[20.04 FEAT] paes self test

It looks like the development of this feature is pretty late for 20.04.
Please attach the backport as early as possible to this ticket and keep the kernel freeze in mind.

------- Comment From <email address hidden> 2020-02-07 03:29 EDT-------
The code is upstream available now ... with one exception (see below):
These are the available upstream commits:

888edbc48857 s390/pkey: Add support for key blob with clear key value
6f3196b74d64 s390/crypto: Rework on paes implementation

but you may want to pick these commits as a pre-requirement (in this sequence):

f9cac4fd8878 s390/pkey: fix memory leak within _copy_apqns_from_user()
8b57e7c852fc s390/pkey: use memdup_user() to simplify code
6733775a92ea s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
94dd3bada53e s390/zcrypt: Fix CCA cipher key gen with clear key value function
0c874cd04292 s390/zcrypt: move ap device reset from bus to driver code

One patch is missing which is the enable patch on the common code on crypto/testmgr.c. This patch is still in Herbert Xu's pipe and not upstream
accepted jet. Maybe a green light comes here within the next few days.

However, we need these patches as they are a pre requirement for LP1853303 "[20.04 FEAT] [SEC1811] Enhanced handling of secure keys and protected keys - kernel part"

The '6f3196b74d64 s390/crypto: Rework on paes implementation' patch does not apply cleanly. There are two ways to resolve this:
a) apply
d00c06398154 crypto: s390/paes - convert to skcipher API
674f368a952c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN
before applying the the paes rework patch
b) use my reworked version of this paes rework patch. I'll attach this
version here.

------- Comment (attachment only) From <email address hidden> 2020-02-07 03:38 EDT-------

------- Comment From <email address hidden> 2020-02-07 04:03 EDT-------
Oh, I did forget one patch ...

You need to push
7f820d053948 s390/crypto: enable clear key values for paes ciphers
of course onto the top.
It may not apply, if b) was choosen as i wrote in my prev comment.
So I'll attach a reworked version of this patch also.

------- Comment (attachment only) From <email address hidden> 2020-02-07 04:05 EDT-------

Hi Harald, thx for sharing the IDs.

I've looked them up and we have the following 3 already in focal master-next:
"s390/pkey: fix memory leak within _copy_apqns_from_user()"
"s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR"
"s390/zcrypt: Fix CCA cipher key gen with clear key value function"
So we are good with these.

I tried to find the others in https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git
and could find:
ea1f56f "s390/pkey: use memdup_user() to simplify code"
2324de6 "s390/zcrypt: move ap device reset from bus to driver code"
d00c063 "crypto: s390/paes - convert to skcipher API"
674f368 "crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN"

I couldn't find these 3 at all:
"s390/crypto: enable clear key values for paes ciphers"
"s390/pkey: Add support for key blob with clear key value"
"s390/crypto: Rework on paes implementation"
Were they not pulled yet?

So except "s390/crypto: enable clear key values for paes ciphers" just the pre-reqs are there.

And you mentioned a patch on crypto/testmgr.c that is still in Herbert Xu's pipe and not upstream.
Can you point us with URL / reference to this, so that we can have an early look at it?

------- Comment From <email address hidden> 2020-02-07 11:35 EDT-------
s390/crypto: enable clear key values for paes ciphers
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7f820d053948ca82bd8221b1df3d676b9c93a494

s390/pkey: Add support for key blob with clear key value
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=888edbc48857c7189592fb0be3ab09994247199c

s390/crypto: Rework on paes implementation
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6f3196b74d64fe4b0a51cefa6f2f80f7f55bcf49

you can go to
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/
and filter by 'freudenberger

I could find them there - thx.
(I was told to look here: https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git)

So just the crypto/testmgr.c patch from Herbert Xu's pipe is missing ... (any reference to it?)

------- Comment From <email address hidden> 2020-02-10 02:30 EDT-------
The missing patch is available on the linux kernel crypto mailing list.
Search for "add selftests for paes-s390".
However, it is as of now not picked by Herbert Xu and I am not sure if
he will pick it for the current open 5.6 kernel merge window. I don't
have any response from him.

The paes selftests should be available when the kernel runs in FIPS mode as FIPS requires to have each cipher selftested before use. For normal use there is no need to have the selftests (and it is an optional kernel feature then).

I'd say we leave this for now. The paes selftest infrastructure is available
with the patches, just the invocation by the testmanager is still missing
- exact the same as the current upstream kernel. If the testmanager patch
is picked, I'll update this bug - if not we will pick the patch for the next Ubuntu kernel update.

Just for reference: https://marc.info/?t=157364264800007&r=1&w=2

------- Comment From <email address hidden> 2020-02-11 07:31 EDT-------
Got answer from Herbert Xu about the testmanager fix. It will not make it into the 5.6 kernel, but will be accepted form 5.7. :-(
However, all the paes selftest code is available and only the trigger code is missing and we can add this later in the Ubuntu 20.4 release cycle.

Finally I sent over the requests to the kernel teams mailing list:
https://lists.ubuntu.com/archives/kernel-team/2020-February/thread.html#107514
and changed the status to 'In Progress'.

Since the following patches are already in Ubuntu focal's kernel 5.4:
- f9cac4fd8878 s390/pkey: fix memory leak within _copy_apqns_from_user() --> already in since Ubuntu-5.4-5.4.0-13.16
- 6733775a92ea s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR --> already in since Ubuntu-5.4-5.4.0-10.13
- 94dd3bada53e s390/zcrypt: Fix CCA cipher key gen with clear key value function --> already in since Ubuntu-5.4-5.4.0-13.16
- 0c874cd04292 s390/zcrypt: move ap device reset from bus to driver code --> already in since Ubuntu-5.4-5.4.0-14.17

I was obviously not able to follow the suggested order for cherry picking / applying all the pacthes.
After some attempts I followed this order that worked for me (using the alternatives aka backports):

a) 8b57e7c852fc "s390/pkey: use memdup_user() to simplify code"
b) 888edbc48857 "s390/pkey: Add support for key blob with clear key value"
c) 674f368a952c "crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN [doesn't allow me to cherry-pick cleanly]"
   alternative: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1854948/+attachment/5326172/+files/s390-crypto-Rework-on-paes-implementation.patch
d) 7f820d053948 "s390/crypto: enable clear key values for paes ciphers"
   alternative: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1854948/+attachment/5326173/+files/s390-crypto-enable-clear-key-values-for-paes-ciphers.patch

------- Comment From <email address hidden> 2020-02-17 04:05 EDT-------
and now the link to the last patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c7ff8573ad21dcdcbcffd66fbfca3b53cd67d2b1
has been picked by Linus Torvald for the 5.6 kernel :-)

Yeah - I saw that upstream on the mailing list.

I think I'll now revoke my previous submission (https://lists.ubuntu.com/archives/kernel-team/2020-February/thread.html#107514) and will submit a "v2" that includes Herbert Xu's commit - so that we have everything needed in one submission.

I've now revoked the first patch submission:
https://lists.ubuntu.com/archives/kernel-team/2020-February/107535.html
and submitted this new one:
https://lists.ubuntu.com/archives/kernel-team/2020-February/thread.html#107536
that incl. the missing commit from comment #13.
Status is still 'In Progress'.

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Just for your info - removing tag "verification-needed-focal" is not sufficient, also tag "verification-done-focal" needs to be added - fixed that.
But thanks for the verification of course!

Our apologies, the "verification-needed-focal" tag was removed prematurely; setting it back.

This bug was fixed in the package linux - 5.4.0-18.22

---------------
linux (5.4.0-18.22) focal; urgency=medium

  * focal/linux: 5.4.0-18.22 -proposed tracker (LP: #1866488)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * Add sysfs attribute to show remapped NVMe (LP: #1863621)
    - SAUCE: ata: ahci: Add sysfs attribute to show remapped NVMe device count

  * [20.04 FEAT] Compression improvements in Linux kernel (LP: #1830208)
    - lib/zlib: add s390 hardware support for kernel zlib_deflate
    - s390/boot: rename HEAP_SIZE due to name collision
    - lib/zlib: add s390 hardware support for kernel zlib_inflate
    - s390/boot: add dfltcc= kernel command line parameter
    - lib/zlib: add zlib_deflate_dfltcc_enabled() function
    - btrfs: use larger zlib buffer for s390 hardware compression
    - [Config] Introducing s390x specific kernel config option CONFIG_ZLIB_DFLTCC

  * [UBUNTU 20.04] s390x/pci: increase CONFIG_PCI_NR_FUNCTIONS to 512 in kernel
    config (LP: #1866056)
    - [Config] Increase CONFIG_PCI_NR_FUNCTIONS from 64 to 512 starting with focal
      on s390x

  * CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set (LP: #1865332)
    - [Config] CONFIG_IP_MROUTE_MULTIPLE_TABLES=y

  * Dell XPS 13 9300 Intel 1650S wifi [34f0:1651] fails to load firmware
    (LP: #1865962)
    - iwlwifi: remove IWL_DEVICE_22560/IWL_DEVICE_FAMILY_22560
    - iwlwifi: 22000: fix some indentation
    - iwlwifi: pcie: rx: use rxq queue_size instead of constant
    - iwlwifi: allocate more receive buffers for HE devices
    - iwlwifi: remove some outdated iwl22000 configurations
    - iwlwifi: assume the driver_data is a trans_cfg, but allow full cfg

  * [FOCAL][REGRESSION] Intel Gen 9 brightness cannot be controlled
    (LP: #1861521)
    - Revert "USUNTU: SAUCE: drm/i915: Force DPCD backlight mode on Dell Precision
      4K sku"
    - Revert "UBUNTU: SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd
      Gen 4K AMOLED panel"
    - SAUCE: drm/dp: Introduce EDID-based quirks
    - SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED
      panel
    - SAUCE: drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels

  * [20.04 FEAT] Enable proper kprobes on ftrace support (LP: #1865858)
    - s390/ftrace: save traced function caller
    - s390: support KPROBES_ON_FTRACE

  * alsa/sof: load different firmware on different platforms (LP: #1857409)
    - ASoC: SOF: Intel: hda: use fallback for firmware name
    - ASoC: Intel: acpi-match: split CNL tables in three
    - ASoC: SOF: Intel: Fix CFL and CML FW nocodec binary names.

  * [UBUNTU 20.04] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x
    starting with focal (LP: #1865452)
    - [Config] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x starting
      with focal

  * Focal update: v5.4.24 upstream stable release (LP: #1866333)
    - io_uring: grab ->fs as part of async offload
    - EDAC: skx_common: downgrade message importance on missing PCI device
    - net: dsa: b53: Ensure the default VID is untagged
    - net: fib_rules: Correctly set table field when table number exceeds 8 bit...

------- Comment From <email address hidden> 2020-03-17 04:29 EDT-------
IBM Bugzilla status-> closed, Fix Released with focal