[Bug 1947046] Re: EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k boundary

[gerald.yang]

Hi Julian,

Could you help to review the above comments, thanks!

** Description changed:

  [Impact]
  Recent kernels emit the following error message when booting on arm64 platforms:
  
    EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary
  
  While this doesn't appear to cause any functional issues - and indeed,
  the kernel commit that added the error[*] says "We can deal with this,
  but let's check for this condition anyway", it is still likely to cause
  user concern.
  
  [*]
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c32ac11da3f83bb42b986702a9b92f0a14ed4182
  
  [Test Case]
- Boot a recent kernel on an EFI-based arm64 system (impish will do, but the kernel patch is also hitting kernels in older releases). This message will be emitted after GRUB execs the kernel EFI stub.
+ This issue can be reproduced by launching a VM with secure boot enabled on an arm64 machine running jammy, e.g.
+ lxc launch ubuntu:jammy testsb --vm -c security.secureboot=true -c limits.cpu=16 -c limits.memory=16GiB
+ 
+ The message shows in early boot, so we need to connect to VM console to see the warning message:
+ lxc console testsb
+ 
+ With the fix, the kernel image loaded by grub will be 64k aligned and the warning message disappears as below:
+ BdsDxe: loading Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
+ BdsDxe: starting Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
+ EFI stub: Booting Linux Kernel...
+ EFI stub: UEFI Secure Boot is enabled.
+ EFI stub: Using DTB from configuration table
+ EFI stub: Exiting boot services...
+ EFI stub: UEFI Secure Boot is enabled.
+ [    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd082]
+ [    0.000000] Linux version 5.15.0-91-generic (buildd at bos03-arm64-015) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #101-Ubuntu SMP Tue Nov 14 13:29:11 UTC 2023 (Ubuntu 5.15.0-91.101-generic 5.15.131)
+ 
+ For testing secure boot, refer to the following link for creating test key, enroll to shim and sign the test grub
+ https://ubuntu.com/blog/how-to-sign-things-for-secure-boot
+ 
  
  [Fix]
  https://github.com/rhboot/grub2/commit/6a5babc21e3ec665e0bae30e399db296451c121e
  
  [What Could Go Wrong]

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2 in Ubuntu.
https://bugs.launchpad.net/bugs/1947046

Title:
  EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary

Status in grub2 package in Ubuntu:
  Fix Released
Status in grub2 source package in Jammy:
  In Progress

Bug description:
  [Impact]
  Recent kernels emit the following error message when booting on arm64 platforms:

    EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary

  While this doesn't appear to cause any functional issues - and indeed,
  the kernel commit that added the error[*] says "We can deal with this,
  but let's check for this condition anyway", it is still likely to
  cause user concern.

  [*]
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c32ac11da3f83bb42b986702a9b92f0a14ed4182

  [Test Case]
  This issue can be reproduced by launching a VM with secure boot enabled on an arm64 machine running jammy, e.g.
  lxc launch ubuntu:jammy testsb --vm -c security.secureboot=true -c limits.cpu=16 -c limits.memory=16GiB

  The message shows in early boot, so we need to connect to VM console to see the warning message:
  lxc console testsb

  With the fix, the kernel image loaded by grub will be 64k aligned and the warning message disappears as below:
  BdsDxe: loading Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
  BdsDxe: starting Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
  EFI stub: Booting Linux Kernel...
  EFI stub: UEFI Secure Boot is enabled.
  EFI stub: Using DTB from configuration table
  EFI stub: Exiting boot services...
  EFI stub: UEFI Secure Boot is enabled.
  [    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd082]
  [    0.000000] Linux version 5.15.0-91-generic (buildd at bos03-arm64-015) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #101-Ubuntu SMP Tue Nov 14 13:29:11 UTC 2023 (Ubuntu 5.15.0-91.101-generic 5.15.131)

  For testing secure boot, refer to the following link for creating test key, enroll to shim and sign the test grub
  https://ubuntu.com/blog/how-to-sign-things-for-secure-boot

  
  [Fix]
  https://github.com/rhboot/grub2/commit/6a5babc21e3ec665e0bae30e399db296451c121e

  [What Could Go Wrong]

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1947046/+subscriptions