/v2022.04/lib/efi_loader/efi_runtime. > c#L124 Well, mokutil can't, it errors out, but it thinks it can because as it seems the efivar library authors haven't thought about the possibility that efivarfs could be read-only and only check if it exists (this function gets called when the library gets initialized) which is then relied upon by mokutil. https://github.com/rhboot/efivar/blob/main/src/efivarfs.c#L67 -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c17 --- Comment #17 from Chester Lin <chester.lin(a)suse.com> --- IIRC, uboot can only support UEFI SecureBoot in a special manner, which needs to specifically install the PK, KEK and db via the u-boot shell. See: https://github.com/u-boot/u-boot/blob/v2022.04/doc/develop/uefi/uefi.rst#co… BTW, MokUtil shouldn't be able to create any EFI variable to uboot because uboot has not yet supported SetVariable [EFI_RT_SUPPORTED_SET_VARIABLE, 0x0040] in its real-time services table. See: https://github.com/u-boot/u-boot/blob/v2022.04/lib/efi_loader/efi_runtime.c… -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c16 --- Comment #16 from Kilian Hanich <khanich.opensource(a)gmx.de> --- (In reply to Joey Lee from comment #14) > For reading requirement, "mokutil --sb-state" needs efivarfs for detecting > "secure boot" status. But I am not sure who used it. systemd automatically mounts efivarfs -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c15 --- Comment #15 from Joey Lee <jlee(a)suse.com> --- A f88814cc25 patch be introduced to v5.8 kernel to set flag to read only if SetVariable not be supported by firmware: commit f88814cc2578c121e6edef686365036db72af0ed [v5.8-rc7~14] Author: Ard Biesheuvel <ardb(a)kernel.org> Date: Wed Jul 8 13:01:57 2020 +0300 efi/efivars: Expose RT service availability via efivars abstraction fs/efivarfs/super.c static int efivarfs_fill_super(struct super_block *sb, struct fs_context *fc) { ... if (!efivar_supports_writes()) sb->s_flags |= SB_RDONLY; ... -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1201066] kernel upgrade fails with Failed to enroll new keys
by bugzilla_noreply＠suse.com 07 Sep '22

07 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1201066 https://bugzilla.suse.com/show_bug.cgi?id=1201066#c14 --- Comment #14 from Joey Lee <jlee(a)suse.com> --- (In reply to Kilian Hanich from comment #12) > OK, U-Boot follows the "Embedded Base Boot Requirements Specification - > Release v1.0" and as such does not have a full blown UEFI implementation. > This includes that "SetVariable" is not supported. > > efivarfs gets mounted because systemd does that. And as such mokutil thinks > it is working with a full blown UEFI implementation. > > Now, I tried to just add "noefi" as a kernel parameter and I have not > noticed any bugs. Because efivarfs doesn't get mounted, mokutil acts > properly and as such transactional-update actually succeeds updating. > > So, does somebody know if anything else depends on being on an UEFI system? There have following functions need efivarfs. All of them need SetVariable: - rtc-efi - efibootmgr - MOK - uefi capsule update For reading requirement, "mokutil --sb-state" needs efivarfs for detecting "secure boot" status. But I am not sure who used it. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1203103] Kernel oops on BPF trace after AMD retbleed patch
by bugzilla_noreply＠suse.com 06 Sep '22

06 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1203103 https://bugzilla.suse.com/show_bug.cgi?id=1203103#c2 pk-pavlk <pk-dev-bzilla.rcd10(a)simplelogin.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(pk-dev-bzilla.rcd | |10(a)simplelogin.com) | --- Comment #2 from pk-pavlk <pk-dev-bzilla.rcd10(a)simplelogin.com> --- I have tested this with the latest kernel from Kernel:SLE15-SP4 repo (5.14.21-150400.220.g3a89213-default) and it still exhibits the problem (booting with retbleed=off makes it disappear in this version as well). -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1203103] Kernel oops on BPF trace after AMD retbleed patch
by bugzilla_noreply＠suse.com 06 Sep '22

06 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1203103 https://bugzilla.suse.com/show_bug.cgi?id=1203103#c1 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bpetkov(a)suse.com, | |pk-dev-bzilla.rcd10@simplel | |ogin.com, tiwai(a)suse.com Flags| |needinfo?(pk-dev-bzilla.rcd | |10(a)simplelogin.com) --- Comment #1 from Takashi Iwai <tiwai(a)suse.com> --- Adding Boris to Cc. Just to be sure: could you check whether the latest kernel in OBS Kernel:SLE15-SP4 repo still shows the same problem? http://download.opensuse.org/repositories/Kernel:/SLE15-SP4/pool/ -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1190340] New: armv7hl 5.14 kernel build fails for Leap 15.4
by bugzilla_noreply＠suse.com 06 Sep '22

06 Sep '22

https://bugzilla.suse.com/show_bug.cgi?id=1190340 Bug ID: 1190340 Summary: armv7hl 5.14 kernel build fails for Leap 15.4 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: tiwai(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Now we start building the armv7hl kernel for Leap 15.4, and it fails as: [ 9793s] GEN modules.builtin [ 9793s] LD .tmp_vmlinux.btf [ 9827s] BTF .btf.vmlinux.bin.o [ 9884s] [4957384] STRUCT thread_info's field 'vfpstate' offset=2048 bit_size=0 type=4957356 Error emitting field [ 9884s] Encountered error while encoding BTF. .... [ 9994s] FAILED: load BTF from vmlinux: No such file or directory [ 9994s] make[1]: *** [/home/abuild/rpmbuild/BUILD/kernel-default-5.14.2/linux-5.14/Makefile:1200: vmlinux] Error 255 My initial attempt worked because BTF wasn't enabled due to the old tools. OTOH, the same 5.14 build is OK with stable branch, so there is still some missing piece, supposedly. -- You are receiving this mail because: You are the assignee for the bug.

1 9