I tried to do a firmware update on a ThinkPad L14 using fwupdmgr on Fedora 34. Everything seemed fine until the program told me to reboot, which I did, but Fedora was booted instead of the firmware updater. I tried changing the boot order manually, removing an unused Windows boot entry with efibootmgr and various combinations of BIOS settings about when and how to allow firmware updates, but nothing worked. Finally, I found out that when disabling Secure Boot, the updater starts and the update completes successfully. Afterwards, I could reenable Secure Boot and my OS booted normally. Also, fwupdmgr says that the update was successfully installed.

Well, it seems like my problem is solved, but I would like to know why the solution worked. I thought the shim bootloader would not only boot the OS but also the updater and because shim is signed by Microsoft, there should be no problem with having Secure Boot enabled.

In case more information is needed to find the solution, please tell me in a comment and I will add it. I do not know a lot about firmware updates and thus can hardly tell what would be required.

  • 1
    Sounds like only Fedora supports Secure Boot. It’s not that usual that fwupdmgr wouldn’t
    – Ramhound
    Jul 26, 2021 at 12:25
  • @Ramhound Does that mean that shim only boots grub which boots Fedora? I am a little confused about this, because this site says that in principle shim can boot fwupdx64.efi and normally Fedora includes the latest software, so this is not likely to be an issue with an old version.
    – nu.
    Jul 26, 2021 at 13:51

1 Answer 1


if you decline the fwupdmgr request for an immediate reboot, and run efibootmgr first, you'll notice that fwupdmgr created a new boot entry to run on next boot. On my fedora34, this looks like:

❯ efibootmgr -v
BootCurrent: 0002
Timeout: 0 seconds
BootOrder: 0001,0000,0019,001A,001B,001C,001D,001E,001F,0020,0021,0022,0023,0024,0002
Boot0000* ...
Boot0001* Fedora        HD(1,GPT,2a6909b8-0af2-4faf-96c6-6ff0ad9881a6,0x800,0x12c000)/File(\EFI\fedora\shimx64.efi)
Boot0002* Linux-Firmware-Updater        HD(1,GPT,2a6909b8-0af2-4faf-96c6-6ff0ad9881a6,0x800,0x12c000)/File(\EFI\fedora\shimx64.efi)\.f.w.u.p.d.x.6.4...e.f.i...

However there currently seems to be a bug in shim, which prevents it from running the fwupdx64.efi binary, instead it just drops though to grub:

  • I already noticed the new boot entry, but like stated in the bug report, it would not actually boot, so thank's for pointing me there. By the way, is it normal that the Linux-Firmware-Updater-entry persists after the update completed successfully or is this caused by it failing before?
    – nu.
    Aug 5, 2021 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.