olifre - 6 days ago

Dear Rod,

hope you are still around and doing well!

I have encountered a problem with recent Shim releases in combination with recent UEFI firmwares, and rEFInd:
https://github.com/rhboot/shim/issues/803

The issues can be mostly resolved with the attached patch. In summary, Shim complains via:
"Invalid call dxe_update_mem_attrs, addr is not page aligned"
since the SBAT section is not page aligned by objcopy, as the syntax used in the Makefiles:
--adjust-section-vma .sbat+10000000
yields a base offset of decimal 10000000, not hexadecimal 0x10000000.
The resulting binaries all have the SBAT section at 0x989680 which is not page aligned.

Subsequently to the warning message, several hardware machines lock up / show erratic behaviour, or rEFInd gets stuck right away or when loading filesystem drivers.

Patching the corresponding makefiles to use 0x10000000 as base fixes the warning, and fixes this behaviour.
After this patch (credits for nailing the issue go to @byrotimi on GitHub) all issues:

  • could be fixed on a Microsoft Surface Pro 6 with Fedora/Ultramarine
  • could be fixed on a Dell Pro 14 Premium PA14250 with most recent UEFI firmware
  • could be partially fixed on an Alienware 18 Area-51 AA18250. Here, the system still gets stuck when loading an EFI stub loader kernel.

Concerning the latter, rEFInd logs show (with loglevel 4):

13:36:26 - In IsValidLoader(), LoadedSize is 4096, SignaturePos is 64
13:36:26 - '\vmlinuz-7.1.12-gentoo-dist' is a valid loader file
13:36:26 - Getting EFI variable 'SecureBoot' from NVRAM
13:36:26 - Getting EFI variable 'SetupMode' from NVRAM
13:36:26 - Employing Shim LoadImage() hack
13:36:26 - Launching 'vmlinuz-7.1.12-gentoo-dist'

and then just stop. The system is still responsive at this point (i.e. Ctrl+Alt+Del works, NumLock works) but there is no further output, neither if using text mode nor graphics mode.

It would be great if you have any idea on this issue or proposals on how to debug this further. And of course if you could verify and apply the patch 🙂.

Cheers and thanks in advance,
Oliver

 
refind-fix-sbat-alignment.patch