Fwupdmgr: Update fails with "Secure boot is enabled, but shim isn't installed to EFI/opensuse/shimx64.efi"

English Install/Boot/Login
1

Hi,

my system is this:

Operating System: openSUSE Tumbleweed 20231106
KDE Plasma Version: 5.27.9
KDE Frameworks Version: 5.111.0
Qt Version: 5.15.11
Kernel Version: 6.5.9-1-default (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 PRO 6850U with Radeon Graphics
Memory: 30.1 GiB of RAM
Graphics Processor: AMD Radeon Graphics
Manufacturer: LENOVO
Product Name: 21CHCTO1WW
System Version: ThinkPad T16 Gen 1

It has been installed with Secure Boot (and TPM) enabled and everything works really fine.

But when I try to update the firmware with fwupdmgr, I get error messages:

linux:/home/christian # fwupdmgr update
WARNUNG: Die UEFI-ESP-Partition ist möglicherweise nicht korrekt eingerichtet
Siehe https://github.com/fwupd/fwupd/wiki/PluginFlag:esp-not-valid für weitere Informationen.
Geräte mit keinen verfügbaren Firmware-Aktualisierungen: 
 • Integrated RGB Camera
 • SSD 980 PRO 2TB
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
Geräte mit der neuesten verfügbaren Firmware-Version:
 • Embedded Controller
╔══════════════════════════════════════════════════════════════════════════════╗
║ System Firmware von 0.1.41 auf 0.1.46 aktualisieren?                         ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This release contains the following changes:                                 ║
║                                                                              ║
║ • [Important] Remove MSC mode.                                               ║
║ • (New) Add support for Maori keyboard.                                      ║
║ • (New) Enable smart card preboot function.                                  ║
║ • (Fix) Fixed issue where Lenovo logo interface lost during restart after    ║
║ set Supervisor Password/Power-On Password/NVMe1Password.                     ║
║ • (Fix) Fixed issue where keyboard backlight does not remain after           ║
║ returning from modern standby.                                               ║
║ • (Fix) Fixed issue where system hang up at Pre-Boot Authentication          ║
║ interface after perform a normal scan operation with unregistered            ║
║ fingerprint for 3 attempts.                                                  ║
║ • (Fix) Fixed issue where system will shutdown when dock power button is     ║
║ pressed for 4s in the process of BIOS upgrade.                               ║
║ • (Fix) Fixed issue where “invalid critical threshold” issue under           ║
║ linux.                                                                       ║
║ • (Fix) Fixed issue where system can't change power-saver mode under         ║
║ linux after wake up from DC+Lid open.                                        ║
║                                                                              ║
║ 21CHCTO1WW muss während der gesamten Dauer der Aktualisierung an eine        ║
║ Stromquelle angeschlossen bleiben, um Schäden zu vermeiden.                  ║
╚══════════════════════════════════════════════════════════════════════════════╝
Operation durchführen? [Y|n]: y
Entpacken …              [                                       ]]
Secure boot is enabled, but shim isn't installed to EFI/opensuse/shimx64.efi

These are the critical points:

Die UEFI-ESP-Partition ist möglicherweise nicht korrekt eingerichtet
Siehe PluginFlag:esp not valid · fwupd/fwupd Wiki · GitHub für weitere Informationen.

Meaning the UEFI-ESP partition is not installed correctly.

And

Secure boot is enabled, but shim isn’t installed to EFI/opensuse/shimx64.efi

When I have a look at EFI/opensuse, I see this:

linux:/home/christian # ls -l /boot/efi/EFI/opensuse
insgesamt 4152
-rwxr-xr-x 1 root root      58  7. Nov 19:21 boot.csv
drwxr-xr-x 2 root root    4096  7. Nov 19:34 fw
-rwxr-xr-x 1 root root   63256  9. Okt 10:59 fwupdx64.efi
-rwxr-xr-x 1 root root     155  7. Nov 19:21 grub.cfg
-rwxr-xr-x 1 root root 2054000  7. Nov 19:21 grub.efi
-rwxr-xr-x 1 root root  331776  7. Nov 19:21 grubx64.efi
-rwxr-xr-x 1 root root  846096  7. Nov 19:21 MokManager.efi
-rwxr-xr-x 1 root root  934024  7. Nov 19:21 shim.efi

So, ok, there is no “shimx86.efi”, but shim.efi exist - and after all, it is a AMD64 system.

Any idea what might be the problem here and how to fix it?
Thanks for your input!

2

Addition:
The link leads to this suggestion

Set the ESP flag using parted /dev/nvme0nXXX set 1 esp on where /dev/nvme0nXXX is the device node that corresponds to the ESP partition – then retry the update.

When I try that, I get

linux:/home/christian # parted /dev/nvme0n1p1 set 1 esp on
Fehler: Keine Unterstützung für Flags

Error: No support for flags :confused:

3

I’m not sure that I understand the problem.

OpenSUSE installs “shim” as “shim.efi”, not as “shimx86.efi”. If you have “shim.efi” you could try copying that to “shimx86.efi” to see whether that helps.

4

Please, do not translate computer messages. Instead, make output in English and post here in English. Or post in corresponding language subforum.

Anyway

fwupd developer says it is not a bug.

Lenovo T470s - “Secure boot is enabled, but shim isn’t installed to the EFI system partition” · Issue #2084 · fwupd/fwupd · GitHub

You may consider submitting openSUSE bug report, because it is more or less integration issue beyond the scope of fwupd. Copying shim.efi to shimx64.efi does provide a workaround.

It is shimx64.efi.

5

First of all, thank you two for your replies, really appreciate it!

I am sure, that I don’t understand the problem… When everything is working with secure boot and UEFI the way it is installed by openSUSE, then why does fwupdmgr insist, that the .efi file has this very specific name?

Sorry, if I had known how to do that, I would have done.
My systems language is German as you can see, but still partly the messages are in english anyway. I just wanted to post it quickly, sorry.
Next time I will look up how to make the shell output english text before posting.

Strange enough, that it is marked as a problem then by fwupdmgr and it does not continue the update…
I had read that thread too, but I would have expected that when it was reported back in 2020, that either the fwupdmgr developers would have made it look for shim.efi or the distributions would use the naming of shimx64.efi that fwupdmgr looks for, by now.
But the way it looks, it has not been solved and users like me still get that error message and wonder what might be the problem…

I will try that as a quick fix, thanks.

Thanks for the suggestion, I will do that. Already have an account for the bugtracker.

Your are absolutely right, my mistake. Guess I was a little tired already and wanted to finish the post…

Thanks again!

6

I reported this as 1217138 – fwupdmgr update fails: Secure boot is enabled, but shim isn't installed to EFI/opensuse/shimx64.efi .

1 Like
7

Thanks a lot, robert.
I added my output to the ticket and am on CC now.