We will need quite some time to ensure this isn't breaking things. The merge proposal was reviewed and I'll upload to Focal-unapproved now. The intention is to not have me testing in advance and then having a short time in -proposed. Instead I think for this case it will be helpful to have it in proposed early, but longer to increase the amount of 3rd-party/people testing it.
Therefore I have added block-proposed tags right away. ** Changed in: ipxe (Ubuntu Eoan) Status: Triaged => Won't Fix ** Tags added: block-proposed block-proposed-focal ** Description changed: [Impact] * Booting some OVMF through the efi roms in our ipxe-qemu package triggers a bad ordering of TPL manipulations and eventually gets the boot stuck. * It was analyzed by Lazlo that this was due to HTTPS being enabled in the rom itself triggering this fail when gathering entropy. In addition isn't required to have HTTPS enabled in this part of the roms as the EFI payload would be able to handle that on it's own (inside OVMF file from src:edk2 instead of the combined rom like efi-e1000.rom). * Disabling HTTPS in the efi-*.rom files should have no functional impact but mitigate the TPL issues we are seeing. [Test Case] * I have provided a test OVMF load attached to this bug https://bugs.launchpad.net/ipxe/+bug/1882671/+attachment/5387066/+files/OVMF-14c7ed8b51f6-DEBUG-enabled.fd * Start that in qemu like: $ qemu-system-x86_64 -enable-kvm -monitor stdio -drive if=pflash,snapshot=on,format=raw,file=/root/edk2/Build/OvmfX64/DEBUG_GCC5/FV/OVMF.fd -global e1000.romfile=/usr/lib/ipxe/qemu/efi-e1000.rom -debugcon file:debug.log -global isa-debugcon.iobase=0x402 # /usr/lib/ipxe/qemu/efi-e1000.rom is from package ipxe-qemu # /root/edk2/Build/OvmfX64/DEBUG_GCC5/FV/OVMF.fd is the debug build I attached Symptoms when failing: - UI never leaves the "initializing" state - in the debug.log the bad case asserts with ASSERT /root/edk2/MdeModulePkg/Core/Dxe/Image/Image.c(1676): Image->Tpl == gEfiCurrentTpl * Extra Test: HTTPS boot a uEFI guest with the efi roms from ipxe-qemu - with old/new ipxe-qmeu code. This shall ensure that OVMF can really take - over as-is or if we need bug 1883114 before we can do so. - Details TBD + with old/new ipxe-qmeu code. This shall ensure that OVMF can really take + over as-is or if we need bug 1883114 before we can do so. + Details TBD when I'm doing these tests + * We pad the rom sizes to be sure, but never the less double check + migrations between Bionic <-> Focal (known to break on size changes) [Regression Potential] * Messing around with rom options always is a complex topic, but I'd like to quote Lazlo (who understands all of this better anyway): "you don't need the iPXE HTTPS implementation, because OVMF already contains the edk2 HTTPS BOOT feature (assuming you build OVMF with "-D NETWORK_HTTP_BOOT_ENABLE -D NETWORK_TLS_ENABLE"). The whole point of CONFIG=qemu is to strip the UEFI build of iPXE to a mere Simple Network Protocol driver. Such a build provides only the lowest level hardware abstraction for UEFI, and the rest (IPv[46], TCP/UDP, DHCP, PXE, TFTP, HTTP(S)) are provided on top by the edk2 implementations of various standard UEFI interfaces." * Never the less, if you seek regressions then in the UEFI handling of HTTPS boot. [Other Info] * This happens with some OVMF versions like the one I have provided for debugging but not with the OVMF delivered as part of Focal. Therefore we should fix it but priority isn't that high. * Quote from the discussion: "If you want to run a full-featured iPXE build on a UEFI machine (including: in an OVMF guest), you still can, of course; lots of people do that, for good reasons. But that use case is best served by the *standalone UEFI application* build of iPXE (produced at "bin-x86_64-efi/ipxe.efi" by "make"). The UEFI *driver* build of iPXE should be as minimal as possible, in comparison -- just provide SNP for the desired NIC models." => Only the EFI roms are changed, neither the PCI roms nor the standalon IPXE builds will be modified. + + * It makes sense to keep this longer in -proposed to increase the + chance of more people testing this. Therefore I'd ask to accept this + early. I can do my (extended) tests against -proposed and we'd get + some community coverage. --- The version of QEMU (4.2.0) packaged for Ubuntu 20.04 hangs indefinitely at boot if an OVMF bios is used. This happens ONLY with qemu-system- x86_64. qemu-system-i386 works fine with the latest ia32 OVMF bios. NOTE[1]: the same identical OVMF bios works fine on QEMU 2.x packaged with Ubuntu 18.04. NOTE[2]: reproducing the fatal bug requires *no* operating system: qemu-system-x86_64 -bios OVMF-pure-efi.fd On its window QEMU gets stuck at the very first stage: "Guest has not initialized the display (yet)." NOTE[3]: QEMU gets stuck no matter if KVM is used or not. NOTE[4]: By adding the `-d int` option it is possible to observe that QEMU is, apparently, stuck in an endless loop of interrupts. For the first few seconds, registers' values vary quickly, but at some point they reach a final value, while the interrupt counter increments: 2568: v=68 e=0000 i=0 cpl=0 IP=0038:0000000007f1d225 pc=0000000007f1d225 SP=0030:0000000007f0c8d0 env->regs[R_EAX]=0000000000000000 RAX=0000000000000000 RBX=0000000007f0c920 RCX=0000000000000000 RDX=0000000000000001 RSI=0000000006d18798 RDI=0000000000008664 RBP=0000000000000000 RSP=0000000007f0c8d0 R8 =0000000000000001 R9 =0000000000000089 R10=0000000000000000 R11=0000000007f2c987 R12=0000000000000000 R13=0000000000000000 R14=0000000007087901 R15=0000000000000000 RIP=0000000007f1d225 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0030 0000000000000000 ffffffff 00cf9300 DPL=0 DS [-WA] CS =0038 0000000000000000 ffffffff 00af9a00 DPL=0 CS64 [-R-] SS =0030 0000000000000000 ffffffff 00cf9300 DPL=0 DS [-WA] DS =0030 0000000000000000 ffffffff 00cf9300 DPL=0 DS [-WA] FS =0030 0000000000000000 ffffffff 00cf9300 DPL=0 DS [-WA] GS =0030 0000000000000000 ffffffff 00cf9300 DPL=0 DS [-WA] LDT=0000 0000000000000000 0000ffff 00008200 DPL=0 LDT TR =0000 0000000000000000 0000ffff 00008b00 DPL=0 TSS64-busy GDT= 00000000079eea98 00000047 IDT= 000000000758f018 00000fff CR0=80010033 CR2=0000000000000000 CR3=0000000007c01000 CR4=00000668 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 CCS=0000000000000044 CCD=0000000000000000 CCO=EFLAGS EFER=0000000000000d00 NOTE[5]: Just to better help the investigation of the bug, I'd like to remark that the issue is NOT caused by an endless loop of triple-faults. I tried with -d cpu_reset and there is NO such loop. No triple fault whatsoever. NOTE[6]: The OVMF version used for the test has been downloaded from: https://www.kraxel.org/repos/jenkins/edk2/edk2.git-ovmf-x64-0-20200515.1398.g6ff7c838d0.noarch.rpm but the issue is the same with older OVMF versions as well. Please take a look at it, as the bug is NOT a corner case. QEMU 4.2.0 cannot boot with an UEFI firmware (OVMF) while virtualizing a x86_64 machine AT ALL. Thank you very much, Vladislav K. Valtchev -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1882671 Title: unbalanced UEFI TPL manipulations in iPXE with DOWNLOAD_PROTO_HTTPS enabled To manage notifications about this bug go to: https://bugs.launchpad.net/ipxe/+bug/1882671/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs