1988760 – edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec

Bug 1988760 - edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec

Summary: edk2 does not ignore PMBR protective record BootIndicator as required by UEFI...

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	None
Product:	Red Hat Enterprise Linux 9
Classification:	Red Hat
Component:	edk2
Sub Component:
Version:	CentOS Stream
Hardware:	Unspecified
OS:	Unspecified
Priority:	medium
Severity:	medium
Target Milestone:	beta
Target Release:	---
Assignee:	Philippe Mathieu-Daudé
QA Contact:	Xueqiang Wei
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2021-07-31 20:42 UTC by Neal Gompa
Modified:	2021-12-07 21:52 UTC (History)
CC List:	22 users (show)
Fixed In Version:	edk2-20210527gite1999b264f1f-5.el9
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:	1978966
Clones:	1988762 (view as bug list)
Environment:
Last Closed:	2021-12-07 21:50:14 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Gitlab	redhat/centos-stream/src edk2 merge_requests 6	None	None	None	2021-08-02 11:00:46 UTC
Red Hat Issue Tracker	RHELPLAN-91781	None	None	None	2021-07-31 20:47:28 UTC
TianoCore	3474	None	None	None	2021-07-31 20:42:23 UTC

Description Neal Gompa 2021-07-31 20:42:24 UTC

+++ This bug was initially created as a clone of Bug #1978966 +++

Description of problem:

edk2-ovmf is taking a PMBR protective record's BootIndictor bit into account when deciding whether the GPT is valid or not. When pmbr_boot (a.k.a setting a bit on the protective record partition entry's BootIndictor in the PMBR, a.k.a. setting the boot flag, a.k.a. setting the active bit) is set, the GPT is seemingly considered invalid by edk2-ovmf and the system is not bootable.

There is now an upstream commit that can be backported to fix this: https://github.com/tianocore/edk2/commit/b3db0cb1f8d163f22b769c205c6347376a315dcd

Version-Release number of selected component (if applicable):
20210527gite1999b264f1f-4.el9

How reproducible:
Always


Steps to Reproduce:
1. Create a UEFI bootable image, boot it
2. parted /dev/vda disk_set pmbr_boot on
3. Try to boot the image

Actual results:

Firmware drops to an EFI shell.

Expected results:

It should boot.


Additional info:

Upstream bug has details including a test image attached.

Comment 1 Xueqiang Wei 2021-08-02 09:17:09 UTC

Reprodued it with edk2-ovmf-20210527gite1999b264f1f-4.el9.noarch.

Versions:
kernel-5.14.0-0.rc3.29.el9.x86_64
qemu-kvm-6.0.0-10.el9
edk2-ovmf-20210527gite1999b264f1f-4.el9-4


Steps:
1. install a rhel9 guest and boot it
/usr/libexec/qemu-kvm \
    -S  \
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/OVMF/OVMF_CODE.secboot.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
    -blockdev node-name=file_ovmf_vars,driver=file,filename=/home/kvm_autotest_root/images/avocado-vt-vm1_rhel900-64-virtio-scsi.qcow2_VARS.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \
    -machine q35,memory-backend=mem-machine_mem,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -m 15360 \
    -object memory-backend-ram,size=15360M,id=mem-machine_mem  \
    -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2  \
    -cpu 'Skylake-Server',+kvm_pv_unhalt \
    -chardev socket,id=qmp_id_qmpmonitor1,server=on,path=/tmp/avocado_dkpw73kl/monitor-qmpmonitor1-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,id=qmp_id_catch_monitor,server=on,path=/tmp/avocado_dkpw73kl/monitor-catch_monitor-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=id3sIdKI \
    -chardev socket,id=chardev_serial0,server=on,path=/tmp/avocado_dkpw73kl/serial-serial0-20210802-043048-9Ao7US0i,wait=off \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20210802-043048-9Ao7US0i,path=/tmp/avocado_dkpw73kl/seabios-20210802-043048-9Ao7US0i,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20210802-043048-9Ao7US0i,iobase=0x402 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel900-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-net-pci,mac=9a:04:b0:7c:7f:9c,id=idOUke6O,netdev=idGbNjIM,bus=pcie-root-port-3,addr=0x0  \
    -netdev tap,id=idGbNjIM,vhost=on  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=c,strict=off \
    -enable-kvm \
    -monitor stdio \

2. parted /dev/sda disk_set pmbr_boot on
# lsblk
NAME                              MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda                                 8:0    0   20G  0 disk
├─sda1                              8:1    0  600M  0 part /boot/efi
├─sda2                              8:2    0    1G  0 part /boot
└─sda3                              8:3    0 18.4G  0 part
  ├─rhel_bootp--73--131--163-root 253:0    0 16.4G  0 lvm  /
  └─rhel_bootp--73--131--163-swap 253:1    0    2G  0 lvm  [SWAP]
# parted /dev/sda
GNU Parted 3.4
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 21.5GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  21.5GB  19.8GB                                     lvm

(parted) disk_set pmbr_boot on
(parted) quit

3. Try to boot the image
# reboot 

After step 3, failed to boot the image. Please refer to attachment for the screenshot.

Comment 10 Yanan Fu 2021-08-09 06:12:06 UTC

QE bot(pre verify): Set 'Verified:Tested,SanityOnly' as gating/tier1 test pass.

Comment 13 Xueqiang Wei 2021-08-09 14:55:29 UTC

Tested with edk2-ovmf-20210527gite1999b264f1f-5.el9.noarch, not hit this issue. So set status to VERIFIED.


Versions:
Host:
kernel-5.14.0-0.rc4.35.el9.x86_64
qemu-kvm-6.0.0-10.el9
edk2-ovmf-20210527gite1999b264f1f-5.el9.noarch

Guest:
kernel-5.13.0-0.rc7.51.el9.x86_64


Steps:
1. install a rhel9 guest and boot it
/usr/libexec/qemu-kvm \
    -S  \
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/OVMF/OVMF_CODE.secboot.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
    -blockdev node-name=file_ovmf_vars,driver=file,filename=/home/kvm_autotest_root/images/avocado-vt-vm1_rhel900-64-virtio-scsi.qcow2_VARS.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \
    -machine q35,memory-backend=mem-machine_mem,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -m 15360 \
    -object memory-backend-ram,size=15360M,id=mem-machine_mem  \
    -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2  \
    -cpu 'Skylake-Server',+kvm_pv_unhalt \
    -chardev socket,id=qmp_id_qmpmonitor1,server=on,path=/tmp/avocado_dkpw73kl/monitor-qmpmonitor1-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,id=qmp_id_catch_monitor,server=on,path=/tmp/avocado_dkpw73kl/monitor-catch_monitor-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=id3sIdKI \
    -chardev socket,id=chardev_serial0,server=on,path=/tmp/avocado_dkpw73kl/serial-serial0-20210802-043048-9Ao7US0i,wait=off \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20210802-043048-9Ao7US0i,path=/tmp/avocado_dkpw73kl/seabios-20210802-043048-9Ao7US0i,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20210802-043048-9Ao7US0i,iobase=0x402 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel900-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-net-pci,mac=9a:04:b0:7c:7f:9c,id=idOUke6O,netdev=idGbNjIM,bus=pcie-root-port-3,addr=0x0  \
    -netdev tap,id=idGbNjIM,vhost=on  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=c,strict=off \
    -enable-kvm \
    -monitor stdio \

2. parted /dev/sda disk_set pmbr_boot on
# lsblk
NAME          MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda             8:0    0   10G  0 disk 
├─sda1          8:1    0  600M  0 part /boot/efi
├─sda2          8:2    0    1G  0 part /boot
└─sda3          8:3    0  8.4G  0 part 
  ├─rhel-root 253:0    0  7.4G  0 lvm  /
  └─rhel-swap 253:1    0    1G  0 lvm  [SWAP]
# parted /dev/sda
GNU Parted 3.4
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 10.7GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: 

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  10.7GB  9032MB                                     lvm

(parted) disk_set pmbr_boot on
(parted) quit

3. reboot the image, and check "Disk Flags: pmbr_boot"
# reboot 

# parted /dev/sda
GNU Parted 3.4
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 10.7GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: pmbr_boot

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  10.7GB  9032MB                                     lvm

Note You need to log in before you can comment on or make changes to this bug.

berrange
bstinson
bugzilla
carl
chayang
coli
davdunc
davide
extras-qa
jinzhao
juzhang
jwboyer
kkiwi
kraxel
lersek
michel
mrezanin
ngompa13
pbonzini
philmd
virt-maint
xuwei