grub is prevented from booting on UEFI Arm64 Laptops - requires 4k aligned headers

[mahmoh]

[Impact]
Ubuntu is not bootable on various arm64 laptops (HP Envy x2, Asus NovaGo, Lenovo Miix 630 and maybe the Lenovo Yoga C630) because GRUB fails to boot. The reason is that their firmware tries to ensure NX protection flags which it can only do when the code is 4K aligned.

[Test Case]
Install and boot Ubuntu on one of the above arm64 laptops.

[Fix]
(pending upstream)

[Regression Risk]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[dann frazier (dannf)]

@mahmoh - do you know if GRUB is the only blocker here? That is, does an Ubuntu kernel otherwise support any of these platforms?

Ubuntu does provide a -snapdragon kernel but, AFAIK, that is only installable via Ubuntu Core for the DragonBoard 410c. The Ubuntu (Server) installer uses the -generic kernel. Is there enough support in the -generic kernel to make Ubuntu usable on the Envy x2?

I'm certainly not opposed to adding this support to GRUB either way - I'm just curious if doing so will unblock you or just get you to the next step.

[mahmoh (mahmoh)]

@dannf it's the first of two I believe. This will allow any kernel to boot but then we hit other problems booting stock kernels. The -snapdrogon kernel is for 410E vs. 835/850.

[mahmoh (mahmoh)]

@dannf it appears the patches have may now have been finally approved?:

  https://<email address hidden>/msg28322.html

The tester reports that the stock Debian Buster installer works out of the box on this device?! If so, it would be nice if Ubuntu could just pick up the patch set that makes the kernel just work.

[dann frazier (dannf)]

On Fri, Feb 1, 2019 at 7:40 PM mahmoh <email address hidden> wrote:
>
> @dannf it appears the patches have may now have been finally approved?:
>
> https://<email address hidden>/msg28322.html

Yep! Though, I'm going to wait until they are actually merged. It is
too late to make 18.04.2, and we still have a lot of time before
18.04.3 and 19.04.

> The tester reports that the stock Debian Buster installer works out of
> the box on this device?! If so, it would be nice if Ubuntu could just
> pick up the patch set that makes the kernel just work.

Kernel support is a different question - if you know what patches are
required for that, please open a bug against the kernel w/ that info.

  -dann

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02+dfsg1-12ubuntu1

---------------
grub2 (2.02+dfsg1-12ubuntu1) disco; urgency=medium

  * Merge against Debian unstable; remaining changes (LP: #564853):
    - debian/control: Update Vcs fields for code location on Ubuntu.
    - debian/control: Breaks shim (<< 13).
    - Secure Boot support: use newer patchset from rhboot repo:
      - many linuxefi_* patches added and modified
      - dropped debian/patches/linuxefi_require_shim.patch
      - renamed: debian/patches/no_insmod_on_sb.patch ->
        debian/patches/linuxefi_no_insmod_on_sb.patch
    - debian/patches/install_signed.patch, grub-install-extra-removable.patch:
      - Make sure if we install shim; it should also be exported as the default
        bootloader to install later to a removable path, if we do.
      - Rework grub-install-extra-removable.patch to reverse its logic: in the
        default case, install the bootloader to /EFI/BOOT, unless we're trying
        to install on a removable device, or explicitly telling grub *not* to
        do it.
      - Install a BOOT.CSV for fallback to use.
      - Make sure postinst and templates know about the replacement of
        --force-extra-removable with --no-extra-removable.
    - debian/patches/add-an-auto-nvram-option-to-grub-install.patch: Add the
      --auto-nvram option to grub-install for auto-detecting NVRAM availability
      before attempting NVRAM updates.
    - debian/build-efi-images: provide a new grub EFI image which enforces that
      loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is
      the same as grub$arch.efi minus the 'linux' module. Without fallback to
      'linux' for unsigned loading, this makes it effectively enforce having a
      signed kernel.
    - Verify that the current and newer kernels are signed when grub is
      updated, to make sure people do not accidentally shutdown without a
      signed kernel.
    - debian/default/grub: replace GRUB_HIDDEN_* variables with the less
      confusing GRUB_TIMEOUT_STYLE=hidden.
    - debian/patches/support_initrd-less_boot.patch: Added knobs to allow
      non-initrd boot config.
    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
      number of entries/clutter from other OSes in Petitboot
    - debian/patches/shorter_version_info.patch: Only show the upstream version
      in menu and console, and hide the package one in a package_version
      variable.
    - debian/patches/skip_text_gfxpayload_where_not_supported.patch: Skip the
      'text' payload if it's not supported but present in gfxpayload, such as
      on EFI systems.
    - debian/patches/bufio_sensible_block_sizes.patch: Don't use arbitrary file
      fizes as block sizes in bufio: this avoids potentially seeking back in
      the files unnecessarily, which may require re-open files that cannot be
      seeked into, such as via TFTP.
    - debian/patches/ofnet-init-structs-in-bootpath-parser.patch: initialize
      structs in bootpath parser.
    - debian/rules: shuffle files around for now to keep build artefacts
      for signing at the same location as they were expected by Launchpad.
    - debian/ru...