[Bug 2149400] [NEW] UEFI Secure Boot failure (Synchronous Exception) on ARM64 VMs

Mon Apr 20 21:57:23 UTC 2026

Public bug reported:

# Description
When booting LXD virtual machines on ARM64 hardware (specifically Raspberry Pi 4 and 5), we are encountering a `Synchronous Exception` early in the UEFI boot process. This bug is inherently tied to Secure Boot and appears to be heavily related to memory availability and layout. 

This regression is present in the `latest/edge` release but does not
occur in the older stable `5.21/edge` build.

# Environment
## Hardware: Raspberry Pi 5 (16GB), Raspberry Pi 4 (8GB), Raspberry Pi 4 (4GB).
## Failing LXD channel: `latest/edge` (bundled with EDK2 version `2025.11-3ubuntu7`).
## Working LXD channel: `5.21/edge` (bundled with EDK2 version `2024.02-2ubuntu0.8`).
## Affected OS: Ubuntu 22.04 (Jammy) and Ubuntu 24.04 (Noble).

# Steps to Reproduce
Attempt to launch Ubuntu 22.04 or 24.04 VMs using the `latest/edge` release:

```bash
lxc launch ubuntu-minimal-daily:<image_hash> --vm --console n1
```

# Actual Behavior
The boot process crashes with a `Synchronous Exception`. The exact point of failure depends heavily on the OS version and available RAM:
* **Ubuntu 22.04:** Fails immediately on the first instance across all tested Raspberry Pi models:
```
# 21dcb6266b78e65d1746bc556d7e5ea6fe7a8420daf12bf71005541a6cee7a6a is 22.04
# lxc launch ubuntu-daily:21dcb6266b78e65d1746bc556d7e5ea6fe7a8420daf12bf71005541a6cee7a6a --vm --console j1
Launching j1
To detach from the console, press: <ctrl>+a q        

BdsDxe: loading Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)
BdsDxe: starting Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)

Synchronous Exception at 0x000000007DBF8B98

Synchronous Exception at 0x000000007DBF8B98
Error: write unix:@->/var/snap/lxd/common/lxd/logs/j1/qemu.console: broken pipe
```

* **Ubuntu 24.04:** The failure threshold scales directly with the host's available memory. 
    * On a Raspberry Pi 5 (16GB), 3 instances boot successfully.
    * On a Raspberry Pi 4 (8GB), the 7th instance fails to boot.
    * On a Raspberry Pi 4 (4GB), the 3rd instance fails (resulting in an additional `broken pipe` on the `qemu.console`).

```
# 1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 is 24.04
lxc launch ubuntu-minimal-daily:1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 --vm --console n1
lxc launch ubuntu-minimal-daily:1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 --vm --console n2
lxc launch ubuntu-minimal-daily:1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 --vm --console n3
Launching n3
To detach from the console, press: <ctrl>+a q        

BdsDxe: loading Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)
BdsDxe: starting Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)

Synchronous Exception at 0x000000007DBF1B98

Synchronous Exception at 0x000000007DBF1B98
Error: write unix:@->/var/snap/lxd/common/lxd/logs/n3/qemu.console: broken pipe

lxc delete -f n1 n2 n3
```

# Expected Behavior
The virtual machines should boot successfully without throwing a `Synchronous Exception`, exactly as they do under the `5.21/edge` release.

# Workaround
Disabling Secure Boot completely bypasses the bug. Using the configuration flag `-c boot.mode=uefi-nosecureboot` at launch avoids the exception entirely. For example, on the 4GB RPi 4 host, we successfully booted up to 4 instances simultaneously when Secure Boot was disabled.

** Affects: edk2 (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to edk2 in Ubuntu.
https://bugs.launchpad.net/bugs/2149400

Title:
  UEFI Secure Boot failure (Synchronous Exception) on ARM64 VMs

Status in edk2 package in Ubuntu:
  New

Bug description:
  # Description
  When booting LXD virtual machines on ARM64 hardware (specifically Raspberry Pi 4 and 5), we are encountering a `Synchronous Exception` early in the UEFI boot process. This bug is inherently tied to Secure Boot and appears to be heavily related to memory availability and layout. 

  This regression is present in the `latest/edge` release but does not
  occur in the older stable `5.21/edge` build.

  # Environment
  ## Hardware: Raspberry Pi 5 (16GB), Raspberry Pi 4 (8GB), Raspberry Pi 4 (4GB).
  ## Failing LXD channel: `latest/edge` (bundled with EDK2 version `2025.11-3ubuntu7`).
  ## Working LXD channel: `5.21/edge` (bundled with EDK2 version `2024.02-2ubuntu0.8`).
  ## Affected OS: Ubuntu 22.04 (Jammy) and Ubuntu 24.04 (Noble).

  # Steps to Reproduce
  Attempt to launch Ubuntu 22.04 or 24.04 VMs using the `latest/edge` release:

  ```bash
  lxc launch ubuntu-minimal-daily:<image_hash> --vm --console n1
  ```

  # Actual Behavior
  The boot process crashes with a `Synchronous Exception`. The exact point of failure depends heavily on the OS version and available RAM:
  * **Ubuntu 22.04:** Fails immediately on the first instance across all tested Raspberry Pi models:
  ```
  # 21dcb6266b78e65d1746bc556d7e5ea6fe7a8420daf12bf71005541a6cee7a6a is 22.04
  # lxc launch ubuntu-daily:21dcb6266b78e65d1746bc556d7e5ea6fe7a8420daf12bf71005541a6cee7a6a --vm --console j1
  Launching j1
  To detach from the console, press: <ctrl>+a q        

  BdsDxe: loading Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)
  BdsDxe: starting Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)

  Synchronous Exception at 0x000000007DBF8B98

  Synchronous Exception at 0x000000007DBF8B98
  Error: write unix:@->/var/snap/lxd/common/lxd/logs/j1/qemu.console: broken pipe
  ```

  * **Ubuntu 24.04:** The failure threshold scales directly with the host's available memory. 
      * On a Raspberry Pi 5 (16GB), 3 instances boot successfully.
      * On a Raspberry Pi 4 (8GB), the 7th instance fails to boot.
      * On a Raspberry Pi 4 (4GB), the 3rd instance fails (resulting in an additional `broken pipe` on the `qemu.console`).

  ```
  # 1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 is 24.04
  lxc launch ubuntu-minimal-daily:1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 --vm --console n1
  lxc launch ubuntu-minimal-daily:1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 --vm --console n2
  lxc launch ubuntu-minimal-daily:1d0c1c89be361d0c5fb1517ac4e5b36ee1b6bd3f0e69a1ed244898a0a0fe7166 --vm --console n3
  Launching n3
  To detach from the console, press: <ctrl>+a q        

  BdsDxe: loading Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)
  BdsDxe: starting Boot0002 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)

  Synchronous Exception at 0x000000007DBF1B98

  Synchronous Exception at 0x000000007DBF1B98
  Error: write unix:@->/var/snap/lxd/common/lxd/logs/n3/qemu.console: broken pipe

  lxc delete -f n1 n2 n3
  ```

  # Expected Behavior
  The virtual machines should boot successfully without throwing a `Synchronous Exception`, exactly as they do under the `5.21/edge` release.

  # Workaround
  Disabling Secure Boot completely bypasses the bug. Using the configuration flag `-c boot.mode=uefi-nosecureboot` at launch avoids the exception entirely. For example, on the 4GB RPi 4 host, we successfully booted up to 4 instances simultaneously when Secure Boot was disabled.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2149400/+subscriptions