Bug 1988762

Summary: edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec
Product: Red Hat Enterprise Linux 8 Reporter: Neal Gompa <ngompa13>
Component: edk2Assignee: Philippe Mathieu-Daudé <philmd>
Status: CLOSED ERRATA QA Contact: Xueqiang Wei <xuwei>
Severity: medium Docs Contact:
Priority: medium    
Version: CentOS StreamCC: berrange, bstinson, bugzilla, carl, davdunc, davide, extras-qa, jwboyer, kraxel, lersek, michel, mrezanin, ngompa13, pbonzini, philmd, virt-bugs, virt-maint, xuwei
Target Milestone: betaKeywords: RFE, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: edk2-20210527gite1999b264f1f-3.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1988760 Environment:
Last Closed: 2021-11-09 18:08:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Neal Gompa 2021-07-31 20:48:50 UTC
+++ This bug was initially created as a clone of Bug #1988760 +++

Description of problem:

edk2-ovmf is taking a PMBR protective record's BootIndictor bit into account when deciding whether the GPT is valid or not. When pmbr_boot (a.k.a setting a bit on the protective record partition entry's BootIndictor in the PMBR, a.k.a. setting the boot flag, a.k.a. setting the active bit) is set, the GPT is seemingly considered invalid by edk2-ovmf and the system is not bootable.

There is now an upstream commit that can be backported to fix this: https://github.com/tianocore/edk2/commit/b3db0cb1f8d163f22b769c205c6347376a315dcd

Version-Release number of selected component (if applicable):
20200602gitca407c7246bf-4.el8_4.1

How reproducible:
Always


Steps to Reproduce:
1. Create a UEFI bootable image, boot it
2. parted /dev/vda disk_set pmbr_boot on
3. Try to boot the image

Actual results:

Firmware drops to an EFI shell.

Expected results:

It should boot.


Additional info:

Upstream bug has details including a test image attached.

Comment 4 Yanan Fu 2021-08-06 14:32:30 UTC
QE bot(pre verify): Set 'Verified:Tested,SanityOnly' as gating/tier1 test pass.

Comment 7 Xueqiang Wei 2021-08-09 15:49:52 UTC
Reproduced it with edk2-ovmf-20210527gite1999b264f1f-1.el8.noarch.

Tested with edk2-20210527gite1999b264f1f-3.el8, not hit this issue. So set status to VERIFIED.


Versions:
Host:
kernel-4.18.0-325.el8.x86_64
qemu-kvm-6.0.0-27.module+el8.5.0+12121+c40c8708
edk2-ovmf-20210527gite1999b264f1f-3.el8.noarch

Guest:
kernel-4.18.0-319.el8.x86_64


Steps:
1. install a rhel8.5.0 guest and boot it
/usr/libexec/qemu-kvm \
    -S  \
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/OVMF/OVMF_CODE.secboot.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
    -blockdev node-name=file_ovmf_vars,driver=file,filename=/home/kvm_autotest_root/images/avocado-vt-vm1_rhel850-64-virtio-scsi.qcow2_VARS.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \
    -machine q35,memory-backend=mem-machine_mem,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -m 15360 \
    -object memory-backend-ram,size=15360M,id=mem-machine_mem  \
    -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2  \
    -cpu 'Skylake-Server',+kvm_pv_unhalt \
    -chardev socket,id=qmp_id_qmpmonitor1,server=on,path=/tmp/avocado_dkpw73kl/monitor-qmpmonitor1-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,id=qmp_id_catch_monitor,server=on,path=/tmp/avocado_dkpw73kl/monitor-catch_monitor-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=id3sIdKI \
    -chardev socket,id=chardev_serial0,server=on,path=/tmp/avocado_dkpw73kl/serial-serial0-20210802-043048-9Ao7US0i,wait=off \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20210802-043048-9Ao7US0i,path=/tmp/avocado_dkpw73kl/seabios-20210802-043048-9Ao7US0i,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20210802-043048-9Ao7US0i,iobase=0x402 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel850-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-net-pci,mac=9a:04:b0:7c:7f:9c,id=idOUke6O,netdev=idGbNjIM,bus=pcie-root-port-3,addr=0x0  \
    -netdev tap,id=idGbNjIM,vhost=on  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=c,strict=off \
    -enable-kvm \
    -monitor stdio \

2. parted /dev/sda disk_set pmbr_boot on
# lsblk
NAME          MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda             8:0    0   10G  0 disk 
├─sda1          8:1    0  600M  0 part /boot/efi
├─sda2          8:2    0    1G  0 part /boot
└─sda3          8:3    0  8.4G  0 part 
  ├─rhel-root 253:0    0  7.4G  0 lvm  /
  └─rhel-swap 253:1    0    1G  0 lvm  [SWAP]
# parted /dev/sda
GNU Parted 3.2
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 10.7GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: 

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  10.7GB  9032MB                                     lvm

(parted) disk_set pmbr_boot on
(parted) quit

3. reboot the image, and check "Disk Flags: pmbr_boot"
# reboot 

# parted /dev/sda
GNU Parted 3.2
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 10.7GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: pmbr_boot

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  10.7GB  9032MB                                     lvm

Comment 9 errata-xmlrpc 2021-11-09 18:08:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: edk2 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4198