debcrafters-packages team mailing list archive

[Frank Heimes <2115718@xxxxxxxxxxxxxxxxxx>]

The pkey modules are in a separate "s390-tools-zkey" package in Ubuntu.
This separate zkey package exists since 2.6.0, when even d-i was used.

It incl. the hook file for the initramfs-tools:
dpkg -c s390-tools-zkey_2.37.0-0ubuntu2_s390x.deb | grep -i /usr/share/initramfs-tools/hooks/s390-tools-zkey
-rwxr-xr-x root/root       907 2025-02-14 16:40 ./usr/share/initramfs-tools/hooks/s390-tools-zkey

Installing this:
sudo apt install s390-tools-zkey

and running update-initramfs:
sudo update-initramfs -k all -u

will add all pkey* modules:
lsinitramfs /boot/initrd.img-$(uname -r)-generic | grep pkey
sr/lib/modules/6.14.0-23-generic/kernel/drivers/s390/crypto/pkey-cca.ko.zst
usr/lib/modules/6.14.0-23-generic/kernel/drivers/s390/crypto/pkey-ep11.ko.zst
usr/lib/modules/6.14.0-23-generic/kernel/drivers/s390/crypto/pkey-pckmo.ko.zst
usr/lib/modules/6.14.0-23-generic/kernel/drivers/s390/crypto/pkey-uv.ko.zst
usr/lib/modules/6.14.0-23-generic/kernel/drivers/s390/crypto/pkey.ko.zst

iianm it was done in the past to have a lean package at install time
that could be pulled-in in case of installations with an encrypted root
partition.

The modules are available and can be loaded at install time by default (s390-tools-zkey package is installed in install live system):
# lsmod | grep pkey
pkey_cca               24576  0
pkey_ep11              24576  0
zcrypt                135168  4 pkey_ep11,pkey_cca,zcrypt_cex4
ap                     90112  3 pkey_ep11,zcrypt,zcrypt_cex4
pkey_pckmo             16384  0
pkey                   49152  3 pkey_pckmo,pkey_ep11,pkey_cca
(in this particular case not pkey-uv, since it's aken from a normal LPAR)

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to s390-tools in Ubuntu.
https://bugs.launchpad.net/bugs/2115718

Title:
  [UBUNTU 25.04] not all pkey modules available in initrd

Status in Ubuntu on IBM z Systems:
  Confirmed
Status in s390-tools package in Ubuntu:
  Confirmed
Status in s390-tools-signed package in Ubuntu:
  Confirmed

Bug description:
  == Comment: #0 - Grgo Mariani <Grgo.Mariani@xxxxxxx> - 2025-06-23 03:21:06 ==
  ---Problem Description---
  Recently pkey module has been split into pkey, pkey-cca, pkey-ep11, pkey-pckmo and pkey-uv.
  This might cause problems for customers who use encrypted root directory with any of these as it requires these modules to be loaded with initrd.
  However listing the modules with lsinitramfs only shows the pkey module being loaded.

  e.g.
  $ lsinitramfs /boot/initrd.img-$(uname -r) | grep pkey
  usr/lib/modules/6.14.0-22-generic/kernel/drivers/s390/crypto/pkey.ko.zst
  $ ls -la /lib/modules/$(uname -r)/kernel/drivers/s390/crypto | grep pkey
  -rw-r--r-- 1 root root  8003 May 21 09:38 pkey-cca.ko.zst
  -rw-r--r-- 1 root root  7304 May 21 09:38 pkey-ep11.ko.zst
  -rw-r--r-- 1 root root 15922 May 21 09:38 pkey.ko.zst
  -rw-r--r-- 1 root root  6207 May 21 09:38 pkey-pckmo.ko.zst
  -rw-r--r-- 1 root root  4643 May 21 09:38 pkey-uv.ko.zst
   
  ---uname output---
  Linux SYSTEM 6.14.0-22-generic #22-Ubuntu SMP Wed May 21 13:32:46 UTC 2025 s390x s390x s390x GNU/Linux
   
  ---Additional Hardware Info---
  CEX cards attached 

   
  Contact Information = grgo.mariani@xxxxxxx christian.rund@xxxxxxxxxx 
   
  Machine Type = Manufacturer:         IBM              Type:                 8561 Model:                701              T01 
   
  ---Debugger---
  A debugger is not configured
   
  ---Steps to Reproduce---
  Check the modules in the initrd
  $ lsinitramfs /boot/initrd.img-$(uname -r) | grep pkey
  and compare them with available modules
  $ ls -la /lib/modules/$(uname -r)/kernel/drivers/s390/crypto/ | grep pkey
   
  System Dump Info:
    The system is not configured to capture a system dump.
   
  Stack trace output:
   no
   
  Oops output:
   no

  == Comment: #1 - Ingo Franzki <ifranzki@xxxxxxxxxx> - 2025-06-23 03:24:23 ==
  FYI: You can use the Dracut config file from https://github.com/ibm-s390-linux/s390-tools/blob/master/zkey/dracut/99-pkey.conf to get all required modules, tools and files into initramfs.

  == Comment: #4 - Ingo Franzki <ifranzki@xxxxxxxxxx> - 2025-06-23 08:01:41 ==
  In case initramfs-tools is still being used then https://github.com/ibm-s390-linux/s390-tools/blob/master/zkey/initramfs/hooks/s390-tools-zkey can be used.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/2115718/+subscriptions