CSM disabled, Tumbleweed fails to boot

I have a Lenovo M73 that came with Windows 10. I did not configure Windows and created a new GPT partition table. I then successfully installed Tumbleweed-Slowroll. I’m trying to get secure boot to work on this machine, but am failing.

That has to do with the CSM support setting in the BIOS, because when I change the CSM support setting to “disabled” Tumbleweed fails to boot. Grub2 is loaded, initramfs loaded, then upon the screen change to plymouth the pc freezes. I have to hard reboot the pc and change the CSM setting back to “enabled” to be able to boot again.

sudo efibootmgr:

BootCurrent: 0049
Timeout: 0 seconds
BootOrder: 0049,0047,0048,0000,0044,0045,0006,000A,000B,0007,0010,0011,001B,003D,001C
Boot0000* opensuse-secureboot   HD(1,GPT,97a4c9df-ce00-4372-a2e0-19a651ae73bf,0x800,0x100000)/File(\EFI\OPENSUSE\SHIM.EFI)
Boot0006* Windows Boot Manager  VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot0007* Windows Boot Manager  VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot000A* Generic Usb Device    VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot000B* CD/DVD Device VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot0010* opensuse      VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot0011* UEFI OS       VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot001B* opensuse      VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot001C* UEFI OS       VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot003D* opensuse      VenHw(99e275e7-75a0-4b37-a2e6-c5385e6c00cb)
Boot0044* opensuse      HD(1,GPT,97a4c9df-ce00-4372-a2e0-19a651ae73bf,0x800,0x100000)/File(\EFI\OPENSUSE\GRUBX64.EFI)
Boot0045* UEFI OS       HD(1,GPT,97a4c9df-ce00-4372-a2e0-19a651ae73bf,0x800,0x100000)/File(\EFI\BOOT\BOOTX64.EFI)
Boot0047* SAMSUNG SSD PM871 mSATA 128GB BBS(HD,,0x0)0000424f
Boot0048* IBA GE Slot 00C8 v1550        BBS(Network,,0x0)0000424f
Boot0049* HL-DT-STDVDRAM GTC0N LW00     BBS(CDROM,,0x0)0000424f

sudo fdisk -l

Disk /dev/sda: 119.24 GiB, 128035676160 bytes, 250069680 sectors
Disk model: SAMSUNG SSD PM87
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 78E5B6B8-3947-4982-AA87-F8D8B29F3949

Device         Start       End   Sectors  Size Type
/dev/sda1       2048   1050623   1048576  512M EFI System
/dev/sda2    1050624  99729407  98678784 47.1G Linux filesystem
/dev/sda3   99729408 234170367 134440960 64.1G Linux filesystem
/dev/sda4  234170368 250069646  15899279  7.6G Linux swap

mokutil --sb

SecureBoot disabled

I don’t understand why disabling csm will make suse not boot while the target to boot is secure-boot. Is there a way to rewrite all entries is the EFI bootloader and have the opensuse key available and csm disabled. The wiki article about UEFI boot is not applicable as Tumbleweed still uses shim 15.4 and not 15.7.

Boot with plymouth.enable=0 and without quiet on the kernel command line, post screen photo when it freezes. The full output of dmesg with Secure Boot disabled may be helpful as well (upload to https://paste.opensuse.org`).

There were quite a number of reports about kernel 6.5 boot issues, you may hit one of them.

I booted the system with the options you mentioned and this is the output upon freezing: https://paste.opensuse.org/pastes/0d98e23c25f3