Re: Linux kernel fails to boot after "Set boot script outside SMM after SmmReadyToLock"

[Laszlo Ersek <lersek@redhat.com>]

On 10/31/18 13:54, Hristo Mihaylov wrote:
> Hello,
> 
> I'm building a custom x86_64 platform. It gets to BDS, where I select an USB with Debian as a boot device.
> 
> ```
> [Bds]Booting UEFI USB Flash Memory C412F52D6C89C0210002C15B
> error: no suitable video mode found.
> error: no video mode activated.
> 
> 
> 
>                          GNU GRUB  version 2.02~beta3-5
> 
> /----------------------------------------------------------------------------\
> | Graphical install                                                          |
> |*Install                                                                    |
> | Advanced options ...                                                       |
> | Install with speech synthesis                                              |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> \----------------------------------------------------------------------------/
>       Use the ^ and v keys to select which entry is highlighted.
>       Press enter to boot the selected OS, `e' to edit the commands
>       before booting or `c' for a command-line.
> 
> 
> 
>                          GNU GRUB  version 2.02~beta3-5
> 
> /----------------------------------------------------------------------------\
> |setparams 'Install'                                                         |
> |                                                                            |
> |    set background_color=black                                              |
> |    linux    /install.amd/vmlinuz console=ttyS0,115200                      |
> |    initrd   /install.amd/initrd.gz                                         |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> |                                                                            |
> \----------------------------------------------------------------------------/
> 
>       Minimum Emacs-like screen editing is supported. TAB lists
>       completions. Press Ctrl-x or F10 to boot, Ctrl-c or F2 for a
>       command-line or ESC to discard edits and return to the GRUB menu.
>   Booting a command list
> 
> error: no suitable video mode found.
> Booting in blind mode
> ```
> 
> Here I set the serial console as a display device. Then I continue into booting the USB stick where I see 2 fatal errors.
> Afterwhich, the kernel starts booting, but fails to boot completely with no error message or anything. The last few lines
> Discover SATA devices.
> 
> ```
> OnExitBootServices..
> IioInit Late Secure the Platform (TXT)..
> S3BootScriptSaveMemWrite called
> FATAL ERROR: Set boot script outside SMM after SmmReadyToLock!!!
> S3BootScriptSaveMemWrite called
> FATAL ERROR: Set boot script outside SMM after SmmReadyToLock!!!
> SmmInstallProtocolInterface: 296EB418-C4C8-4E05-AB59-39E8AF56F00A 0
> SmmLockBoxSmmLib RestoreLockBox - Enter
> SmmLockBoxSmmLib RestoreLockBox - Exit (Success)
> SmmLockBoxSmmLib SaveLockBox - Enter
> LockBoxGuid - B5AF1D7A-B8CF-4EB3-8925-A820E16B687D, SmramBuffer - 0x76F49000, Length - 0x36F6
> SmmLockBoxSmmLib SaveLockBox - Exit (Success)
> SmmLockBoxSmmLib SaveLockBox - Enter
> LockBoxGuid - 627EE2DA-3BF9-439B-929F-2E0E6E9DBA62, SmramBuffer - 0x76F48000, Length - 0x18
> SmmLockBoxSmmLib SaveLockBox - Exit (Success)
> SmmLockBoxSmmLib SetLockBoxAttributes - Enter
> SmmLockBoxSmmLib SetLockBoxAttributes - Exit (Success)
> [    0.000000] Linux version 4.9.0-6-amd64 (debian-kernel@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) #1 SMP Debian 4.9.82-1+deb9u3 (2018-03-02)
> [    0.000000] Command line: BOOT_IMAGE=/install.amd/vmlinuz console=ttyS0,115200
> [    0.000000] Intel Spectre v2 broken microcode detected; disabling Speculation Control
> ```
> 
> Is this related to the SMM fatal errors? It's occurring here https://github.com/tianocore/edk2/blob/14923c1a6bf9940b48feeaf47cb5d6c662b6528c/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c#L829
> There a lot of function calls and I can't print a stack trace.
> 
> If this is related to the SMM errors, any advice on how to fix them? If not, I guess it's off to the Debian mailing lists.

I don't know why the kernel fails to boot, but I can comment on the SMM
error messages.

BDS has to lock down SMM before it launches third party drivers /
applications. Therefore an ExitBootServices() callback ("notify
function") that attempts to write the S3 boot script, *in combination
with* a LockBox library instance that is backed by SMM, will not work.

The S3 boot script generally serves for re-initializing / restoring
platform chipset state on S3 resume, so I don't see why it should be
delayed until an EBS handler.

The Intel whitepaper

  A Tour Beyond BIOS
  Implementing S3 Resume with EDKII

explains the right order of steps in section "Normal Boot Flow for S3".
(The copy I have is quite dated at this point: October 2014.)

You can also refer to PlatformBootManagerBeforeConsole() in
"OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c":

- signal the gEfiEndOfDxeEventGroupGuid event group
- call S3SaveStateProtocol->Write
- install gEfiDxeSmmReadyToLockProtocolGuid

(Speaking in terms of PlatformBootManagerLib APIs, these should occur in
BeforeConsole, and not in AfterConsole, in order to precede 3rd party
drivers/apps. EfiBootManagerDispatchDeferredImages() called in
BeforeConsole (meaning PCI oproms basically), but similarly after the
last step of the above triplet.)

Hope this helps,
Laszlo