Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1988762

Summary:	edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec
Product:	Red Hat Enterprise Linux 8	Reporter:	Neal Gompa <ngompa13>
Component:	edk2	Assignee:	Philippe Mathieu-Daudé <philmd>
Status:	CLOSED ERRATA	QA Contact:	Xueqiang Wei <xuwei>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	CentOS Stream	CC:	berrange, bstinson, bugzilla, carl, davdunc, davide, extras-qa, jwboyer, kraxel, lersek, michel, mrezanin, ngompa13, pbonzini, philmd, virt-bugs, virt-maint, xuwei
Target Milestone:	beta	Keywords:	RFE, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	edk2-20210527gite1999b264f1f-3.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1988760	Environment:
Last Closed:	2021-11-09 18:08:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Neal Gompa 2021-07-31 20:48:50 UTC

+++ This bug was initially created as a clone of Bug #1988760 +++

Description of problem:

edk2-ovmf is taking a PMBR protective record's BootIndictor bit into account when deciding whether the GPT is valid or not. When pmbr_boot (a.k.a setting a bit on the protective record partition entry's BootIndictor in the PMBR, a.k.a. setting the boot flag, a.k.a. setting the active bit) is set, the GPT is seemingly considered invalid by edk2-ovmf and the system is not bootable.

There is now an upstream commit that can be backported to fix this: https://github.com/tianocore/edk2/commit/b3db0cb1f8d163f22b769c205c6347376a315dcd

Version-Release number of selected component (if applicable):
20200602gitca407c7246bf-4.el8_4.1

How reproducible:
Always


Steps to Reproduce:
1. Create a UEFI bootable image, boot it
2. parted /dev/vda disk_set pmbr_boot on
3. Try to boot the image

Actual results:

Firmware drops to an EFI shell.

Expected results:

It should boot.


Additional info:

Upstream bug has details including a test image attached.

Comment 4 Yanan Fu 2021-08-06 14:32:30 UTC

QE bot(pre verify): Set 'Verified:Tested,SanityOnly' as gating/tier1 test pass.

Comment 7 Xueqiang Wei 2021-08-09 15:49:52 UTC

Reproduced it with edk2-ovmf-20210527gite1999b264f1f-1.el8.noarch.

Tested with edk2-20210527gite1999b264f1f-3.el8, not hit this issue. So set status to VERIFIED.


Versions:
Host:
kernel-4.18.0-325.el8.x86_64
qemu-kvm-6.0.0-27.module+el8.5.0+12121+c40c8708
edk2-ovmf-20210527gite1999b264f1f-3.el8.noarch

Guest:
kernel-4.18.0-319.el8.x86_64


Steps:
1. install a rhel8.5.0 guest and boot it
/usr/libexec/qemu-kvm \
    -S  \
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -blockdev node-name=file_ovmf_code,driver=file,filename=/usr/share/OVMF/OVMF_CODE.secboot.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_code,driver=raw,read-only=on,file=file_ovmf_code \
    -blockdev node-name=file_ovmf_vars,driver=file,filename=/home/kvm_autotest_root/images/avocado-vt-vm1_rhel850-64-virtio-scsi.qcow2_VARS.fd,auto-read-only=on,discard=unmap \
    -blockdev node-name=drive_ovmf_vars,driver=raw,read-only=off,file=file_ovmf_vars \
    -machine q35,memory-backend=mem-machine_mem,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars \
    -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
    -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x2 \
    -m 15360 \
    -object memory-backend-ram,size=15360M,id=mem-machine_mem  \
    -smp 16,maxcpus=16,cores=8,threads=1,dies=1,sockets=2  \
    -cpu 'Skylake-Server',+kvm_pv_unhalt \
    -chardev socket,id=qmp_id_qmpmonitor1,server=on,path=/tmp/avocado_dkpw73kl/monitor-qmpmonitor1-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_qmpmonitor1,mode=control \
    -chardev socket,id=qmp_id_catch_monitor,server=on,path=/tmp/avocado_dkpw73kl/monitor-catch_monitor-20210802-043048-9Ao7US0i,wait=off  \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=id3sIdKI \
    -chardev socket,id=chardev_serial0,server=on,path=/tmp/avocado_dkpw73kl/serial-serial0-20210802-043048-9Ao7US0i,wait=off \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20210802-043048-9Ao7US0i,path=/tmp/avocado_dkpw73kl/seabios-20210802-043048-9Ao7US0i,server=on,wait=off \
    -device isa-debugcon,chardev=seabioslog_id_20210802-043048-9Ao7US0i,iobase=0x402 \
    -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
    -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,auto-read-only=on,discard=unmap,aio=threads,filename=/home/kvm_autotest_root/images/rhel850-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,read-only=off,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
    -device virtio-net-pci,mac=9a:04:b0:7c:7f:9c,id=idOUke6O,netdev=idGbNjIM,bus=pcie-root-port-3,addr=0x0  \
    -netdev tap,id=idGbNjIM,vhost=on  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=c,strict=off \
    -enable-kvm \
    -monitor stdio \

2. parted /dev/sda disk_set pmbr_boot on
# lsblk
NAME          MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda             8:0    0   10G  0 disk 
├─sda1          8:1    0  600M  0 part /boot/efi
├─sda2          8:2    0    1G  0 part /boot
└─sda3          8:3    0  8.4G  0 part 
  ├─rhel-root 253:0    0  7.4G  0 lvm  /
  └─rhel-swap 253:1    0    1G  0 lvm  [SWAP]
# parted /dev/sda
GNU Parted 3.2
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 10.7GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: 

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  10.7GB  9032MB                                     lvm

(parted) disk_set pmbr_boot on
(parted) quit

3. reboot the image, and check "Disk Flags: pmbr_boot"
# reboot 

# parted /dev/sda
GNU Parted 3.2
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print                                                            
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sda: 10.7GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: pmbr_boot

Number  Start   End     Size    File system  Name                  Flags
 1      1049kB  630MB   629MB   fat32        EFI System Partition  boot, esp
 2      630MB   1704MB  1074MB  xfs
 3      1704MB  10.7GB  9032MB                                     lvm

Comment 9 errata-xmlrpc 2021-11-09 18:08:20 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: edk2 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4198