fwupdaa64.efi crashes on startup

[dann frazier]

[Impact]
fwupdaa64.efi crashes on startup

[Test Case]
FS0:\EFI\BOOT\> fwupdaa64.efi

Synchronous Exception at 0x0000000438759658

Synchronous Exception at 0x0000000438759658

[Fix]
https://github.com/fwupd/fwupd/commit/8b044c6cb3d007803bd67ca5e6527ed89d5ecb62

[Regression Risk]

[dann frazier (dannf)]

Fixed packages are staged here:
  https://launchpad.net/~dannf/+archive/ubuntu/fwupd

[Timo Aaltonen (tjaalton)]

Hello dann, or anyone else affected,

Accepted fwupd into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd/1.2.10-1ubuntu4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[dann frazier (dannf)]

eoan verification:

FS0:\efi\> fwupdaa64.efi
WARNING: No updates to process. Called in error?

[Mario Limonciello (superm1)]

Regression for eoan: bug 1860536

[dann frazier (dannf)]

Thx. fwupd-signed is in the SRU queue but needs to be approved before this goes out. I'll add the block-proposed tag here until then.

[Timo Aaltonen (tjaalton)]

Hello dann, or anyone else affected,

Accepted fwupd-signed into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd-signed/1.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[dann frazier (dannf)]

For fwupd-signed, I verified it by copying the fwupdx64.efi.signed over the grubx64.efi binary on a SecureBoot-enabled system and verified that it was able to be exec'd. (I'm not sure how to force shim to execute it any other way).

[Launchpad Janitor (janitor)]

This bug was fixed in the package fwupd - 1.2.10-1ubuntu4

---------------
fwupd (1.2.10-1ubuntu4) eoan; urgency=medium

  [ Robert Ancell ]
  * d/p/0001-trivial-libfwupd-skip-tests-if-machine-id-is-empty-t.patch:
    - Only check the vendor ID if the device has one set (LP: #1856896)

  [ dann frazier ]
  * d/p/0001-efi-use-a-wildcard-section-copy-for-final-EFI-genera.patch
    - This avoids a crash on exec of fwupdaa64.efi (LP: #1858590)

 -- dann frazier <email address hidden> Mon, 13 Jan 2020 12:17:07 -0700

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for fwupd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package fwupd-signed - 1.10.2

---------------
fwupd-signed (1.10.2) eoan; urgency=medium

  * Build depends on fwupd 1.2.10-1ubuntu4 (LP: #1856896, LP: #1858590)

 -- dann frazier <email address hidden> Mon, 13 Jan 2020 12:19:08 -0700

[Adrian Bunk (bunk)]

Is there any progress on getting this fixed in bionic?

1.2.10-1ubuntu4 from eoan with meson-0.45-bc.patch from 1.2.10-1ubuntu2~ubuntu18.04.3 added builds and fixes the problem for me.

Thanks

[Ike Panhc (ikepanhc)]

The fix[1] is simple but since we already backport fwupd from eoan to bionic. Shall we backport 1.3.11 from focal to bionic?

[1] https://github.com/fwupd/fwupd/commit/8b044c6cb3d007803bd67ca5e6527ed89d5ecb62

[dann frazier (dannf)]

On Wed, Nov 25, 2020 at 12:41 AM Ike Panhc <email address hidden> wrote:
>
> The fix[1] is simple but since we already backport fwupd from eoan to
> bionic. Shall we backport 1.3.11 from focal to bionic?

While this package has been granted an SRU special case exception:
  https://wiki.ubuntu.com/firmware-updates
It currently states that only "fwupd releases in the 1.0.x series."
can be SRU'd back to bionic.
But bionic is currently at 1.2.x now. Mario - since it looks like you
authored that exception, would you be able to help clarify?

  -dann

[dann frazier (dannf)]

Actually, it looks like there's been a queued fix for this in the bionic SRU queue for several months now. See bug 1884788.

[Mario Limonciello (superm1)]

That's correct, it's only supposed to be with the same series the OS version launched with. Bionic was an exception because it was on SUCH an old version that upstream decided to stop supporting it.
I would expect we should only SRU 1.2.x into bionic now. Iff upstream decides to stop supporting 1.2.x then yes we should bring it up to sync with focal.

[dann frazier (dannf)]

Thanks Mario. Do you know what the status of the SRU for bug 1884788 is? The only issue I see mentioned in the bug is mine where I suggest correcting the changelog entry for this bug. If that's the only issue, would you mind uploading a fix and noting it there?

[Taihsiang Ho (tai271828)]

A quick note of the current status: on bionic (4.15 kernel) we are still looking forward to bionic re-uploading if possible because the uploaded version[1] could still reproduce this issue.

[1]
     1.2.10-1ubuntu2~ubuntu18.04.5 500
        500 http://ports.ubuntu.com/ubuntu-ports bionic-updates/main arm64 Packages
        500 http://ports.ubuntu.com/ubuntu-ports bionic-security/main arm64 Packages

[Ike Panhc (ikepanhc)]

Thanks all the comments.

fwupd in ubuntu is now
 - bionic 1.2.10-1ubuntu2
 - eoan (EOLed) 1.2.10-1ubuntu4.1
 - focal 1.3.11-1~focal1
 - upstream 1_2_X 1.2.13

Since 1.2.10-1ubuntu4.1 contains CVE-2020-10759, I think it is good to backport lastest eoan fwupd to bionic and consider moving to 1.3.x in the future. Does it make sense?

[dann frazier (dannf)]

Sounds like there's a plan to update fwupd across releases to support SBAT. See the penultimate paragraph of https://ubuntu.com/blog/grub2-secure-boot-bypass-2021

[Brian Murray (brian-murray)]

Hello dann, or anyone else affected,

Accepted fwupd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd/1.2.14-0~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello dann, or anyone else affected,

Accepted fwupd-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd-signed/1.10~ubuntu18.04.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[dann frazier (dannf)]

Verified 1.2.14-0~18.04.1:

FS2:\> fwupdaa64.efi
WARNING: No updates to process. Called in error?

[Brian Murray (brian-murray)]

Hello dann, or anyone else affected,

Accepted fwupd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd/1.2.14-0~18.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello dann, or anyone else affected,

Accepted fwupd-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/fwupd-signed/1.10~ubuntu18.04.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[dann frazier (dannf)]

= Verification of 1.2.14-0~18.04.2 =
Shell> fs0:
FS0:\> cd efi
FS0:\efi\> fwupdaa64.efi
WARNING: No updates to process. Called in error?
FS0:\efi\>

[Launchpad Janitor (janitor)]

This bug was fixed in the package fwupd - 1.2.14-0~18.04.2

---------------
fwupd (1.2.14-0~18.04.2) bionic; urgency=medium

  * debian/rules: catch up to generate sbat section.

fwupd (1.2.14-0~18.04.1) bionic; urgency=medium

  * New upstream version (1.2.14) (LP: #1884788)
  * Bug fixes:
    - Fixes crashes on fwupdaa64.efi on startup (LP: #1858590)
    - Check version was updated by checking version
    - Correctly import PKCS-7 remote metadata
    - Decrease minimum battery requirement to 10%
    - Disable the battery percentage checks if UPower is unavailable
    - Do not do semver conversion in fu_common_vercmp()
    - Fix the DeviceID set by GetDetails
    - Force the synaptics-prometheus minor version from 0x02 to 0x01
    - Prevent Dell updates to occur via synaptics-mst
    - Read all releases and convert versions when comparing
    - Use the correct timeout for unifying IO channel writes
    - Validate that gpgme_op_verify_result() returned at least one signature
    - Avoid checking for bolt support when not required
    - Correct HWID support in wacom-raw
    - Fix offset of vendor id of hidraw devices
    - Make loading vendor/product/serial strings non-fatal
    - Only check the vendor ID if the device has one set
    - Use more systemd directives for directories
    - Actually write the new device path if different than before
    - Add a SynapticsMSTBoardID for a few Lenovo docks
    - Add the counterpart GUID for the DW5821e
    - Be more accepting when trying to recover a failed database migration
    - Do not ask the user to upload a report if ReportURI is not set
    - Do not segfault when trying to quit the downgrade selection
    - Fix a crash when stopping the fwupd service
    - Never show AppStream markup on the console
    - Relax the certificate time checks in the self tests for the legacy certificate
    - Reload metadata store when configuration changes
    - Remove replug flag after the device comes back from reboot
    - Update device_modified in sql database during updates
    - Work properly with ICL thunderbolt controller
  * New features:
    - Add support for tpm2-tools 4.X
    - Allow specifying a firmware GUID to check any version exists
    - Add SBAT region support (LP: #1921539)
  * Don't cleanup /var/cache/fwupdate anymore
  * Drop upstreamed patches:
    - 0001-Relax-the-certificate-time-checks-in-the-self-tests-.patch
    - 0001-trivial-libfwupd-skip-tests-if-machine-id-is-empty-t.patch
    - 0001-Allows-confined-snaps-to-activate-fwupd-via-D-Bus.patch
    - 0001-Only-check-the-vendor-ID-if-the-device-has-one-set.patch
    - 0001-efi-use-a-wildcard-section-copy-for-final-EFI-genera.patch
    - CVE-2020-10759.patch
  * Remaining changes:
    - meson-0.45-bc.patch: Fix build with meson 0.45
    - Drop added Recommends: on bolt which is not in flavor seeds and adds a
      new service.
  * Backport a patch from upstream 1_2_X branch to fix SBAT character.
  * Backport a patch from upstream 1_2_X branch to fix vendor-id requirement
    error on Dell WD19 (LP: #1921544)

 -- Yuan-Chen Cheng <email address hidden> Tue, 31 Aug 2021 15:58:09 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package fwupd-signed - 1.10~ubuntu18.04.6

---------------
fwupd-signed (1.10~ubuntu18.04.6) bionic; urgency=medium

  * Build depends on fwupd version 1.2.14-0~18.04.2. (LP: #1921539)

fwupd-signed (1.10~ubuntu18.04.5) bionic; urgency=medium

  * Build depends on fwupd version 1.2.14-0~18.04.1
    - LP: #1921544
    - LP: #1921539
    - LP: #1884788
    - LP: #1858590

 -- Yuan-Chen Cheng <email address hidden> Tue, 31 Aug 2021 17:50:22 +0800