search

openSUSE / sdbootutil

MIT License
25 stars 13 forks source link

fwupd firmware update error #121

Closed ThePhatLe closed 4 weeks ago

ThePhatLe commented 3 months ago

today i saw i have updates from Gnome Software to update system firmwae and Gnome software wont install or restart & install it. Tryied from terminal and getting error

Devices with no available firmware updates: 
 • DLL0945:00 04F3:311C
 • Fingerprint Sensor
 • Internal SPI Controller
 • SSD 990 PRO 2TB
 • TPM
 • UEFI Device Firmware
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade System Firmware from 1.29.0 to 1.31.0?                               ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This stable release fixes the following issues:                              ║
║                                                                              ║
║ • This release contains security updates as disclosed in the Dell            ║
║ Security Advisories.                                                         ║
║ • Fixed the issue where the system does not boot to the Windows operating    ║
║ system. This issue occurs when the Dell Keyboard KB555T is connected to the  ║
║ system.                                                                      ║
║                                                                              ║
║ XPS 15 9510 must remain plugged into a power source for the duration of the  ║
║ update to avoid damage.                                                      ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: y
Downloading…             [*                                      ] Less than oneDownloading…             [*                                      ] Less than oneDownloading…             [**                                     ] Less than oneDownloading…             [**                                     ] Less than oneDownloading…             [***                                    ] Less than oneDownloading…             [***                                    ] Less than oneDownloading…             [***                                    ] Less than oneDownloading…             [****                                   ] Less than oneDownloading…             [*****                                  ] Less than oneDownloading…             [*****                                  ] Less than oneDownloading…             [*****                                  ] Less than oneDownloading…             [******                                 ] Less than oneDownloading…             [******                                 ] Less than oneDownloading…             [*******                                ] Less than oneDownloading…             [*******                                ] Less than oneDownloading…             [*******                                ] Less than oneDownloading…             [********                               ] Less than oneDownloading…             [*********                              ] Less than oneDownloading…             [*********                              ] Less than oneDownloading…             [**********                             ] Less than oneDownloading…             [**********                             ] Less than oneDownloading…             [**********                             ] Less than oneDownloading…             [***********                            ] Less than oneDownloading…             [***********                            ] Less than oneDownloading…             [************                           ] Less than oneDecompressing…           [                                       ]
Secure boot is enabled, but shim isn't installed to EFI/aeon/shim.efi
phatle@aeon:~> LC_MESSAGES=C ls -lR /boot/efi/
/boot/efi/:
total 96
drwxr-xr-x. 3 root root 32768 Aug 12 15:49 aeon
drwxr-xr-x. 6 root root 32768 Aug 14 11:56 EFI
drwxr-xr-x. 4 root root 32768 Aug 14 12:06 loader

/boot/efi/aeon:
total 32
drwxr-xr-x. 2 root root 32768 Aug 14 13:16 6.10.3-1-default

/boot/efi/aeon/6.10.3-1-default:
total 193664
-rwxr-xr-x. 1 root root 99596412 Aug 12 22:49 initrd-4343bce92b1aecac063692eefe306295ad44149c
-rwxr-xr-x. 1 root root 83904086 Aug 14 11:01 initrd-ec873e03bb84b898585e86c043e2d6fb2a400de9
-rwxr-xr-x. 1 root root 14768496 Aug  4 13:37 linux-f431a68473f70f7db938d56c1a4f039aa439998e

/boot/efi/EFI:
total 128
drwxr-xr-x. 3 root root 32768 Aug 14 11:56 aeon
drwxr-xr-x. 2 root root 32768 Aug 12 17:56 BOOT
drwxr-xr-x. 2 root root 32768 Aug 12 17:46 Linux
drwxr-xr-x. 2 root root 32768 Aug 12 17:56 systemd

/boot/efi/EFI/aeon:
total 32
drwxr-xr-x. 2 root root 32768 Aug 14 12:36 fw

/boot/efi/EFI/aeon/fw:
total 22880
-rwxr-xr-x. 1 root root 23409375 Aug 14 12:36 fwupd-6e106831-11dd-4c1b-b22b-526d6f78683c.cap

/boot/efi/EFI/BOOT:
total 1088
-rwxr-xr-x. 1 root root 100720 Aug  2 17:29 BOOTX64.EFI
-rwxr-xr-x. 1 root root  90496 Jul 23 10:27 fallback.efi
-rwxr-xr-x. 1 root root 852312 Jul 23 10:27 MokManager.efi

/boot/efi/EFI/Linux:
total 0

/boot/efi/EFI/systemd:
total 2176
-rwxr-xr-x. 1 root root     64 Aug 12 15:49 boot.csv
-rwxr-xr-x. 1 root root 100720 Aug  2 17:29 grub.efi
-rwxr-xr-x. 1 root root      5 Aug 12 15:49 installed_by_sdbootutil
-rwxr-xr-x. 1 root root 852312 Jul 23 10:27 MokManager.efi
-rwxr-xr-x. 1 root root   1645 Aug 14 12:16 pcrlock.json
-rwxr-xr-x. 1 root root 965528 Jul 23 10:27 shim.efi
-rwxr-xr-x. 1 root root 100720 Aug  2 17:29 systemd-bootx64.efi

/boot/efi/loader:
total 160
drwxr-xr-x. 2 root root 32768 Aug 14 12:16 credentials
drwxr-xr-x. 2 root root 32768 Aug 14 13:16 entries
-rwxr-xr-x. 1 root root     6 Aug 12 15:49 entries.srel
-rwxr-xr-x. 1 root root    31 Aug 12 22:49 loader.conf
-rwxr-xr-x. 1 root root    32 Aug 14 12:06 random-seed

/boot/efi/loader/credentials:
total 32
-rwxr-xr-x. 1 root root 2362 Aug 14 12:16 pcrlock.aeon.cred

/boot/efi/loader/entries:
total 384
-rwxr-xr-x. 1 root root 583 Aug 12 18:51 aeon-6.10.3-1-default-10.conf
-rwxr-xr-x. 1 root root 583 Aug 13 09:51 aeon-6.10.3-1-default-11.conf
-rwxr-xr-x. 1 root root 583 Aug 14 11:01 aeon-6.10.3-1-default-12.conf
-rwxr-xr-x. 1 root root 583 Aug 14 11:00 aeon-6.10.3-1-default-13.conf
-rwxr-xr-x. 1 root root 583 Aug 14 12:16 aeon-6.10.3-1-default-15.conf
-rwxr-xr-x. 1 root root 581 Aug 12 17:40 aeon-6.10.3-1-default-3.conf
-rwxr-xr-x. 1 root root 602 Aug 12 17:46 aeon-6.10.3-1-default-4.conf
-rwxr-xr-x. 1 root root 602 Aug 12 17:53 aeon-6.10.3-1-default-5.conf
-rwxr-xr-x. 1 root root 581 Aug 12 17:55 aeon-6.10.3-1-default-6.conf
-rwxr-xr-x. 1 root root 581 Aug 12 17:56 aeon-6.10.3-1-default-7.conf
-rwxr-xr-x. 1 root root 581 Aug 12 18:09 aeon-6.10.3-1-default-8.conf
-rwxr-xr-x. 1 root root 581 Aug 12 18:47 aeon-6.10.3-1-default-9.conf
aplanas commented 3 months ago

you mean that the firmware is not updated?

ThePhatLe commented 3 months ago

yes it ant update due the Secure boot is enabled, but shim isn't installed to EFI/aeon/shim.efi it fails and wont update or start update process even on both cases Gnome Software or Terminal

arvidjaar commented 3 months ago

fwupd expects path \EFI\${ID-from-os_release}:

https://github.com/fwupd/fwupd/blob/72b69f7cea012c811647a1bd66dbca229b330a2f/plugins/uefi-capsule/fu-uefi-common.c#L176-L212

sdbootutil hardcodes \EFI\systemd.

aplanas commented 3 months ago

Is not /EFI/vendor a free form? sdbootutil can choose systemd as vendor. I am searching in the specification to see if we are forced to select os-release

TobiPeterG commented 3 months ago

Doesn't systemd itself install to /EFI/systemd? sdbootutil just copies this behavior. I don't think it's useful by fwupd to assume the path without testing different default paths or having an option to override it.

arvidjaar commented 3 months ago

Is not /EFI/vendor a free form?

Well, it has been established convention for years. At least since grub2 took over. And BTW sdbootutil also supports grub2 and hardcodes \EFI\opensuse which would be wrong as well:

cat > %{buildroot}%{_prefix}/lib/os-release <<EOF
NAME="Aeon"
# VERSION="%{version}%{?betaversion: %{betaversion}}"
ID="aeon"

sdbootutil can choose systemd as vendor.

Sure. The question is how any other application becomes aware of it.

an option to override it

So far applications and distributions consistently derived path from /etc/os-release (or from /etc/SuSE-release in the past).

Doesn't systemd itself install to /EFI/systemd?

Does systemd-boot even support Secure Boot with shim natively?

aplanas commented 3 months ago

The arguments are good, but I wonder how we can update sdbootutil without breaking old installations

aplanas commented 3 months ago

Well, it has been established convention for years. At least since grub2 took over. And BTW sdbootutil also supports grub2 and hardcodes \EFI\opensuse which would be wrong as well:

Oh .. btw ... There must be something else. My GRUB2 installation has ID="opensuse-tumbleweed", and the vendor in EFI is "opensuse". Even tho fwupd worked installing the components in "opensuse"

aplanas commented 3 months ago

This something else is ID_LIKE, that is also keep into consideration. What are the ID_LIKE in Aeon?

ThePhatLe commented 3 months ago 
NAME="Aeon"
# VERSION="20240812"
ID="aeon"
ID_LIKE="suse opensuse opensuse-tumbleweed opensuse-microos opensuse-aeon microos"
VERSION_ID="20240812"
PRETTY_NAME="Aeon"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:aeon:20240812"
BUG_REPORT_URL="https://aeondesktop.org/reportbug"
SUPPORT_URL="https://aeondesktop.org/bugs"
HOME_URL="https://aeondesktop.org/"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Aeon"
LOGO="distributor-logo-Aeon"
aplanas commented 3 months ago

Doesn't systemd itself install to /EFI/systemd? sdbootutil just copies this behavior. I don't think it's useful by fwupd to assume the path without testing different default paths or having an option to override it.

Tobias is right also. Checking [1] seems that the path is fixed, so any bootctl installation will break fwupd

Ideally sdbootutil should disappear, and only bootctl should be used, more in the boot loader installation. I wonder if the proper fix is not in fwupd, as Tobias comment.

[1] https://github.com/systemd/systemd/blob/main/src/boot/bootctl-install.c

aplanas commented 3 months ago

One possible option is to create /EFI/opensuse manually. @ThePhatLe can you create the directory in the ESP and try again the fwupd?

ThePhatLe commented 3 months ago

/EFI/ is on aeon located in /boot/efi/EFI under /EFI/ there is BOOT, Linux, aeon,systemd

in systemd there is shim.efi

where i should create /EFI/opensuse directly in /EFI/

also it is looking shim for EFI/aeon/shim.efi and shim actually is located in /boot/efi/EFI/systemd

aplanas commented 3 months ago

mkdir /boot/efi/EFI/opensuse

ThePhatLe commented 3 months ago

mkdir /boot/efi/EFI/opensuse

no affect still same no shim for /EFI/aeon/shim.efi since it is located on systemd not aeon

phatle@aeon:~> fwupdmgr update
Devices with no available firmware updates: 
 • DLL0945:00 04F3:311C
 • Fingerprint Sensor
 • Internal SPI Controller
 • SSD 990 PRO 2TB
 • TPM
 • UEFI Device Firmware
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade System Firmware from 1.29.0 to 1.31.0?                               ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This stable release fixes the following issues:                              ║
║                                                                              ║
║ • This release contains security updates as disclosed in the Dell            ║
║ Security Advisories.                                                         ║
║ • Fixed the issue where the system does not boot to the Windows operating    ║
║ system. This issue occurs when the Dell Keyboard KB555T is connected to the  ║
║ system.                                                                      ║
║                                                                              ║
║ XPS 15 9510 must remain plugged into a power source for the duration of the  ║
║ update to avoid damage.                                                      ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: Y
Decompressing…           [                                       ]
Secure boot is enabled, but shim isn't installed to EFI/aeon/shim.efi
aplanas commented 3 months ago

how EFI/aeon/shim.efi was installed? sdbootutil does not do that

ThePhatLe commented 3 months ago

/EFI/aeon/shim.efi does not excist

everything is automated it is injecting image on aeon

inside aeon i see only 6.10.3-1-default kernel

inside systemd is all

MokManager.efi  grub.efi                 pcrlock.json  systemd-bootx64.efi
boot.csv        installed_by_sdbootutil  shim.efi

seems like fwupd is looking somehow wrong path for the shim and thats why it fails

all this i am actually looking inside root using sudo transacttional-update -c shell

aplanas commented 3 months ago

inside aeon i see only 6.10.3-1-default kernel

I think you are confusing the directory? Maybe you are referring to /boot/efi/aeon? This one is irrelevant.

inside systemd is all

MokManager.efi  grub.efi                 pcrlock.json  systemd-bootx64.efi
boot.csv        installed_by_sdbootutil  shim.efi

seems like fwupd is looking somehow wrong path for the shim and thats why it fails

But if you create /boot/efi/EFI/opensuse, why is searching in /boot/efi/EFI/aeon?. Why requires shim.efi in there?

Can you give me the output of find /boot/efi/EFI? Do you have secure boot enabled?

ThePhatLe commented 3 months ago

secureboot enabled

phatle@aeon:~> find /boot/efi/EFI
/boot/efi/EFI
/boot/efi/EFI/systemd
/boot/efi/EFI/systemd/MokManager.efi
/boot/efi/EFI/systemd/shim.efi
/boot/efi/EFI/systemd/grub.efi
/boot/efi/EFI/systemd/boot.csv
/boot/efi/EFI/systemd/installed_by_sdbootutil
/boot/efi/EFI/systemd/pcrlock.json
/boot/efi/EFI/systemd/systemd-bootx64.efi
/boot/efi/EFI/BOOT
/boot/efi/EFI/BOOT/MokManager.efi
/boot/efi/EFI/BOOT/fallback.efi
/boot/efi/EFI/BOOT/BOOTX64.EFI
/boot/efi/EFI/Linux
/boot/efi/EFI/aeon
/boot/efi/EFI/aeon/fw
/boot/efi/EFI/aeon/fw/fwupd-6e106831-11dd-4c1b-b22b-526d6f78683c.cap

But if you create /boot/efi/EFI/opensuse, why is searching in /boot/efi/EFI/aeon?. Why requires shim.efi in there?

no idea that is just output it says when trying to update firmware

aplanas commented 3 months ago

Aha ... seems that /boot/efi/EFI/opensuse was not created.

I asked also about secure boot. You can try: mokutil --sb-state

ThePhatLe commented 3 months ago

Aha ... seems that /boot/efi/EFI/opensuse was not created.

i created that manually and try again update no affect so i removed it

mokutil --sb-state

phatle@aeon:~> mokutil --sb-state
SecureBoot enabled
arvidjaar commented 3 months ago

But if you create /boot/efi/EFI/opensuse, why is searching in /boot/efi/EFI/aeon?. Why requires shim.efi in there?

Because fwupd expects bootloader related files to be in \EFI\${ID-from-os-release} (it will also search through ID_LIKE as fallback). It is possible to disable check for shim in fwupd, not sure whether it will work though.

aplanas commented 3 months ago

ok this explain the mistery. For now copy shim.efi and grub.efi from /boot/efi/EFI/systemd/ to /boot/efi/EFI/aeon/

I am still not sure how sdbootutil will help here. For me this is a bug in fwupd

ThePhatLe commented 3 months ago

ok this explain the mistery. For now copy shim.efi and grub.efi from /boot/efi/EFI/systemd/ to /boot/efi/EFI/aeon/

thank you this worked

I am still not sure how sdbootutil will help here. For me this is a bug in fwupd

i agree now it is more fwupd related issue but as for now fix has been just copy those two files to /boot/efi/EFI/aeon fixed

thank you again for all the help

aplanas commented 3 months ago

But if you create /boot/efi/EFI/opensuse, why is searching in /boot/efi/EFI/aeon?. Why requires shim.efi in there?

Because fwupd expects bootloader related files to be in \EFI\${ID-from-os-release} (it will also search through ID_LIKE as fallback). It is possible to disable check for shim in fwupd, not sure whether it will work though.

No, the answer was that secure boot was enabled, /boot/efi/EFI/aeon was created (?) and /boot/efi/EFI/opensuse was not created. If opensuse was created and secure boot is disabled, then I would expect to work, and if secure boot as enabled the complain should be that /boot/efi/EFI/opensuse/shim.efi was not found.

aplanas commented 3 months ago

How can we follow up? Alternatives are:

Does anyone knows what other distributions that use systemd-boot are using?

cyril279 commented 1 month ago

A conversation has been started with fwupd about this.
https://github.com/fwupd/fwupd/issues/7783

Vogtinator commented 4 weeks ago

A conversation has been started with fwupd about this. https://github.com/fwupd/fwupd/issues/7783

A fix was merged so I think this can be closed.