Changes/Edk2Security: The guest OS boot chain is not NX clean

Ask Fedora
,
1

Hi,

im running F42 Silverblue fully updated, with libvirt/KVM layered. All is running fine, except while booting my Fedora guests (UEFI Secureboot), i got the following Warning:

PageFaultExitBoot: Page fault fixups needed (NX: 0, RW: 1).
PageFaultExitBoot: The guest OS boot chain is not NX clean.

Windows 10 Guests boots fine, but TPM is tampered - i got a message like Error Code 10: protocol mismatch in the device manager.

i could fix the windows guest by switching OVMF_CODE.secboot.fd to OVMF_CODE_4M.secboot.qcow2 and OVMF_VARS.fd to OVMF_VARS_4M.secboot.qcow2 and reinitializing the TPM, but have no luck with the linux guests. Also i’ve tried to reset Secureboot to factory default with no avail.

any ideas?

Thanks!

2

OVMF_VARS.fd doesn’t have enough space for the dbx updates, so the 4Meg version OVMF_VARS_4M.secboot.qcow2 is required. I don’t know if that has anything to do with your problem. Also, I am not sure you can safely switch these on an existing virtual machine, or if you need to create a new virtual machine.

3

Hi @vekruse,

I completely forgot to mention that I have already attempted this with a completely new VM, the results are the same.

As long as you didn’t store any custom data in the DBs or in the TPM, i wouldn’t expect problems at all. for example, if you use Bitlocker on that Windows guest, i’m sure, you have to rewrite the Bitlocker-key into the TPM store. Or maybe the TPM isn’t touched at all and would work anyway…. hmm I think I have to test this…

4

Custom data includes the boot configuration too.

5

Yeah, i think, you’re right. I just tested it with Fedora, created a win10 VM, enabled Bitlocker and did upgrade to F42 afterwards. Of course, the VM couldn’t boot, Bitlocker asks for the recovery key.

Finally in the Guest OS again, it shows the error code 10 for the TPM device. After changing to OVMF_CODE/VARS_4M.secboot.qcow2 Variant and entering the recovery key, the issue is fixed the Windows 10 VM….

however, with Linux Guest, with the previous OVMF_CODE.secboot.fd, I got the

PageFaultExitBoot: Page fault fixups needed (NX: 0, RW: 1).
PageFaultExitBoot: The guest OS boot chain is not NX clean.

followed by this Error:

Aug 31 00:33:00 fedora kernel: tpm tpm0: A TPM error (256) occurred attempting the self test

with the OVMF_CODE_4M.secboot.qcow2 loader, i only got the PageFaultExitBoot Warnings, TPM operates normally.

I believe, they didn’t do something quite right…

6

Thank you for your post! I’ve just seen that issue in a VM with SecureBlue - based off Silverblue. I’m not sure I fully understand your setup, I got my issues with (all defaults apart from choosing UEFI instead of BIOS):

  <os firmware="efi">
    <type arch="x86_64" machine="pc-q35-9.2">hvm</type>
    <firmware>
      <feature enabled="yes" name="enrolled-keys"/>
      <feature enabled="yes" name="secure-boot"/>
    </firmware>
    <loader readonly="yes" secure="yes" type="pflash" format="qcow2">/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
    <nvram template="/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2" templateFormat="qcow2" format="qcow2">/home/user/.config/libvirt/qemu/nvram/secureblue_u_VARS.qcow2</nvram>
    <boot dev="hd"/>
  </os>

And that’s a user session VM. I have not noted any issues on my other VMs as of yet (win11, arch, a “normal” Fedora).