Proposed shim package will cause system complain "Failed to set MokSBStateRT: (2) Invalid Parameter"

Bug #1644806 reported by Po-Hsu Lin on 2016-11-25
This bug affects 2 people
Affects Status Importance Assigned to Milestone
shim (Ubuntu)
shim-signed (Ubuntu)
Mathieu Trudel-Lapierre

Bug Description

CID: 201606-22528

The proposed shim package will cause this laptop complain about: "Failed to set MokSBStateRT: (2) Invalid Parameter" on boot.

You will see a blue screen after the Dell logo (please find the attached screenshot). Hit ok will continue to boot.

BIOS setting
UEFI + SecureBoot Enabled

1. Install 14.04.1 + dist-upgrade
2. Reboot to see if everything is ok
3. Enable proposed + dist-upgrade
4. Reboot, and you will see this issue

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: linux-image-4.4.0-49-generic 4.4.0-49.70
ProcVersionSignature: Ubuntu 4.4.0-49.70-generic 4.4.30
Uname: Linux 4.4.0-49-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
 /dev/snd/controlC0: ubuntu 1611 F.... pulseaudio
CurrentDesktop: Unity
Date: Fri Nov 25 07:03:10 2016
HibernationDevice: RESUME=UUID=b1256199-2e00-45a5-999c-0b81ea3fcfa6
InstallationDate: Installed on 2016-11-25 (0 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
 Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
 Bus 001 Device 005: ID 0cf3:e005 Atheros Communications, Inc.
 Bus 001 Device 003: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card Reader Controller
 Bus 001 Device 002: ID 1bcf:28c0 Sunplus Innovation Technology Inc.
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
MachineType: Dell Inc. Vostro 15-3568
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-49-generic.efi.signed root=UUID=f6e40ce3-8944-47c0-ac5d-592570800352 ro quiet splash vt.handoff=7
 linux-restricted-modules-4.4.0-49-generic N/A
 linux-backports-modules-4.4.0-49-generic N/A
 linux-firmware 1.157.5
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install) 07/22/2016
dmi.bios.vendor: Dell Inc.
dmi.bios.version: 01.00.00
dmi.board.vendor: Dell Inc.
dmi.chassis.type: 9
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvr01.00.00:bd07/22/2016:svnDellInc.:pnVostro15-3568:pvr:rvnDellInc.:rn:rvr:cvnDellInc.:ct9:cvr: Vostro 15-3568
dmi.sys.vendor: Dell Inc.

Po-Hsu Lin (cypressyew) wrote :
Po-Hsu Lin (cypressyew) wrote :

Note that this issue can be reproduced on a Dell Inspiron 7560 (201606-22349) laptop as well.

And the OEM image is affected too.

tags: added: 201606-22349
description: updated

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Po-Hsu Lin (cypressyew) wrote :

Note that you can verify this issue by downgrading grub-related packages from proposed to updates:

sudo apt-get install shim=0.8-0ubuntu2 shim-signed=1.19~16.04.1+0.8-0ubuntu2 grub-efi-amd64-bin=2.02~beta2-36ubuntu3.2 grub2-common=2.02~beta2-36ubuntu3.2 grub-common=2.02~beta2-36ubuntu3.2 grub-efi-amd64=2.02~beta2-36ubuntu3.2 grub-efi-amd64-signed=1.66.2+2.02~beta2-36ubuntu3.2

Changed in shim-signed (Ubuntu):
importance: Undecided → High
Ivan Hu ( wrote :

This issue is caused by the Dell machines have already embedded the MokSBStatesRT variable with EFI_VARIABLE_NON_VOLATILE attribute, and the new shim-signed 1.21.4 include the patch which will mirror the MokSBStatesRT when MokSBState exists, see the, and it causes the setvariable MokSBStatesRT failed because it has already existed with different attribute.

Attached the patch which can be used to solve this issue by checking the MokSBStateRT existence and deleting it before mirroring it.

This patch had been sent to upstream and wait for feedback.

The attachment "0001-shim-fix-the-mirroring-MokSBState-fail.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch

On Tue, Nov 29, 2016 at 07:24:32AM -0000, Ivan Hu wrote:
> This issue is caused by the Dell machines have already embedded the
> MokSBStatesRT variable with EFI_VARIABLE_NON_VOLATILE attribute, and the
> new shim-signed 1.21.4 include the patch which will mirror the
> MokSBStatesRT when MokSBState exists, see the
> and it causes the setvariable MokSBStatesRT failed because it has
> already existed with different attribute.

Are the machines that have this variable pre-set in production, or are these
dev systems? Does this issue block the boot or does it "just" generate an
ugly error message? From your perspective, should this block release of
this SRU, which has been delayed several times and will require another
round trip to Microsoft for signing to get this new patch included?

The current version of shim is known to have failures correctly booting to
e.g. fwupdate.efi (bug #1581299). The pending SRU fixes this.

Ivan Hu ( wrote :


The machines have been in production and sold more than one year. Unfortunately the error message is print out by console error,
console_error(L"Failed to set MokSBStateRT", efi_status);
It will block the boot with ugly full blue screen and wait for user's "enter" to continue to boot.

I believe it is better that the new SRU should wait for the new patch included, because there might be a lot of Dell machine users affected.

Steve Langasek (vorlon) on 2016-11-30
Changed in shim-signed (Ubuntu):
assignee: nobody → Mathieu Trudel-Lapierre (cyphermox)
importance: High → Critical
milestone: none → ubuntu-16.12
status: New → Triaged
tags: added: regression-proposed
Changed in linux (Ubuntu):
importance: Undecided → Critical
Steve Langasek (vorlon) on 2016-12-21
no longer affects: linux (Ubuntu)

We're still waiting for the updated shim to be signed; I'll update again as soon as we have more information.

Changed in shim-signed (Ubuntu):
milestone: ubuntu-16.12 → ubuntu-17.01
status: Triaged → In Progress
Changed in shim-signed (Ubuntu):
milestone: ubuntu-17.01 → ubuntu-17.02
Ivan Hu ( wrote :

the patch has been accepted by upstream, commit# 07bda58596608f05bfa035a1cc5710f5ac8ea3d9

Yes, the patches are ready and reviewed and good; we're just waiting for the shim upload to be signed by Microsoft.

Changed in shim-signed (Ubuntu):
milestone: ubuntu-17.02 → ubuntu-17.03
Steve Langasek (vorlon) wrote :

This bug has been resolved for zesty with shim-signed 1.27.

For previous releases, the affected package was withdrawn from the -proposed queue.

Changed in shim-signed (Ubuntu):
status: In Progress → Fix Released

The verification of the Stable Release Update for shim has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

tags: added: verification-needed
removed: package-from-proposed regression-proposed

This has been pushed to trusty-proposed; and needs validation. Unfortunately, I do not have access to hardware to do that validation myself. Ivan, could you help?

Changed in shim (Ubuntu):
status: New → Fix Released
Changed in shim (Ubuntu Trusty):
status: New → Fix Committed
Changed in shim-signed (Ubuntu Trusty):
status: New → Fix Committed
tags: added: verification-needed-trusty
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package shim - 0.9+1474479173.6c180c6-1ubuntu1

shim (0.9+1474479173.6c180c6-1ubuntu1) zesty; urgency=medium

  [ Steve Langasek ]
  * Merge (not yet NEW cleared) changes from Debian branch.

  [ Mathieu Trudel-Lapierre ]
  * debian/patches/0001-shim-fix-the-mirroring-MokSBState-fail.patch: guard
    against errors in mirroring MokSBState to MokSBStateRT. Thanks to Ivan Hu
    for the patch. This will fix issues updating MokSBStateRT if the variable
    already exists with different attributes. (LP: #1644806)

 -- Mathieu Trudel-Lapierre <email address hidden> Thu, 01 Dec 2016 16:55:50 -0500

Changed in shim (Ubuntu Trusty):
status: Fix Committed → Fix Released
Mathew Hodson (mathew-hodson) wrote :

This bug was fixed in the package shim-signed - 1.32~14.04.2

shim-signed (1.32~14.04.2) trusty; urgency=medium

  * Backport shim-signed 1.32 to 14.04. (LP: #1700170)

Changed in shim-signed (Ubuntu Trusty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers