Am 16.04.2021 17:20 schrieb Michael Pujos <pujos.michael(a)gmail.com>:
>
> Hi,
>
>
> On my Lenovo P72 laptop with Secure Boot enabled, I cannot get fwupdmgr
> to apply firmware updates that requires a reboot (BIOS, Intel ME, ...).
> What happens is that after fwupdmgr downloads the firmware and propose
> to reboot, the machine simply boots normally into grub.
> If I disable 'Secure Boot' in BIOS, it works properly and the Lenovo
> firmware updater is started on reboot.
>
> If when fwupdmgr asks to reboot, I reply negatively and look at the
> modified startup with 'efibootmgr -v', it looks fine,
> with Bootnext starting the shim with fwupdx64.efi seemingly being chain
> loaded:
>
> |BootNext: 0004 BootCurrent: 0002 Timeout: 0 seconds BootOrder:
> 0002,0003,0001,001B,0010,0011,0012,0013,0014,0000,0018,0019,001A,001C,001D,001E,001F,0020,0021,0022,0027,0004
> Boot0000* Windows Boot Manager
> HD(8,GPT,ab16b902-fdd2-f945-b235-bf0f99a6d098,0x72853800,0x82000)/File(\EFI\Microsoft\Boot\bootmgfw.efi)WINDOWS.........x...B.C.D.O.B.J.E.C.T.=.{.9.d.e.a.8.6.2.c.-.5.c.d.d.-.4.e.7.0.-.a.c.c.1.-.f.3.2.b.3.4.4.d.4.7.9.5.}...e.............�...
> Boot0001* openSUSE Secure Boot
> HD(1,GPT,9a54bd14-137a-4800-9494-38ec72b3809a,0x800,0x82000)/File(EFI\opensuse\shim.efi)
> Boot0002* opensuse-secureboot
> HD(8,GPT,ab16b902-fdd2-f945-b235-bf0f99a6d098,0x72853800,0x82000)/File(\EFI\opensuse\shim.efi)
> Boot0003* openSUSE TEST
> HD(8,GPT,ab16b902-fdd2-f945-b235-bf0f99a6d098,0x72853800,0x82000)/File(\EFI\opensuse\shim.efi)
> Boot0004* Linux-Firmware-Updater
> HD(8,GPT,ab16b902-fdd2-f945-b235-bf0f99a6d098,0x72853800,0x82000)/File(\EFI\opensuse\shim.efi)\.f.w.u.p.d.x.6.4...e.f.i...|
>
>
> I'm trying to determine if that issue is specific to my system, hence my
> question: has anyone got these updates working with Secure Boot ?
Yes, worked with a T480s and Leap15.2. Secure Boot is on. I think it was a BIOS update, not ME. It Rebooted, started BIOS update directly without starting grub.
Mit freundlichen Grüßen,
Andreas Vetter