search

fwupd / dbx-firmware

DBXUpdate files from Microsoft
Other
18 stars 2 forks source link

dbx x64 version is 267 after failed update 77 -> 217 #2

Closed nre closed 1 year ago

nre commented 1 year ago

Describe the bug Updating dbx x64 77 -> 217 "failed to run update on reboot" but now fwupd says the version is 267.

What dbx version do I actually have now?

Steps to Reproduce I cannot reproduce it because dbx cannot be downgraded. The steps were:

  1. $ fwupdmgr refresh
  2. $ fwupdmgr get-updates
  3. $ fwupdmgr update
  4. Reboot.

Expected behavior dbx to be updated to 217 or remain at 77.

fwupd version information

$ fwupdmgr --version ``` runtime org.freedesktop.fwupd 1.7.5 compile org.freedesktop.gusb 0.3.10 runtime com.dell.libsmbios 2.4 runtime org.kernel 5.15.0-48-generic compile org.freedesktop.fwupd 1.7.5 runtime org.freedesktop.gusb 0.3.10 ```

apt default installation on Ubuntu 22.04.1 (upgraded from 20.04.4).

fwupd device information

$ fwupdmgr get-devices --show-all-devices ``` 20VHCTO1WW │ ├─11th Gen Intel Core™ i5-1135G7 @ 2.40GHz: │ Device ID: 4bde70ba4e39b28f9eab1628f9dd6e6244c03027 │ Current version: 0x000000a4 │ Vendor: Intel │ GUIDs: b9a2dd81-159e-5537-a7db-e7101d164d3f │ 30249f37-d140-5d3e-9319-186b1bd5cac3 │ 2347ad97-b545-5bae-b6b3-b70a9553cbba │ 1df99df5-22f4-5505-98cc-22dcc53b132a │ Device Flags: • Internal device │ ├─Intel Management Engine: │ Device ID: a45df35ac0e948ee180fe216a5f703f32dda163f │ Summary: UEFI ESRT device │ Current version: 0.23.1706 │ Vendor: Lenovo (DMI:LENOVO) │ Update State: Success │ GUIDs: 19aef08f-2701-4db3-b90b-d4bc1412ade7 │ 950e547f-0090-5a43-a74f-497902f980a9 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─System Firmware: │ │ Device ID: 11a7fbdd09ce583e58b899660fe10f147fd155a2 │ │ Summary: UEFI ESRT device │ │ Current version: 0.1.18 │ │ Vendor: Lenovo (DMI:LENOVO) │ │ Update State: Success │ │ GUIDs: 78ad74e1-d048-4abd-b566-9e4e7fbd6e7c │ │ 230c8b18-8d9b-53ec-838b-6cfc0383493a │ │ 3b3d9ded-5562-573a-b076-cd064e6e759c │ │ Device Flags: • Internal device │ │ • Updatable │ │ • System requires external power source │ │ • Needs a reboot after installation │ │ • Cryptographic hash verification is available │ │ • Device is usable for the duration of the update │ │ │ └─UEFI dbx: │ Device ID: 362301da643102b9f38477387e2193e57abaa590 │ Summary: UEFI revocation database │ Current version: 267 │ Minimum Version: 267 │ Vendor: UEFI:Linux Foundation │ Install Duration: 1 second │ GUIDs: 1e9c3d61-4bd9-514e-ad87-0a9b61b9e77d │ 304a9ede-aff2-58f6-b5e5-0e651b065f1a │ c6682ade-b5ec-57c4-b687-676351208742 │ f8ba2887-9411-5c36-9cee-88995bb39731 │ Device Flags: • Internal device │ • Updatable │ • Supported on remote server │ • Needs a reboot after installation │ • Only version upgrades are allowed │ ├─TPM: │ Device ID: c6a80ac3a22083423992a3cb15018989f37834d6 │ Current version: 1.257.0.0 │ Vendor: ST Microelectronics (TPM:STM) │ GUIDs: ff71992e-52f7-5eea-94ef-883e56e034c6 │ 84df3581-f896-54d2-bd1a-372602f04c32 │ bfaed10a-bbc1-525b-a329-35da2f63e918 │ 70b7b833-7e1a-550a-a291-b94a12d0f319 │ 06f005e9-cb62-5d1a-82d9-13c534c53c48 │ Device Flags: • Internal device │ ├─TigerLake-LP GT2 [Iris Xe Graphics]: │ Device ID: 5792b48846ce271fab11c4a545f7a3df0d36e00a │ Current version: 01 │ Vendor: Intel Corporation (PCI:0x8086) │ GUIDs: fc64bab7-3f53-5a1f-8528-9780cfea4a67 │ 8d16bb8f-8c57-5f00-8cbd-f6f14fbe9bcb │ 3c11d563-4f83-5bd1-8369-75359ea6b6f6 │ 54ff3ed7-1ea3-5279-975f-93c13bf2aa53 │ Device Flags: • Internal device │ • Cryptographic hash verification is available │ ├─UEFI Device Firmware: │ Device ID: 349bb341230b1a86e5effe7dfe4337e1590227bd │ Summary: UEFI ESRT device │ Current version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: 76ca0ad8-4a14-4389-b7e5-fd88791762ad │ c2e0f0f3-b5df-5db2-af1c-90610dc32b12 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: 632acf4927c0b5fb53519d6beed3b60adb73f1d5 │ Summary: UEFI ESRT device │ Current version: 1409356129 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: e515c8c5-83b0-43f9-842a-4a0e3c5ad0e6 │ a29d22cd-c3e9-5134-bb74-9a9ba278734f │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: 97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e │ Summary: UEFI ESRT device │ Current version: 1 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: 08f6d13c-ac5d-44be-af3b-9ddd8f442cae │ a5ff04e6-8011-5b32-804a-43e162e27b4e │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: 2292ae5236790b47884e37cf162dcf23bfcd1c60 │ Summary: UEFI ESRT device │ Current version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: 626d93db-2c42-48c3-915a-71f968a81b04 │ e9688c87-579e-59f0-8541-70ac22424169 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: f95c9218acd12697af946874bfe4239587209232 │ Summary: UEFI ESRT device │ Current version: 0 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: 3dd84775-ec79-4ecb-8404-74de030c3f77 │ c646684a-e042-5b7e-b767-ae2d910e4dfd │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: d96de5c124b60ed6241ebcb6bb2c839cb5580786 │ Summary: UEFI ESRT device │ Current version: 1 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: 69585d92-b50a-4ad7-b265-2eb1ae066574 │ b8b66c3c-cf18-5678-8475-88601a3dc2f4 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: f37fb01122dd62c773f4e84ec89737e059712d59 │ Summary: UEFI ESRT device │ Current version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: 9fe02f9c-5bda-4971-a918-b79451b43e43 │ 02649ddf-58d0-5e74-9255-26a64a1abd39 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: 36efb79c255f402f619fa9eb53cd659db51f2a04 │ Summary: UEFI ESRT device │ Current version: 10001 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: de95a75a-fcf9-4d31-9467-0552be90fbe1 │ df6e20a5-68a3-51a5-a3f3-2a8915a08535 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: a083ebc5138e5e071ef7270cc9a8280722cc7adf │ Summary: UEFI ESRT device │ Current version: 4028040874 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: bc7f67ec-c74a-424a-9575-305f278a37bd │ aa3c65b2-df2a-595f-956e-43b4d16b1f3a │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─UEFI Device Firmware: │ Device ID: 5bfc5b91c18ef8b751d3d052af77b69ebf738038 │ Summary: UEFI ESRT device │ Current version: 16777218 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUIDs: c5e36a4d-f132-419f-a8ce-638404c9b87a │ d2628a4e-e651-5e31-b759-eb2591cd9144 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ ├─USB4 host controller: │ Device ID: 2a06e48cf7523e889415969c25c014e51045978a │ Summary: Unmatched performance for high-speed I/O │ Update Error: No vendor ID set │ GUID: e72e778e-94f7-5ed2-b560-1c1262ee217c │ Device Flags: • Internal device │ • System requires external power source │ • Updatable │ ├─Unifying Receiver: │ Device ID: 7e45f403f345e10a77659fbe52f7d5d8f0a1f264 │ Summary: Miniaturised USB wireless receiver │ Current version: RQR12.11_B0032 │ Bootloader Version: BOT01.04_B0016 │ Vendor: HIDRAW:0x046D|USB:0x046D │ Install Duration: 30 seconds │ GUIDs: 9d131a0c-a606-580f-8eda-80587250b8d6 │ fcf55bf5-767b-51ce-9c17-f6f538c4ee9f │ 279ed287-3607-549e-bacc-f873bb9838c4 │ Device Flags: • Updatable │ └─WDC PC SN730 SDBQNTY-512G-1001: Device ID: 04e17fcf7d3de91da49a163ffe4907855c3648be Summary: NVM Express solid state drive Current version: 11170101 Vendor: Sandisk Corp (NVME:0x15B7) GUIDs: 7b974856-317d-5538-a915-de0a6353750f 12c86995-0b90-5ec5-98f3-7a6ed4ca50e0 a39943dd-3afb-54f8-b110-c5a21f071200 fccbb6ea-e20e-58ad-bf8a-7fb7d43ff4c2 06b4e2aa-91af-508b-b06e-65e3b3189e97 Device Flags: • Internal device • Updatable • System requires external power source • Supported on remote server • Needs a reboot after installation • Device is usable for the duration of the update ```

System UEFI configuration

$ efibootmgr -v ``` BootCurrent: 0000 Timeout: 0 seconds BootOrder: 0000,0010,0011,0012,0013,0014,0015,0016,001A,001B,001C,001D,001E,001F,0020,0021 Boot0000* ubuntu HD(1,GPT,277637a0-f5ac-4787-a5d0-6c22ed46d75e,0x800,0x200000)/File(\EFI\ubuntu\shimx64.efi) Boot0010 Setup FvFile(721c8b66-426c-4e86-8e99-3457c46ab0b9) Boot0011 Boot Menu FvFile(126a762d-5758-4fca-8531-201a7f57f850) Boot0012 Diagnostic Splash Screen FvFile(a7d8d9a6-6ab0-4aeb-ad9d-163e59a7a380) Boot0013 Lenovo Diagnostics FvFile(3f7e615b-0d45-4f80-88dc-26b234958560) Boot0014 Asset Information FvFile(da465b87-a26f-4c12-b78a-0361428fa026) Boot0015 Regulatory Information FvFile(478c92a0-2622-42b7-a65d-5894169e4d24) Boot0016 ThinkShield secure wipe FvFile(3593a0d5-bd52-43a0-808e-cbff5ece2477) Boot0017 Startup Interrupt Menu FvFile(f46ee6f4-4785-43a3-923d-7f786c3c8479) Boot0018 Rescue and Recovery FvFile(665d3f60-ad3e-4cad-8e26-db46eee9f1b5) Boot0019 MEBx Hot Key FvFile(ac6fd56a-3d41-4efd-a1b9-870293811a28) Boot001A USB CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,86701296aa5a7848b66cd49dd3ba6a55) Boot001B USB FDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,6ff015a28830b543a8b8641009461e49) Boot001C NVMe0 VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,001c199932d94c4eae9aa0b6e98eb8a400) Boot001D USB HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,33e821aaaf33bc4789bd419f88c50803) Boot001E PXE BOOT VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,78a84aaf2b2afc4ea79cf5cc8f3d3803) Boot001F LENOVO CLOUD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,ad38ccbbf7edf04d959cf42aa74d3650)/Uri(https://download.lenovo.com/pccbbs/cdeploy/efi/boot.efi) Boot0020 Other CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,aea2090adfde214e8b3a5e471856a35400) Boot0021 Other HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,91af625956449f41a7b91f4f892ab0f600) Boot0022* IDER BOOT CDROM PciRoot(0x0)/Pci(0x16,0x2)/Ata(0,1,0) Boot0023* IDER BOOT Floppy PciRoot(0x0)/Pci(0x16,0x2)/Ata(0,0,0) Boot0024* ATA HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,91af625956449f41a7b91f4f892ab0f6) Boot0025* ATAPI CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,aea2090adfde214e8b3a5e471856a354) Boot0026* IDER BOOT CDROM PciRoot(0x0)/Pci(0x14,0x0)/USB(11,1) Boot0027* IDER BOOT Floppy PciRoot(0x0)/Pci(0x14,0x0)/USB(11,0) ```

$ efivar -l | grep fw finds nothing.

$ sudo tree /boot ``` /boot ├── config-5.15.0-47-generic ├── config-5.15.0-48-generic ├── efi │   └── EFI │   ├── BOOT │   │   ├── BOOTX64.EFI │   │   ├── fbx64.efi │   │   └── mmx64.efi │   └── ubuntu │   ├── BOOTX64.CSV │   ├── grub │   │   ├── fonts │   │   │   └── unicode.pf2 │   │   ├── grub.cfg │   │   ├── grubenv │   │   └── x86_64-efi │   │   ├── acpi.mod │   │   ├── adler32.mod │   │   ├── affs.mod │   │   ├── afs.mod │   │   ├── ahci.mod │   │   ├── all_video.mod │   │   ├── aout.mod │   │   ├── appleldr.mod │   │   ├── archelp.mod │   │   ├── ata.mod │   │   ├── at_keyboard.mod │   │   ├── backtrace.mod │   │   ├── bfs.mod │   │   ├── bitmap.mod │   │   ├── bitmap_scale.mod │   │   ├── blocklist.mod │   │   ├── boot.mod │   │   ├── bsd.mod │   │   ├── bswap_test.mod │   │   ├── btrfs.mod │   │   ├── bufio.mod │   │   ├── cat.mod │   │   ├── cbfs.mod │   │   ├── cbls.mod │   │   ├── cbmemc.mod │   │   ├── cbtable.mod │   │   ├── cbtime.mod │   │   ├── chain.mod │   │   ├── cmdline_cat_test.mod │   │   ├── cmp.mod │   │   ├── cmp_test.mod │   │   ├── command.lst │   │   ├── configfile.mod │   │   ├── core.efi │   │   ├── cpio_be.mod │   │   ├── cpio.mod │   │   ├── cpuid.mod │   │   ├── crc64.mod │   │   ├── cryptodisk.mod │   │   ├── crypto.lst │   │   ├── crypto.mod │   │   ├── cs5536.mod │   │   ├── ctz_test.mod │   │   ├── datehook.mod │   │   ├── date.mod │   │   ├── datetime.mod │   │   ├── diskfilter.mod │   │   ├── disk.mod │   │   ├── div.mod │   │   ├── div_test.mod │   │   ├── dm_nv.mod │   │   ├── echo.mod │   │   ├── efifwsetup.mod │   │   ├── efi_gop.mod │   │   ├── efinet.mod │   │   ├── efi_uga.mod │   │   ├── ehci.mod │   │   ├── elf.mod │   │   ├── eval.mod │   │   ├── exfat.mod │   │   ├── exfctest.mod │   │   ├── ext2.mod │   │   ├── extcmd.mod │   │   ├── f2fs.mod │   │   ├── fat.mod │   │   ├── file.mod │   │   ├── fixvideo.mod │   │   ├── font.mod │   │   ├── fshelp.mod │   │   ├── fs.lst │   │   ├── functional_test.mod │   │   ├── gcry_arcfour.mod │   │   ├── gcry_blowfish.mod │   │   ├── gcry_camellia.mod │   │   ├── gcry_cast5.mod │   │   ├── gcry_crc.mod │   │   ├── gcry_des.mod │   │   ├── gcry_dsa.mod │   │   ├── gcry_idea.mod │   │   ├── gcry_md4.mod │   │   ├── gcry_md5.mod │   │   ├── gcry_rfc2268.mod │   │   ├── gcry_rijndael.mod │   │   ├── gcry_rmd160.mod │   │   ├── gcry_rsa.mod │   │   ├── gcry_seed.mod │   │   ├── gcry_serpent.mod │   │   ├── gcry_sha1.mod │   │   ├── gcry_sha256.mod │   │   ├── gcry_sha512.mod │   │   ├── gcry_tiger.mod │   │   ├── gcry_twofish.mod │   │   ├── gcry_whirlpool.mod │   │   ├── geli.mod │   │   ├── gettext.mod │   │   ├── gfxmenu.mod │   │   ├── gfxterm_background.mod │   │   ├── gfxterm_menu.mod │   │   ├── gfxterm.mod │   │   ├── gptsync.mod │   │   ├── grub.efi │   │   ├── gzio.mod │   │   ├── halt.mod │   │   ├── hashsum.mod │   │   ├── hdparm.mod │   │   ├── hello.mod │   │   ├── help.mod │   │   ├── hexdump.mod │   │   ├── hfs.mod │   │   ├── hfspluscomp.mod │   │   ├── hfsplus.mod │   │   ├── http.mod │   │   ├── iorw.mod │   │   ├── iso9660.mod │   │   ├── jfs.mod │   │   ├── jpeg.mod │   │   ├── keylayouts.mod │   │   ├── keystatus.mod │   │   ├── ldm.mod │   │   ├── legacycfg.mod │   │   ├── legacy_password_test.mod │   │   ├── linux16.mod │   │   ├── linuxefi.mod │   │   ├── linux.mod │   │   ├── loadbios.mod │   │   ├── load.cfg │   │   ├── loadenv.mod │   │   ├── loopback.mod │   │   ├── lsacpi.mod │   │   ├── lsefimmap.mod │   │   ├── lsefi.mod │   │   ├── lsefisystab.mod │   │   ├── lsmmap.mod │   │   ├── ls.mod │   │   ├── lspci.mod │   │   ├── lssal.mod │   │   ├── luks.mod │   │   ├── lvm.mod │   │   ├── lzopio.mod │   │   ├── macbless.mod │   │   ├── macho.mod │   │   ├── mdraid09_be.mod │   │   ├── mdraid09.mod │   │   ├── mdraid1x.mod │   │   ├── memdisk.mod │   │   ├── memrw.mod │   │   ├── minicmd.mod │   │   ├── minix2_be.mod │   │   ├── minix2.mod │   │   ├── minix3_be.mod │   │   ├── minix3.mod │   │   ├── minix_be.mod │   │   ├── minix.mod │   │   ├── mmap.mod │   │   ├── moddep.lst │   │   ├── modinfo.sh │   │   ├── morse.mod │   │   ├── mpi.mod │   │   ├── msdospart.mod │   │   ├── mul_test.mod │   │   ├── multiboot2.mod │   │   ├── multiboot.mod │   │   ├── nativedisk.mod │   │   ├── net.mod │   │   ├── newc.mod │   │   ├── nilfs2.mod │   │   ├── normal.mod │   │   ├── ntfscomp.mod │   │   ├── ntfs.mod │   │   ├── odc.mod │   │   ├── offsetio.mod │   │   ├── ohci.mod │   │   ├── part_acorn.mod │   │   ├── part_amiga.mod │   │   ├── part_apple.mod │   │   ├── part_bsd.mod │   │   ├── part_dfly.mod │   │   ├── part_dvh.mod │   │   ├── part_gpt.mod │   │   ├── partmap.lst │   │   ├── part_msdos.mod │   │   ├── part_plan.mod │   │   ├── part_sun.mod │   │   ├── part_sunpc.mod │   │   ├── parttool.lst │   │   ├── parttool.mod │   │   ├── password.mod │   │   ├── password_pbkdf2.mod │   │   ├── pata.mod │   │   ├── pbkdf2.mod │   │   ├── pbkdf2_test.mod │   │   ├── pcidump.mod │   │   ├── pgp.mod │   │   ├── play.mod │   │   ├── png.mod │   │   ├── priority_queue.mod │   │   ├── probe.mod │   │   ├── procfs.mod │   │   ├── progress.mod │   │   ├── raid5rec.mod │   │   ├── raid6rec.mod │   │   ├── random.mod │   │   ├── rdmsr.mod │   │   ├── read.mod │   │   ├── reboot.mod │   │   ├── regexp.mod │   │   ├── reiserfs.mod │   │   ├── relocator.mod │   │   ├── romfs.mod │   │   ├── scsi.mod │   │   ├── search_fs_file.mod │   │   ├── search_fs_uuid.mod │   │   ├── search_label.mod │   │   ├── search.mod │   │   ├── serial.mod │   │   ├── setjmp.mod │   │   ├── setjmp_test.mod │   │   ├── setpci.mod │   │   ├── sfs.mod │   │   ├── shift_test.mod │   │   ├── shim_lock.mod │   │   ├── signature_test.mod │   │   ├── sleep.mod │   │   ├── sleep_test.mod │   │   ├── smbios.mod │   │   ├── spkmodem.mod │   │   ├── squash4.mod │   │   ├── strtoull_test.mod │   │   ├── syslinuxcfg.mod │   │   ├── tar.mod │   │   ├── terminal.lst │   │   ├── terminal.mod │   │   ├── terminfo.mod │   │   ├── test_blockarg.mod │   │   ├── testload.mod │   │   ├── test.mod │   │   ├── testspeed.mod │   │   ├── tftp.mod │   │   ├── tga.mod │   │   ├── time.mod │   │   ├── tpm.mod │   │   ├── trig.mod │   │   ├── tr.mod │   │   ├── true.mod │   │   ├── udf.mod │   │   ├── ufs1_be.mod │   │   ├── ufs1.mod │   │   ├── ufs2.mod │   │   ├── uhci.mod │   │   ├── usb_keyboard.mod │   │   ├── usb.mod │   │   ├── usbms.mod │   │   ├── usbserial_common.mod │   │   ├── usbserial_ftdi.mod │   │   ├── usbserial_pl2303.mod │   │   ├── usbserial_usbdebug.mod │   │   ├── usbtest.mod │   │   ├── verifiers.mod │   │   ├── video_bochs.mod │   │   ├── video_cirrus.mod │   │   ├── video_colors.mod │   │   ├── video_fb.mod │   │   ├── videoinfo.mod │   │   ├── video.lst │   │   ├── video.mod │   │   ├── videotest_checksum.mod │   │   ├── videotest.mod │   │   ├── wrmsr.mod │   │   ├── xfs.mod │   │   ├── xnu.mod │   │   ├── xnu_uuid.mod │   │   ├── xnu_uuid_test.mod │   │   ├── xzio.mod │   │   ├── zfscrypt.mod │   │   ├── zfsinfo.mod │   │   ├── zfs.mod │   │   └── zstd.mod │   ├── grub.cfg │   ├── grubx64.efi │   ├── mmx64.efi │   └── shimx64.efi ├── grub │   ├── fonts │   │   └── unicode.pf2 │   ├── gfxblacklist.txt │   ├── grub.cfg │   ├── grubenv │   ├── locale │   │   ├── en_AU.mo │   │   ├── en_CA.mo │   │   ├── en_GB.mo │   │   └── en@quot.mo │   ├── unicode.pf2 │   └── x86_64-efi │   ├── acpi.mod │   ├── adler32.mod │   ├── affs.mod │   ├── afs.mod │   ├── afsplitter.mod │   ├── ahci.mod │   ├── all_video.mod │   ├── aout.mod │   ├── appleldr.mod │   ├── archelp.mod │   ├── ata.mod │   ├── at_keyboard.mod │   ├── backtrace.mod │   ├── bfs.mod │   ├── bitmap.mod │   ├── bitmap_scale.mod │   ├── blocklist.mod │   ├── boot.mod │   ├── bsd.mod │   ├── bswap_test.mod │   ├── btrfs.mod │   ├── bufio.mod │   ├── cat.mod │   ├── cbfs.mod │   ├── cbls.mod │   ├── cbmemc.mod │   ├── cbtable.mod │   ├── cbtime.mod │   ├── chain.mod │   ├── cmdline_cat_test.mod │   ├── cmp.mod │   ├── cmp_test.mod │   ├── command.lst │   ├── configfile.mod │   ├── core.efi │   ├── cpio_be.mod │   ├── cpio.mod │   ├── cpuid.mod │   ├── crc64.mod │   ├── cryptodisk.mod │   ├── crypto.lst │   ├── crypto.mod │   ├── cs5536.mod │   ├── ctz_test.mod │   ├── datehook.mod │   ├── date.mod │   ├── datetime.mod │   ├── diskfilter.mod │   ├── disk.mod │   ├── div.mod │   ├── div_test.mod │   ├── dm_nv.mod │   ├── echo.mod │   ├── efifwsetup.mod │   ├── efi_gop.mod │   ├── efinet.mod │   ├── efi_uga.mod │   ├── ehci.mod │   ├── elf.mod │   ├── eval.mod │   ├── exfat.mod │   ├── exfctest.mod │   ├── ext2.mod │   ├── extcmd.mod │   ├── f2fs.mod │   ├── fat.mod │   ├── file.mod │   ├── fixvideo.mod │   ├── font.mod │   ├── fshelp.mod │   ├── fs.lst │   ├── functional_test.mod │   ├── gcry_arcfour.mod │   ├── gcry_blowfish.mod │   ├── gcry_camellia.mod │   ├── gcry_cast5.mod │   ├── gcry_crc.mod │   ├── gcry_des.mod │   ├── gcry_dsa.mod │   ├── gcry_idea.mod │   ├── gcry_md4.mod │   ├── gcry_md5.mod │   ├── gcry_rfc2268.mod │   ├── gcry_rijndael.mod │   ├── gcry_rmd160.mod │   ├── gcry_rsa.mod │   ├── gcry_seed.mod │   ├── gcry_serpent.mod │   ├── gcry_sha1.mod │   ├── gcry_sha256.mod │   ├── gcry_sha512.mod │   ├── gcry_tiger.mod │   ├── gcry_twofish.mod │   ├── gcry_whirlpool.mod │   ├── geli.mod │   ├── gettext.mod │   ├── gfxmenu.mod │   ├── gfxterm_background.mod │   ├── gfxterm_menu.mod │   ├── gfxterm.mod │   ├── gptsync.mod │   ├── grub.efi │   ├── gzio.mod │   ├── halt.mod │   ├── hashsum.mod │   ├── hdparm.mod │   ├── hello.mod │   ├── help.mod │   ├── hexdump.mod │   ├── hfs.mod │   ├── hfspluscomp.mod │   ├── hfsplus.mod │   ├── http.mod │   ├── iorw.mod │   ├── iso9660.mod │   ├── jfs.mod │   ├── jpeg.mod │   ├── json.mod │   ├── keylayouts.mod │   ├── keystatus.mod │   ├── ldm.mod │   ├── legacycfg.mod │   ├── legacy_password_test.mod │   ├── linux16.mod │   ├── linuxefi.mod │   ├── linux.mod │   ├── loadbios.mod │   ├── load.cfg │   ├── loadenv.mod │   ├── loopback.mod │   ├── lsacpi.mod │   ├── lsefimmap.mod │   ├── lsefi.mod │   ├── lsefisystab.mod │   ├── lsmmap.mod │   ├── ls.mod │   ├── lspci.mod │   ├── lssal.mod │   ├── luks2.mod │   ├── luks.mod │   ├── lvm.mod │   ├── lzopio.mod │   ├── macbless.mod │   ├── macho.mod │   ├── mdraid09_be.mod │   ├── mdraid09.mod │   ├── mdraid1x.mod │   ├── memdisk.mod │   ├── memrw.mod │   ├── minicmd.mod │   ├── minix2_be.mod │   ├── minix2.mod │   ├── minix3_be.mod │   ├── minix3.mod │   ├── minix_be.mod │   ├── minix.mod │   ├── mmap.mod │   ├── moddep.lst │   ├── modinfo.sh │   ├── morse.mod │   ├── mpi.mod │   ├── msdospart.mod │   ├── mul_test.mod │   ├── multiboot2.mod │   ├── multiboot.mod │   ├── nativedisk.mod │   ├── net.mod │   ├── newc.mod │   ├── nilfs2.mod │   ├── normal.mod │   ├── ntfscomp.mod │   ├── ntfs.mod │   ├── odc.mod │   ├── offsetio.mod │   ├── ohci.mod │   ├── part_acorn.mod │   ├── part_amiga.mod │   ├── part_apple.mod │   ├── part_bsd.mod │   ├── part_dfly.mod │   ├── part_dvh.mod │   ├── part_gpt.mod │   ├── partmap.lst │   ├── part_msdos.mod │   ├── part_plan.mod │   ├── part_sun.mod │   ├── part_sunpc.mod │   ├── parttool.lst │   ├── parttool.mod │   ├── password.mod │   ├── password_pbkdf2.mod │   ├── pata.mod │   ├── pbkdf2.mod │   ├── pbkdf2_test.mod │   ├── pcidump.mod │   ├── pgp.mod │   ├── play.mod │   ├── png.mod │   ├── priority_queue.mod │   ├── probe.mod │   ├── procfs.mod │   ├── progress.mod │   ├── raid5rec.mod │   ├── raid6rec.mod │   ├── random.mod │   ├── rdmsr.mod │   ├── read.mod │   ├── reboot.mod │   ├── regexp.mod │   ├── reiserfs.mod │   ├── relocator.mod │   ├── romfs.mod │   ├── scsi.mod │   ├── search_fs_file.mod │   ├── search_fs_uuid.mod │   ├── search_label.mod │   ├── search.mod │   ├── serial.mod │   ├── setjmp.mod │   ├── setjmp_test.mod │   ├── setpci.mod │   ├── sfs.mod │   ├── shift_test.mod │   ├── signature_test.mod │   ├── sleep.mod │   ├── sleep_test.mod │   ├── smbios.mod │   ├── spkmodem.mod │   ├── squash4.mod │   ├── strtoull_test.mod │   ├── syslinuxcfg.mod │   ├── tar.mod │   ├── terminal.lst │   ├── terminal.mod │   ├── terminfo.mod │   ├── test_blockarg.mod │   ├── testload.mod │   ├── test.mod │   ├── testspeed.mod │   ├── tftp.mod │   ├── tga.mod │   ├── time.mod │   ├── tpm.mod │   ├── trig.mod │   ├── tr.mod │   ├── true.mod │   ├── udf.mod │   ├── ufs1_be.mod │   ├── ufs1.mod │   ├── ufs2.mod │   ├── uhci.mod │   ├── usb_keyboard.mod │   ├── usb.mod │   ├── usbms.mod │   ├── usbserial_common.mod │   ├── usbserial_ftdi.mod │   ├── usbserial_pl2303.mod │   ├── usbserial_usbdebug.mod │   ├── usbtest.mod │   ├── video_bochs.mod │   ├── video_cirrus.mod │   ├── video_colors.mod │   ├── video_fb.mod │   ├── videoinfo.mod │   ├── video.lst │   ├── video.mod │   ├── videotest_checksum.mod │   ├── videotest.mod │   ├── wrmsr.mod │   ├── xfs.mod │   ├── xnu.mod │   ├── xnu_uuid.mod │   ├── xnu_uuid_test.mod │   ├── xzio.mod │   ├── zfscrypt.mod │   ├── zfsinfo.mod │   ├── zfs.mod │   └── zstd.mod ├── initrd.img -> initrd.img-5.15.0-48-generic ├── initrd.img-5.15.0-47-generic ├── initrd.img-5.15.0-48-generic ├── initrd.img.old -> initrd.img-5.15.0-47-generic ├── lost+found ├── memtest86+.bin ├── memtest86+.elf ├── memtest86+_multiboot.bin ├── System.map-5.15.0-47-generic ├── System.map-5.15.0-48-generic ├── vmlinuz -> vmlinuz-5.15.0-48-generic ├── vmlinuz-5.15.0-47-generic ├── vmlinuz-5.15.0-48-generic └── vmlinuz.old -> vmlinuz-5.15.0-47-generic ```

Additional questions

hughsie commented 1 year ago

What dbx version do I actually have now?

If you update fwupd to 1.8.5 or 1.7.10 the versions will be a bit less random: https://github.com/fwupd/fwupd/commit/eec6de6985f6d4a8d1d758fb7c8863c1f92b02df

nre commented 1 year ago

Snap 1.8.5-10-g34dfa8689 says the dbx version is 217, which seems like good news. Was fwupd mistaken about the update failing? Was the incorrect version number the cause of that confusion?

│ └─UEFI dbx:
│       Device ID:        362301da643102b9f38477387e2193e57abaa590
│       Summary:          UEFI revocation database
│       Current version:  217
│       Minimum Version:  217
│       Vendor:           UEFI:Linux Foundation
│       Install Duration: 1 second
│       GUIDs:            1e9c3d61-4bd9-514e-ad87-0a9b61b9e77d ← UEFI\CRT_156645FC005F8617669DF76E1DE6FAE02B3856D24B624E47D97BD2B8ADFFB6E0
│                         304a9ede-aff2-58f6-b5e5-0e651b065f1a ← UEFI\CRT_156645FC005F8617669DF76E1DE6FAE02B3856D24B624E47D97BD2B8ADFFB6E0&ARCH_X64
│                         c6682ade-b5ec-57c4-b687-676351208742 ← UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503
│                         f8ba2887-9411-5c36-9cee-88995bb39731 ← UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_X64
│       Device Flags:     • Internal device
│                         • Updatable
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
│                         • Only version upgrades are allowed
│                         • Signed Payload

The old fwupd history:

$ fwupdmgr get-history
20VHCTO1WW
│
└─UEFI dbx:
  │   Device ID:          362301da643102b9f38477387e2193e57abaa590
  │   Previous version:   77
  │   Update State:       Failed
  │   Update Error:       failed to run update on reboot
  │   Last modified:      2022-09-24 11:53
  │   GUID:               1e9c3d61-4bd9-514e-ad87-0a9b61b9e77d
  │   Device Flags:       • Internal device
  │                       • Updatable
  │                       • Supported on remote server
  │                       • Needs a reboot after installation
  │
  └─  New version:      217
        Remote ID:        lvfs
        License:          Unknown
        Description:
        The vendor did not supply any release notes.
hughsie commented 1 year ago

It's all explained in the comment:

/*
 * Microsoft seems to actually remove checksums in UEFI dbx updates, which I'm guessing is
 * a result from OEM pressure about SPI usage -- but local dbx updates are append-only.
 *
 * That means that if you remove hashes then you can have a different set of dbx checksums
 * on your machine depending on whether you went A->B->C->D or A->D...
 *
 * If we use the metric of "count the number of SHA256 checksums from MS" then we might
 * overcount (due to the now-removed entries) -- in some cases enough to not actually apply
 * the new update at all.
 *
 * In these cases look at the *last* dbx checksum and compare to the set we know to see if
 * we need to artificially lower the reported version. This isn't helped by having *zero*
 * visibility in the reason that entries were removed or added.
 *
 * This also fixes the DBX update 20200729 which added 4 duplicate entries, which should be
 * rectified during the SetVariable(), so they're only really a problem for transactional
 * size limits. But we all noticed that load-bearing *should* word there, didn't we.
 */
nre commented 1 year ago

My point was that fwupd was wrong about "failed to run update on reboot".

fu_engine_update_history_device checks whether the device version is the update version. But if it isn't, instead of checking whether the device version is something unexpected, it falls back to "failed to run update on reboot". I think this is a problematic default because the wiki entry sounds like it can be ignored as a known issue.

dbx isn't alone in having unexpected versions. Lenovo is having a problem with Intel ME versions too.