Bug 2062569
| Summary: | Mok* and SbatLevelRT variables is not available/visible on VMWare systems | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Renaud Métrich <rmetrich> | ||||||||
| Component: | shim-unsigned-x64 | Assignee: | Bootloader engineering team <bootloader-eng-team> | ||||||||
| Status: | MODIFIED --- | QA Contact: | Release Test Team <release-test-team> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 8.5 | CC: | fmartine, mlewando | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | shim-15.5-2.el8 | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | Type: | Bug | |||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
Created attachment 1865094 [details]
Shim verbose log showing initial SbatLevelRT assignment on VMWare
Created attachment 1865095 [details]
Shim verbose log showing second SbatLevelRT assignment on VMWare
Created attachment 1865096 [details]
Shim verbose log on KVM
Hi Renaud, could you check if this happens with the 15.5 test builds? Works fine with shim-unsigned-x64-15.5-1.el9 (on a RHEL8 VMWare): # efivar -l 605dab50-e046-4300-abb6-3dd810dd8b23-SbatLevelRT 605dab50-e046-4300-abb6-3dd810dd8b23-MokListXRT 605dab50-e046-4300-abb6-3dd810dd8b23-MokListRT ... Hi Renaud, do you also want to check with the signed shim, since we have it now? Otherwise, I can set this to verified: tested, if you are finished testing. :) I confirm it works fine with shim-x64-15.5-2.el8: Before (had shim-x64-15-16.el8.x86_64): -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [root@vmware-rmetrich-normal-67 ~]# efivar -l | grep Mok --> nothing -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- With shim-x64-15.5-2.el8: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [root@vmware-rmetrich-normal-67 ~]# efivar -l | grep Mok 605dab50-e046-4300-abb6-3dd810dd8b23-MokListXRT 605dab50-e046-4300-abb6-3dd810dd8b23-MokListRT [root@vmware-rmetrich-normal-67 ~]# efivar -l | grep -i sbat 605dab50-e046-4300-abb6-3dd810dd8b23-SbatLevelRT -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Awesome, thank you. Setting Verified: Tested based on comment #7. |
Description of problem: Listing the variables using "efivar -l", on VMWare systems, there seem to be no Mok* variable available or visible: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # efivar -l | egrep "(Mok|Sbat)" # -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- The variables are only present in /sys/firmware/efi/mok-variables directory: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # ls -l /sys/firmware/efi/mok-variables/ total 0 -r--------. 1 root root 0 Mar 10 01:42 MokIgnoreDB -r--------. 1 root root 964 Mar 10 01:42 MokListRT -r--------. 1 root root 76 Mar 10 01:42 MokListXRT -r--------. 1 root root 0 Mar 10 01:42 MokSBStateRT -r--------. 1 root root 18 Mar 10 01:42 SbatLevelRT -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Trying to understand why this happens, while booting in Verbose mode, I can see a difference between my KVM system and VMWare system: - KVM -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- mok.c:936:import_one_mok_state() maybe mirroring "SbatLevel". original data: mok.c:937:import_one_mok_state() 00000000 XX XX XX XX XX XX XX XX 73 62 61 74 2c 31 2c 32 XXXXXXXX|sbat,1,2| mok.c:937:import_one_mok_state() 00000008 30 32 31 30 33 30 32 31 38 0a XX XX XX XX XX XX |021030218.| mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" : mok.c:791:mirror_one_mok_variable() SetVariable("SbatLevelRT", ... varsz=0x12) = Success mok.c:836:mirror_one_mok_variable() returning Success : mok.c:853:maybe_mirror_one_mok_variable() deleting "SbatLevelRT" mok.c:855:maybe_mirror_one_mok_variable() LibDeleteVariable("SbatLevelRT",...) => Invalid Parameter mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- - VMWare (transcript, serial console doesn't work during early boot) -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- mok.c:936:import_one_mok_state() maybe mirroring "SbatLevel". original data: mok.c:937:import_one_mok_state() 00000000 XX XX XX XX XX XX XX XX 73 62 61 74 2c 31 2c 32 XXXXXXXX|sbat,1,2| mok.c:937:import_one_mok_state() 00000008 30 32 31 30 33 30 32 31 38 0a XX XX XX XX XX XX |021030218.| mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" : mok.c:791:mirror_one_mok_variable() SetVariable("SbatLevelRT", ... varsz=0x12) = Success mok.c:836:mirror_one_mok_variable() returning Success : mok.c:853:maybe_mirror_one_mok_variable() deleting "SbatLevelRT" mok.c:855:maybe_mirror_one_mok_variable() LibDeleteVariable("SbatLevelRT",...) => Success mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Here above on line "mok.c:855" on VMWare there is a **Success** instead of **Invalid Parameter** on KVM. I don't know if it's relevant or not. Version-Release number of selected component (if applicable): shim-x64-15.4-2.el8_1.x86_64 How reproducible: Always Steps to Reproduce: 1. Boot a VMWare VM in UEFI mode Actual results: No variables Expected results: Variables