arm64 images built w/ setjmp module fail w/ license error

[dann frazier]

[Impact]
Any ARM64 GRUB image that includes the setjmp module will fail, reporting an "incompatible license" error. Ubuntu doesn't normally include this module in most images. The one exception I know of is MAAS which, by default, includes all modules when generating EFI images. MAAS currently has a hack to blacklist setjmp on arm64 because a fix wasn't available at the time - but I fear other users will try to do the same thing and hit this issue which can be difficult to track down.

[Test Case]
PXE boot a grub image on arm64 that includes the setjmp module:

$ grub-mkimage -v -o grubaa64.efi -O arm64-efi -d /usr/lib/grub/arm64-efi setjmp

[Regression Risk]
The patch merely adds a license section to the module and it has been tested to work.

[dann frazier (dannf)]

Here's a pull request against debian's git:

The following changes since commit f71c8970804848681afe0eb0a597aefb9d4463a2:

  releasing package grub2 version 2.02~beta2-29 (2015-10-13 23:40:21 +0100)

are available in the git repository at:

  https://git.launchpad.net/~dannf/grub2 people/dannf/arm64-setjmp-license

for you to fetch changes up to 269a263bb6c706329fec0efa0b68d7bd100d4fbc:

  merge patched-people/dannf/arm64-setjmp-license into people/dannf/arm64-setjmp-license (2015-10-23 16:25:25 -0600)

----------------------------------------------------------------
dann frazier (2):
      arm64/setjmp: Add missing license macro
      merge patched-people/dannf/arm64-setjmp-license into people/dannf/arm64-setjmp-license

 debian/.git-dpm | 4 +--
 debian/changelog | 6 ++++
 .../arm64-setjmp-Add-missing-license-macro.patch | 33 ++++++++++++++++++++++
 debian/patches/series | 1 +
 grub-core/lib/arm64/setjmp.S | 2 ++
 5 files changed, 44 insertions(+), 2 deletions(-)
 create mode 100644 debian/patches/arm64-setjmp-Add-missing-license-macro.patch

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02~beta2-31

---------------
grub2 (2.02~beta2-31) unstable; urgency=medium

  * Cherry-pick upstream patch to fix XFS alignment treatment.
  * Cherry-pick upstream patch to fix XFS handling of symlink with
    crc-enabled filesystem.

 -- Colin Watson <email address hidden> Thu, 05 Nov 2015 15:08:03 +0000

[Steve Langasek (vorlon)]

This change is self-evidently correct, but is there a bug task somewhere for MAAS to not generate kitchen-sink .efi images that are exercising non-default configurations? This seems like something that we should abstract at a different layer. E.g., we already have to build grub netboot images in both d-i and grub2 (the grub2 ones in order to get EFI-signed netboot images). It seems preferable for MAAS to be able to use a "stock" netboot image config provided by grub2 instead.

Longer term, this may be by virtue of MAAS using EFI-signed images for arm64, the way it does already on x86_64. So maybe that's the solution here.

[Steve Langasek (vorlon)]

Hello dann, or anyone else affected,

Accepted grub2 into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-9ubuntu1.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Steve Langasek (vorlon)]

Hello dann, or anyone else affected,

Accepted grub2 into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-22ubuntu1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Steve Langasek (vorlon)]

Hello dann, or anyone else affected,

Accepted grub2 into wily-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-29ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello dann, or anyone else affected,

Accepted grub2-signed into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.34.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello dann, or anyone else affected,

Accepted grub2-signed into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.46.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello dann, or anyone else affected,

Accepted grub2-signed into wily-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.55.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[dann frazier (dannf)]

On Tue, Dec 1, 2015 at 7:30 PM, Steve Langasek
<email address hidden> wrote:
> This change is self-evidently correct, but is there a bug task somewhere
> for MAAS to not generate kitchen-sink .efi images that are exercising
> non-default configurations?

Not specifically. We've submitted hacks to MAAS to exclude "bad"
modules temporarily in the past - it currently omits setjmp & progress
on arm64.

> This seems like something that we should
> abstract at a different layer. E.g., we already have to build grub
> netboot images in both d-i and grub2 (the grub2 ones in order to get
> EFI-signed netboot images). It seems preferable for MAAS to be able to
> use a "stock" netboot image config provided by grub2 instead.

Agreed. Ultimately I'd like to see MAAS boot resources provide these
images via signed simplestream metadata, like it does for other boot
files/images.

> Longer term, this may be by virtue of MAAS using EFI-signed images for
> arm64, the way it does already on x86_64. So maybe that's the solution
> here.

It solves part of the problem, but it'd actually make things more
insecure today (LP: #1457982).

  -dann

[dann frazier (dannf)]

I verified that I can successfully netboot from a MAAS server when setjmp is loaded (verified by lsmod from the grub prompt).

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02~beta2-9ubuntu1.5

---------------
grub2 (2.02~beta2-9ubuntu1.5) trusty; urgency=medium

  * d/p/arm64-set-correct-length-of-device-path-end-entry.patch: Fixes
    booting arm64 kernels on certain UEFI implementations. (LP: #1476882)
  * progress: avoid NULL dereference for net files. (LP: #1459872)
  * arm64/setjmp: Add missing license macro. (LP: #1459871)
  * Cherry-pick patch to add SAS disks to the device list from the ofdisk
    module. (LP: #1517586)
  * Cherry-pick patch to open Simple Network Protocol exclusively.
    (LP: #1508893)

 -- dann frazier <email address hidden> Wed, 25 Nov 2015 13:13:35 -0700

[Steve Langasek (vorlon)]

The verification of the Stable Release Update for grub2 has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Chris J Arges (arges)]

Hello dann, or anyone else affected,

Accepted grub2 into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-22ubuntu1.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello dann, or anyone else affected,

Accepted grub2 into wily-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-29ubuntu0.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02~beta2-22ubuntu1.5

---------------
grub2 (2.02~beta2-22ubuntu1.5) vivid; urgency=medium

  * Merge in changes from 2.02~beta2-22ubuntu1.3:
    - d/p/arm64-set-correct-length-of-device-path-end-entry.patch: Fixes
      booting arm64 kernels on certain UEFI implementations. (LP: #1476882)
    - progress: avoid NULL dereference for net files. (LP: #1459872)
    - arm64/setjmp: Add missing license macro. (LP: #1459871)
    - Cherry-pick patch to add SAS disks to the device list from the ofdisk
      module. (LP: #1517586)
    - Cherry-pick patch to open Simple Network Protocol exclusively.
      (LP: #1508893)
  * Cherry-picks to better handle TFTP timeouts on some arches: (LP: #1521612)
    - (7b386b7) efidisk: move device path helpers in core for efinet
    - (c52ae40) efinet: skip virtual IP devices when enumerating cards
    - (f348aee) efinet: enable hardware filters when opening interface
  * Update quick boot logic to handle abstractions for which there is no
    write support. (LP: #1274320)

 -- dann frazier <email address hidden> Wed, 16 Dec 2015 13:31:15 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02~beta2-29ubuntu0.3

---------------
grub2 (2.02~beta2-29ubuntu0.3) wily; urgency=medium

  * Merge in changes from 2.02~beta2-29ubuntu0.1:
    - arm64/setjmp: Add missing license macro. (LP: #1459871)
    - Cherry-pick patch to add SAS disks to the device list from the ofdisk
      module. (LP: #1517586)
    - Cherry-pick patch to open Simple Network Protocol exclusively.
      (LP: #1508893)
  * Cherry-picks to better handle TFTP timeouts on some arches: (LP: #1521612)
    - (7b386b7) efidisk: move device path helpers in core for efinet
    - (c52ae40) efinet: skip virtual IP devices when enumerating cards
    - (f348aee) efinet: enable hardware filters when opening interface

 -- dann frazier <email address hidden> Wed, 16 Dec 2015 10:05:39 -0700