Description of problem: Listing the variables using "efivar -l", on VMWare systems, there seem to be no Mok* variable available or visible: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # efivar -l | egrep "(Mok|Sbat)" # -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- The variables are only present in /sys/firmware/efi/mok-variables directory: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # ls -l /sys/firmware/efi/mok-variables/ total 0 -r--------. 1 root root 0 Mar 10 01:42 MokIgnoreDB -r--------. 1 root root 964 Mar 10 01:42 MokListRT -r--------. 1 root root 76 Mar 10 01:42 MokListXRT -r--------. 1 root root 0 Mar 10 01:42 MokSBStateRT -r--------. 1 root root 18 Mar 10 01:42 SbatLevelRT -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Trying to understand why this happens, while booting in Verbose mode, I can see a difference between my KVM system and VMWare system: - KVM -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- mok.c:936:import_one_mok_state() maybe mirroring "SbatLevel". original data: mok.c:937:import_one_mok_state() 00000000 XX XX XX XX XX XX XX XX 73 62 61 74 2c 31 2c 32 XXXXXXXX|sbat,1,2| mok.c:937:import_one_mok_state() 00000008 30 32 31 30 33 30 32 31 38 0a XX XX XX XX XX XX |021030218.| mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" : mok.c:791:mirror_one_mok_variable() SetVariable("SbatLevelRT", ... varsz=0x12) = Success mok.c:836:mirror_one_mok_variable() returning Success : mok.c:853:maybe_mirror_one_mok_variable() deleting "SbatLevelRT" mok.c:855:maybe_mirror_one_mok_variable() LibDeleteVariable("SbatLevelRT",...) => Invalid Parameter mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- - VMWare (transcript, serial console doesn't work during early boot) -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- mok.c:936:import_one_mok_state() maybe mirroring "SbatLevel". original data: mok.c:937:import_one_mok_state() 00000000 XX XX XX XX XX XX XX XX 73 62 61 74 2c 31 2c 32 XXXXXXXX|sbat,1,2| mok.c:937:import_one_mok_state() 00000008 30 32 31 30 33 30 32 31 38 0a XX XX XX XX XX XX |021030218.| mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" : mok.c:791:mirror_one_mok_variable() SetVariable("SbatLevelRT", ... varsz=0x12) = Success mok.c:836:mirror_one_mok_variable() returning Success : mok.c:853:maybe_mirror_one_mok_variable() deleting "SbatLevelRT" mok.c:855:maybe_mirror_one_mok_variable() LibDeleteVariable("SbatLevelRT",...) => Success mok.c:640:mirror_one_mok_variable() v->name:"SbatLevel" v->rtname:"SbatLevelRT" -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Here above on line "mok.c:855" on VMWare there is a **Success** instead of **Invalid Parameter** on KVM. I don't know if it's relevant or not. Version-Release number of selected component (if applicable): shim-x64-15.4-2.el8_1.x86_64 How reproducible: Always Steps to Reproduce: 1. Boot a VMWare VM in UEFI mode Actual results: No variables Expected results: Variables
Created attachment 1865094 [details] Shim verbose log showing initial SbatLevelRT assignment on VMWare
Created attachment 1865095 [details] Shim verbose log showing second SbatLevelRT assignment on VMWare
Created attachment 1865096 [details] Shim verbose log on KVM
Hi Renaud, could you check if this happens with the 15.5 test builds?
Works fine with shim-unsigned-x64-15.5-1.el9 (on a RHEL8 VMWare): # efivar -l 605dab50-e046-4300-abb6-3dd810dd8b23-SbatLevelRT 605dab50-e046-4300-abb6-3dd810dd8b23-MokListXRT 605dab50-e046-4300-abb6-3dd810dd8b23-MokListRT ...
Hi Renaud, do you also want to check with the signed shim, since we have it now? Otherwise, I can set this to verified: tested, if you are finished testing. :)
I confirm it works fine with shim-x64-15.5-2.el8: Before (had shim-x64-15-16.el8.x86_64): -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [root@vmware-rmetrich-normal-67 ~]# efivar -l | grep Mok --> nothing -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- With shim-x64-15.5-2.el8: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [root@vmware-rmetrich-normal-67 ~]# efivar -l | grep Mok 605dab50-e046-4300-abb6-3dd810dd8b23-MokListXRT 605dab50-e046-4300-abb6-3dd810dd8b23-MokListRT [root@vmware-rmetrich-normal-67 ~]# efivar -l | grep -i sbat 605dab50-e046-4300-abb6-3dd810dd8b23-SbatLevelRT -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Awesome, thank you. Setting Verified: Tested based on comment #7.