Failed to set MokListRT: Invalid Parameter

[Shubham Rajesh Kale]

Hello,
I am testing Ubuntu 20.04 Daily built the latest version on my MacBook pro-13inch late 2012 model Non-retina display. and I am getting the error while I boot my MacBook using a Pendrive in which I have installed the Ubuntu Daily 20.04 OS.
Error is as follows :

Failed. to set MokListRT: Invalid Parameter
Could not create MokListRT: Invalid Parameter
Importing MOK states has failed: import_mok_state() failed : invalid Parameter
Continuing boot since secure mode is disabled.

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: xorg 1:7.7+19ubuntu14
ProcVersionSignature: Ubuntu 5.4.0-14.17-generic 5.4.18
Uname: Linux 5.4.0-14-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.20.11-0ubuntu20
Architecture: amd64
BootLog: Error: [Errno 13] Permission denied: '/var/log/boot.log'
CompositorRunning: None
CurrentDesktop: ubuntu:GNOME
Date: Thu Mar 12 10:40:44 2020
DistUpgraded: Fresh install
DistroCodename: focal
DistroVariant: ubuntu
DkmsStatus: bcmwl, 6.30.223.271+bdcom, 5.4.0-14-generic, x86_64: installed
ExtraDebuggingInterest: Yes, if not too technical
GraphicsCard:
 Intel Corporation 3rd Gen Core processor Graphics Controller [8086:0166] (rev 09) (prog-if 00 [VGA controller])
   Subsystem: Apple Inc. 3rd Gen Core processor Graphics Controller [106b:00fa]
InstallationDate: Installed on 2020-03-11 (0 days ago)
InstallationMedia: Ubuntu 20.04 LTS "Focal Fossa" - Alpha amd64 (20200309)
MachineType: Apple Inc. MacBookPro9,2
ProcEnviron:
 LANGUAGE=en_IN:en
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_IN
 SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-5.4.0-14-generic root=UUID=70f5287a-ef7d-48fd-a479-01244bc3fecf ro quiet splash vt.handoff=7
SourcePackage: xorg
Symptom: display
Title: Xorg freeze
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 07/24/2019
dmi.bios.vendor: Apple Inc.
dmi.bios.version: 229.0.0.0.0
dmi.board.asset.tag: Base Board Asset Tag#
dmi.board.name: Mac-6F01561E16C75D06
dmi.board.vendor: Apple Inc.
dmi.board.version: MacBookPro9,2
dmi.chassis.type: 10
dmi.chassis.vendor: Apple Inc.
dmi.chassis.version: Mac-6F01561E16C75D06
dmi.modalias: dmi:bvnAppleInc.:bvr229.0.0.0.0:bd07/24/2019:svnAppleInc.:pnMacBookPro9,2:pvr1.0:rvnAppleInc.:rnMac-6F01561E16C75D06:rvrMacBookPro9,2:cvnAppleInc.:ct10:cvrMac-6F01561E16C75D06:
dmi.product.family: MacBook Pro
dmi.product.name: MacBookPro9,2
dmi.product.sku: System SKU#
dmi.product.version: 1.0
dmi.sys.vendor: Apple Inc.
version.compiz: compiz N/A
version.libdrm2: libdrm2 2.4.100-4
version.libgl1-mesa-dri: libgl1-mesa-dri 20.0.0-1ubuntu1
version.libgl1-mesa-glx: libgl1-mesa-glx N/A
version.xserver-xorg-core: xserver-xorg-core 2:1.20.7-2ubuntu2
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev N/A
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:19.1.0-1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.99.917+git20190815-1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.16-1

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This change was made by a bot.

[You-Sheng Yang (vicamo)]

Just remove shim/shim-signed/mokutil, and make sure you also deleted /boot/efi/EFI/*/shimx64.efi, then this problem goes away. It's not related to linux kernel.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[You-Sheng Yang (vicamo)]

https://support.apple.com/en-us/HT208330 2012 MBP don't have T2 Security Chip, therefore no Secure Boot support. So don't try secure boot on it. (which sounds this should be a WONTFIX/INVALID bug, but let shim developers decide).

[Daniel van Vugt (vanvugt)]

Even if it is Won't Fix, then users should not be presented with error messages for non-errors.

[Shubham Rajesh Kale (shubzzz332878)]

so will the error message go away in the upcoming updates or not?

[Steve Langasek (vorlon)]

This error is not a result of SecureBoot being supported or not. Why is shim unable to write to an nvram variable at runtime? That looks like a problem with the firmware's UEFI implementation.

I believe we also should only be setting MokListRT, if MokList is also set. Were you prompted to enroll a MOK key on this system (unfriendly blue screen), and did you do so?

The most likely cause for Ubuntu to prompt to you to enroll MOK is if you have nvidia driver packages installed; but your bug report shows that you are using nouveau drivers and there is no nvidia kernel module loaded. Did you previously try to install the nvidia binary drivers?

[Shubham Rajesh Kale (shubzzz332878)]

No i didn't enrolled a MOK key in the system.Infact I want not prompted with any blue screen .I was a good and smooth install as it usually is.But this error didn't occur the first time i boot up.But then second time onwards it started to appear.

Sent from Yahoo Mail on Android

  On Fri, Mar 13, 2020 at 12:05, Steve Langasek<email address hidden> wrote: This error is not a result of SecureBoot being supported or not.  Why is
shim unable to write to an nvram variable at runtime?  That looks like a
problem with the firmware's UEFI implementation.

I believe we also should only be setting MokListRT, if MokList is also
set.  Were you prompted to enroll a MOK key on this system (unfriendly
blue screen), and did you do so?

The most likely cause for Ubuntu to prompt to you to enroll MOK is if
you have nvidia driver packages installed; but your bug report shows
that you are using nouveau drivers and there is no nvidia kernel module
loaded.  Did you previously try to install the nvidia binary drivers?

** Changed in: shim (Ubuntu)
      Status: Confirmed => Incomplete

** Changed in: grub2 (Ubuntu)
      Status: Confirmed => Invalid

** Changed in: mokutil (Ubuntu)
      Status: Confirmed => Invalid

--
You received this bug notification because you are subscribed to the bug
report.
https://bugs.launchpad.net/bugs/1867092

Title:
  Failed to set MokListRT: Invalid Parameter

Status in grub2 package in Ubuntu:
  Invalid
Status in mokutil package in Ubuntu:
  Invalid
Status in shim package in Ubuntu:
  Incomplete
Status in shim-signed package in Ubuntu:
  Confirmed

Bug description:
  Hello,
  I am testing Ubuntu 20.04 Daily built the latest version on my MacBook pro-13inch late 2012 model Non-retina display. and I am getting the error while I boot my MacBook using a Pendrive in which I have installed the Ubuntu Daily 20.04 OS.
  Error is as follows :

  Failed. to set MokListRT: Invalid Parameter
  Could not create MokListRT: Invalid Parameter
  Importing MOK states has failed: import_mok_state() failed : invalid Parameter
  Continuing boot since secure mode is disabled.

  ProblemType: Bug
  DistroRelease: Ubuntu 20.04
  Package: xorg 1:7.7+19ubuntu14
  ProcVersionSignature: Ubuntu 5.4.0-14.17-generic 5.4.18
  Uname: Linux 5.4.0-14-generic x86_64
  NonfreeKernelModules: wl
  ApportVersion: 2.20.11-0ubuntu20
  Architecture: amd64
  BootLog: Error: [Errno 13] Permission denied: '/var/log/boot.log'
  CompositorRunning: None
  CurrentDesktop: ubuntu:GNOME
  Date: Thu Mar 12 10:40:44 2020
  DistUpgraded: Fresh install
  DistroCodename: focal
  DistroVariant: ubuntu
  DkmsStatus: bcmwl, 6.30.223.271+bdcom, 5.4.0-14-generic, x86_64: installed
  ExtraDebuggingInterest: Yes, if not too technical
  GraphicsCard:
  Intel Corporation 3rd Gen Core processor Graphics Controller [8086:0166] (rev 09) (prog-if 00 [VGA controller])
    Subsystem: Apple Inc. 3rd Gen Core processor Graphics Controller [106b:00fa]
  InstallationDate: Installed on 2020-03-11 (0 days ago)
  InstallationMedia: Ubuntu 20.04 LTS "Focal Fossa" - Alpha amd64 (20200309)
  MachineType: Apple Inc. MacBookPro9,2
  ProcEnviron:
  LANGUAGE=en_IN:en
  PATH=(custom, no user)
  XDG_RUN...

[Shubham Rajesh Kale (shubzzz332878)]

Just to confirm that I installed it correctly i reinstalled the Ubuntu 20.04 OS completely but still getting the same screen error. I Even cleared any Boot file junk and NVRAM data to reset Just to be safe but still getting this error.
The installation process followed is as per books.
But still getting this error please help me to get rid of it.
Thank you.

[Johan Smolders (smojo1)]

I can confirm that this error is shown after clean installing Ubuntu 20.04 on a Mac and rebooting.
My device is a late 2015 iMac. Seems to work well but as stated above users shouldn't be presented such a error when there is actually no problem.

[Bob Bauer (wahram-tig)]

I've got the same issue on my Macbook Pro early 2008. Deleting /boot/efi/EFI/ubuntu/shimx64.efi doesn't help at all.

"Solution": Press "alt" when booting the macbook. Select "Boot from next target" and your system should boot by showing the error message. Alternatively, do exactly the same by starting a LIVE USB system at the first time.

[Repa (alexandrcfif)]

Hi! I also have got this on my Macbook air 2012 running Linux mint 20 xfce after latest package update.

[Paul (penright)]

Just installed 20.04 my Macbook 2010. At first it booted ok. Then when logging on the screen would flash and go right back to the log on screen. I thought it had to do with chrome remote desk top. After some searching I landed on this thread. https://askubuntu.com/questions/1231410/cant-log-in-on-ubuntu-20-04 One of the post talked about following this and it worked. https://www.how2shout.com/how-to/ubuntu-20-04-lts-stuck-login-loop-general-solution.html Basicly it just told about using alt, ctl, F3 to log in. Then it said to do a apt update/upgrade. After doing that it did fix my hanging on the gui log in screen, but that was when I stated seeing "MokListRT" error. Since I am not using secure boot, mine will continue loading all the way though. I was getting a crash report for chrome-remote-desktop. I remove it and still getting the error. Being new to Ubuntu 20.04 this may be normal, but everytime I log on I see a pop up for an application requesting access to the "default keyring". It does not tell me which application. I suspected it to be chrome, so I canceled the popup, then went into chrome, and it did pop back up. So I assume that chrome is requesting the access.

I hope this detail help narrow down more than it confuses. Any logs that I can help with let me know.

[Steve Langasek (vorlon)]

The MokListRT error has nothing to do with either chrome, or problems logging into the desktop.

[Chris Williamson (chriswilliamson-i)]

The day before yesterday, I got the error as originally reported, except I was running Kubuntu 20.04, got the updates available prompt, opened Discover, updated shim and shim-signed, waited for both the regular software update and grub update to finish, and then restarted.

I posted a question on Ask Ubuntu, then found a CentOS bug with a fix I was able to adapt to my own situation and answer my own question. If you're a bug fixer, read the first note on the CentOS bug; if you've got this same problem, read the Ask Ubuntu question and answer:

https://bugs.centos.org/view.php?id=15522#c33203
https://askubuntu.com/questions/1277828/how-do-i-fix-broken-boot-after-shim-update

[Steve Langasek (vorlon)]

So the issue here appears to be that the new shim treats a failure to write MokListRT to nvram as a fatal error, even when not booting in SecureBoot mode, with the consequence that systems with no nvram space available will fail to boot.

This will take time to resolve upstream due to the requirement to go through a signing cycle with Microsoft for any new binaries. However, it sounds like the bug is well-characterized and we should be able to work with upstream for a proper fix.

[Niko Reveliotis (nikorev)]

Is this related to the problem? Haven't attempted this solution yet, but I am on a 2011 Macbook Pro running Ubuntu 20.04 experiencing the same issue.

https://askubuntu.com/questions/1279602/ubuntu-20-04-failed-to-set-moklistrt-invallid-parameter

[Who Rider (whorider)]

This seems to work on MacBook Air 2012

sudo su -
cd /boot/efi/EFI/ubuntu
cp grubx64.efi shimx64.efi
reboot

[Julian Andres Klode (juliank)]

You effectively just did the same as uninstalling shim-signed but in a weird way that will get reverted every update.

[Rowan Wookey (rwky)]

This worked for me on my MPB 2015

apt-get purge shim
mv /boot/efi/EFI/ubuntu /root/ubuntu-efi.bak #backing up just in case
grub-install /dev/sda1

[lorn10 (kle)]

I can also confirm this bug for Kubuntu 18.04 LTS at an older Apple iMac 8,1 computer. The solution seems to purge shim and then reinstall grub.

It would be really great if the corresponding devs can fix this issue by add a simple check (for an Apple EFI environment) before shim is installed. Or it may be also possible to make shim aware that there also exists non Secure Boot capable UEFI systems. (So far I know, Apple introduced the Secure Boot feature not before 2017.) On such nun Secure Boot compliant systems shim only has to be inactive and quiet. ;-)