Occasionally crashes in _relocate() on arm64

By attaching gdb to the guest, I believe I've identified where it's crashing. The executing frame appears to be in the _relocate() function:

reloc_aarch64.c:_relocate()
   case R_AARCH64_RELATIVE:
    addr = (unsigned long *)
     (ldbase + rel->r_offset);
    *addr = ldbase + rel->r_addend;
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    break;

   default:

The previous address points to the following code, which suggests my addresses are sane:
crt0-efi-aarch64.S:
 adrp x1, _DYNAMIC
 add x1, x1, #:lo12:_DYNAMIC
 bl _relocate
                 ^^^^^^^^^
 cbnz x0, 0f

fyi, there's a patch posted upstream that looks promising:
  https://github.com/rhboot/shim/issues/371#issuecomment-862170542

Upstream pull request #383 has been included in 15.4-0ubuntu6~uefi1, binaries can be found at

http://ppa.launchpad.net/ubuntu-uefi-team/ppa/ubuntu/dists/hirsute/main/signed/shim-arm64/15.4-0ubuntu6~uefi1/

Please verify that it fixes the bug.

Well, I think you already verified this in the upstream bug :)

Yeah, but doesn't hurt to verify the official build either. I've put 16 VMs in reboot loops w/ the updated shim and they've cumulatively successfully approximately 1000 times - so I think we're good :)

s/successfully/successfully reboot/

This bug was fixed in the package shim - 15.4-0ubuntu7

---------------
shim (15.4-0ubuntu7) hirsute; urgency=medium

  * Fix load option parsing, and thus fwupd execution (LP: #1929471) (PR #379)
  * Fix occasional crashes in _relocate() on arm64 (LP: #1928010) (PR #383)
  * Fix accidental deletion of RT variables (LP: #1934506) (PR #387)
  * mok: relax the maximum variable size check (LP: #1934780) (PR #369)

 -- Julian Andres Klode <email address hidden> Wed, 07 Jul 2021 10:57:35 +0200

Hello dann, or anyone else affected,

Accepted shim into hirsute-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim/15.4-0ubuntu7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-hirsute to verification-done-hirsute. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-hirsute. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello dann, or anyone else affected,

Accepted shim into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim/15.4-0ubuntu7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello dann, or anyone else affected,

Accepted shim-signed into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.40.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

= Verification =
Survivied 368 reboots so far, so I think we're good :)
shim-signed 1.50+15.4-0ubuntu7

Hello dann, or anyone else affected,

Accepted shim into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim/15.4-0ubuntu7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello dann, or anyone else affected,

Accepted shim-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.37~18.04.9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello dann, or anyone else affected,

Accepted shim into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim/15.4-0ubuntu7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello dann, or anyone else affected,

Accepted shim-signed into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.33.1~16.04.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

The arm64/shim package in xenial-proposed (15.4-0ubuntu7) seems to be lacking content, so I'll mark that verification failed:

ubuntu@xenial:~$ dpkg -L shim
/.
/usr
/usr/lib
/usr/lib/shim
/usr/lib/shim/BOOTAA64.CSV
/usr/lib/shim/fbaa64.efi
/usr/lib/shim/mmaa64.efi
/usr/lib/shim/shimaa64.efi
/usr/share
/usr/share/doc
/usr/share/doc/shim
/usr/share/doc/shim/changelog.Debian.gz
/usr/share/doc/shim/copyright
ubuntu@xenial:~$ sudo apt install shim
Reading package lists... Done

Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  shim
1 upgraded, 0 newly installed, 0 to remove and 4 not upgraded.
Need to get 12.5 kB of archives.
After this operation, 2,578 kB disk space will be freed.
Get:1 http://ports.ubuntu.com/ubuntu-ports xenial-proposed/main arm64 shim arm64 15.4-0ubuntu7 [12.5 kB]
Fetched 12.5 kB in 0s (863 kB/s)
(Reading database ... 63671 files and directories currently installed.)
Preparing to unpack .../shim_15.4-0ubuntu7_arm64.deb ...
Unpacking shim (15.4-0ubuntu7) over (15+1552672080.a4a1fbe-0ubuntu2) ...
Setting up shim (15.4-0ubuntu7) ...
ubuntu@xenial:~$ dpkg -L shim
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/shim
/usr/share/doc/shim/buildinfo_arm64.gz
/usr/share/doc/shim/changelog.Debian.gz
/usr/share/doc/shim/copyright
ubuntu@xenial:~$

= focal verification =
shim-signed 1.40.6+15.4-0ubuntu7 has survived > 60 reboots

Oh, I see that the shim packages - both amd64 and arm64 - appear to no longer contain binaries. The thing I tested successfully in Comment #11 was shim-signed, which does. I'm not sure if this change to shim is intentional or not (I don't see anything obvious in the changelog), so I'll go ahead and mark this as verification-failed across the board for now.

It's been that way for a while (15.4-0ubuntu1 probably, ubuntu5 certainly). Whether that was really intentional I can't say. It is however nothing we can afford blocking this on and do another round of resigning.

We do not support arm64 secure boot on xenial, so this is practically verified.

Dimitri confirmed this change was intentional, fwiw. The auxiliary binaries moved to shim-signed, and there isn't really any need for unsigned shim binaries.

Hello dann, or anyone else affected,

Accepted shim-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.37~18.04.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

= bionic verification =
I verified that shim*-signed* version 1.37~18.04.10+15.4-0ubuntu7 reboots fine.

The verification of the Stable Release Update for shim has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package shim - 15.4-0ubuntu7

---------------
shim (15.4-0ubuntu7) hirsute; urgency=medium

  * Fix load option parsing, and thus fwupd execution (LP: #1929471) (PR #379)
  * Fix occasional crashes in _relocate() on arm64 (LP: #1928010) (PR #383)
  * Fix accidental deletion of RT variables (LP: #1934506) (PR #387)
  * mok: relax the maximum variable size check (LP: #1934780) (PR #369)

 -- Julian Andres Klode <email address hidden> Wed, 07 Jul 2021 10:57:35 +0200

What are the plans for a release to bionic?

This bug was fixed in the package shim - 15.4-0ubuntu7

---------------
shim (15.4-0ubuntu7) hirsute; urgency=medium

  * Fix load option parsing, and thus fwupd execution (LP: #1929471) (PR #379)
  * Fix occasional crashes in _relocate() on arm64 (LP: #1928010) (PR #383)
  * Fix accidental deletion of RT variables (LP: #1934506) (PR #387)
  * mok: relax the maximum variable size check (LP: #1934780) (PR #369)

 -- Julian Andres Klode <email address hidden> Wed, 07 Jul 2021 10:57:35 +0200