[Bug 1947046] Re: EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k boundary

[gerald.yang]

Hi

I found this issue is still not fixed.
Launch a VM with secure boot enabled on an arm64 machine running jammy, it shows the following:

BdsDxe: loading Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
BdsDxe: starting Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
EFI stub: Booting Linux Kernel...
EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k boundary   <========
EFI stub: UEFI Secure Boot is enabled.
EFI stub: Using DTB from configuration table
EFI stub: Exiting boot services...
EFI stub: UEFI Secure Boot is enabled.
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd082]
[    0.000000] Linux version 5.15.0-91-generic (buildd at bos03-arm64-015) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #101-Ubuntu SMP Tue Nov 14 13:29:11 UTC 2023 (Ubuntu 5.15.0-91.101-generic 5.15.131)


The fix mentioned in the bug description is not in the current grub code
https://github.com/rhboot/grub2/commit/6a5babc21e3ec665e0bae30e399db296451c121e

I also found this commit is not merged into upstream master branch, instead it's merged into rhel-9.x.x
and fedora-37 and later

Could we SRU it to our grub?
The commit needs to be modified a bit based on our current grub code, I will attach a diff for grub-core/loader/efi/linux.c which is a modified version of the above commit.
With this I can confirm it fixes the error message
EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k boundary

I will also modify the bug description regarding the reproducer

Thanks,
Gerald

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2 in Ubuntu.
https://bugs.launchpad.net/bugs/1947046

Title:
  EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary

Status in grub2 package in Ubuntu:
  Fix Released
Status in grub2 source package in Jammy:
  In Progress

Bug description:
  [Impact]
  Recent kernels emit the following error message when booting on arm64 platforms:

    EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary

  While this doesn't appear to cause any functional issues - and indeed,
  the kernel commit that added the error[*] says "We can deal with this,
  but let's check for this condition anyway", it is still likely to
  cause user concern.

  [*]
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c32ac11da3f83bb42b986702a9b92f0a14ed4182

  [Test Case]
  This issue can be reproduced by launching a VM with secure boot enabled on an arm64 machine running jammy, e.g.
  lxc launch ubuntu:jammy testsb --vm -c security.secureboot=true -c limits.cpu=16 -c limits.memory=16GiB

  The message shows in early boot, so we need to connect to VM console to see the warning message:
  lxc console testsb

  With the fix, the kernel image loaded by grub will be 64k aligned and the warning message disappears as below:
  BdsDxe: loading Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
  BdsDxe: starting Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
  EFI stub: Booting Linux Kernel...
  EFI stub: UEFI Secure Boot is enabled.
  EFI stub: Using DTB from configuration table
  EFI stub: Exiting boot services...
  EFI stub: UEFI Secure Boot is enabled.
  [    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd082]
  [    0.000000] Linux version 5.15.0-91-generic (buildd at bos03-arm64-015) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #101-Ubuntu SMP Tue Nov 14 13:29:11 UTC 2023 (Ubuntu 5.15.0-91.101-generic 5.15.131)

  For testing secure boot, refer to the following link for creating test key, enroll to shim and sign the test grub
  https://ubuntu.com/blog/how-to-sign-things-for-secure-boot

  
  [Fix]
  https://github.com/rhboot/grub2/commit/6a5babc21e3ec665e0bae30e399db296451c121e

  [What Could Go Wrong]

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1947046/+subscriptions