[SOLVED] LoadImage in efi_image_probe fails on Lenovo ThinkPad Yoga 11e

[SebastianRoth]

Hi everyone,

we have another odd issue with one of these new devices (see thread subject). We try loading the kernel (version 4.4.x, EFI_STUB enabled!) via ipxe.efi and see this:


I had the impression that maybe the kernel image got corrupted while transferring it via HTTP so we added imgverify trust check command and now we see this:


From my point of view this boils down to LoadImage call in efi_image_probe (image/efi_image.c) not being able to load that kernel image. So we tried to boot exactly this bzImage on a USB key as \EFI\BOOT\BOOTX64.EFI and guess what. I boots without an issue.

Has anyone an idea how to further debug this issue? Going to add EFI call debug next to see if we can get more information on where exactly LoadImage fails.

Thanks in advance!

Cheers
Sebastian

[NiKiZe]

The error: http://ipxe.org/7f048182 should give you link to exact line that is possible failure sources. (http://ipxe.org/2e008081 is just a subsequent error from the above?)

Building with DEBUG=efi_image might give some info on why it fails.

(or maybe that was what you had in the output?)

What does The (linux) file command give for bzImage, can you share bzImage?

Could it be that secure boot is enabled and that refuses to load the kernel in network mode, however in usb mode, or local disk it is allowed. (I have seen similar things before where unsigned ipxe.efi could be loaded, but trying to start unsigned wimboot from there failed)

[SebastianRoth]

Hi NiKiZe,

thanks for your answer!

(2016-04-04 18:28)NiKiZe Wrote:  The error: http://ipxe.org/7f048182 should give you link to exact line that is possible failure sources. (http://ipxe.org/2e008081 is just a subsequent error from the above?)

As mentioned in the subject it fails on LoadImage in the efi_image_probe function. There is no doubt about it I'd say.

(2016-04-04 18:28)NiKiZe Wrote:  Building with DEBUG=efi_image might give some info on why it fails.

I will give this a try but I guess it won't give us any more information as there is only one DBGC statement in the probe function.

(2016-04-04 18:28)NiKiZe Wrote:  What does The (linux) file command give for bzImage, can you share bzImage?

Code:

Linux kernel x86 boot executable bzImage, version 4.5.0 (root@debian64) #1 SMP Mon Mar 14 06:35:01 EDT 2016, RO-rootFS, swap_dev 0x6, Normal VGA

(2016-04-04 18:28)NiKiZe Wrote:  Could it be that secure boot is enabled and that refuses to load the kernel in network mode, however in usb mode, or local disk it is allowed. (I have seen similar things before where unsigned ipxe.efi could be loaded, but trying to start unsigned wimboot from there failed)

I have double checked. Secure boot is off. If I turn it on ipxe does not load...

[NiKiZe]

Reading you post again, I fully agree, do you only get this on this particular hardware, or is it reproducible in other efi envs as well? (if not is there any firmware upgrades available for the machine?)

Might verry well be wrong here, but it fails to load, and it is not even tried to execute.

[SebastianRoth]

OMG... We found out what the issue is/was. Too bad that we didn't check ALL the BIOS settings earlier. On that Yoga (and most probably on other models as well) there is a so called Embedded Security Subsystem chip. Disabled and now LoadImage works like a charm. Funny that it does not prevent iPXE from being loaded in the first place.

[NiKiZe]

Glad you found it.

Could it be that some implementations of EFI does not prevent entering unsigned EFI code, but rather only exiting EFI boot from unsigned code. At-least something like that since I have seen secure boot enabled machines starting ipxe without issue, but refusing to start wimboot. (or actually even Microsoft memtest)

I wonder if it would be possible to chain into (signed) Microsoft bootmgr from ipxe with the same config as you are using when bzImage fails.