[Bug 1947046] Re: EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k boundary

[Julian Andres Klode]

There was some state mix up but grub2 was fixed in jammy already, it's
grub2-unsigned, specifically the loader that it used on secure boot that
was not fixed.

I'll discuss this with Mate if that's worth fixing. It's a cosmetic
issue, the patch is large, and all that code has been ripped out in
2.12.

Thanks for your patch but I'm afraid it won't be much use, we'll have to
start from scratch with cherty-picking the commit properly in the patch
queue git branch.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2-unsigned in Ubuntu.
https://bugs.launchpad.net/bugs/1947046

Title:
  EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary

Status in grub2 package in Ubuntu:
  Fix Released
Status in grub2-unsigned package in Ubuntu:
  Fix Released
Status in grub2 source package in Jammy:
  Fix Released
Status in grub2-unsigned source package in Jammy:
  Triaged

Bug description:
  [Impact]
  Recent kernels emit the following error message when booting on arm64 platforms:

    EFI stub: ERROR: FIRMWARE BUG: kernel image not aligned on 64k
  boundary

  While this doesn't appear to cause any functional issues - and indeed,
  the kernel commit that added the error[*] says "We can deal with this,
  but let's check for this condition anyway", it is still likely to
  cause user concern.

  [*]
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c32ac11da3f83bb42b986702a9b92f0a14ed4182

  [Test Case]
  This issue can be reproduced by launching a VM with secure boot enabled on an arm64 machine running jammy, e.g.
  lxc launch ubuntu:jammy testsb --vm -c security.secureboot=true -c limits.cpu=16 -c limits.memory=16GiB

  The message shows in early boot, so we need to connect to VM console to see the warning message:
  lxc console testsb

  With the fix, the kernel image loaded by grub will be 64k aligned and the warning message disappears as below:
  BdsDxe: loading Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
  BdsDxe: starting Boot0008 "ubuntu" from HD(15,GPT,5570F84F-4616-4E20-AD7E-CF915E637099,0x800,0x31801)/\EFI\ubuntu\shimaa64.efi
  EFI stub: Booting Linux Kernel...
  EFI stub: UEFI Secure Boot is enabled.
  EFI stub: Using DTB from configuration table
  EFI stub: Exiting boot services...
  EFI stub: UEFI Secure Boot is enabled.
  [    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd082]
  [    0.000000] Linux version 5.15.0-91-generic (buildd at bos03-arm64-015) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #101-Ubuntu SMP Tue Nov 14 13:29:11 UTC 2023 (Ubuntu 5.15.0-91.101-generic 5.15.131)

  For testing secure boot, refer to the following link for creating test key, enroll to shim and sign the test grub
  https://ubuntu.com/blog/how-to-sign-things-for-secure-boot

  
  [Fix]
  https://github.com/rhboot/grub2/commit/6a5babc21e3ec665e0bae30e399db296451c121e

  [What Could Go Wrong]

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1947046/+subscriptions