Arch Linux

miguel375

Member

Registered: 2024-07-12

Posts: 18

System "not booted in UEFI mode" in Setup mode (secure boot setup)

I'm trying to setup secure boot on my laptop (Lenovo Yoga Slim 7i, Intel Core Ultra Lunar Lake) using sbctl.

If I run "sbctl status" when secure boot is off and not in setup mode, it correctly reports that the system is booted in UEFI mode. However, when I reboot and enter setup mode, sbctl now claims the system is not booted into UEFI mode at all, and I cannot continue the process.
This likely isn't an issue with sbctl specifically, because bootctl/systemd also report the same, so I'm assuming it's a firmware issue. I've already updated the firmware to the latest version.

Has anyone had luck setting up secure boot in these or similar laptops?

-thc

Member

Registered: 2017-03-15

Posts: 1,215

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

AFAIK the "setup mode" for "Secure Boot" is only entered to replace the "Platform Key" (PK).
As soon as the new PK is in place the system is in "User mode".

Some UEFI firmware implementations allow the exchange of the PK only inside the EFI setup itself - do you have such an option?

miguel375

Member

Registered: 2024-07-12

Posts: 18

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

AFAIK the "setup mode" for "Secure Boot" is only entered to replace the "Platform Key" (PK).
As soon as the new PK is in place the system is in "User mode".

Some UEFI firmware implementations allow the exchange of the PK only inside the EFI setup itself - do you have such an option?

There's no option for setting a key in the UEFI settings unfortunately, so there's no way for me to change the PK.
The only secure boot related options I have are for toggling secure boot, resetting the keys, entering setup mode and toggling 3rd party keys (which I've tried).

-thc

Member

Registered: 2017-03-15

Posts: 1,215

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

Unfortunately my preferred way of changing keys (via EFI firmware built-in EFI shell and the "efitools" binary "KeyTool.efi") no longer works out of the box - the maintainers have removed the ".efi" binaries from the "efitools" package.

You can however extract it from the older efitools package (1.9.2-5) via the Arch archive (https://archive.archlinux.org/packages/e/efitools/) - but I never tried if it still works.

miguel375

Member

Registered: 2024-07-12

Posts: 18

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

Unfortunately my preferred way of changing keys (via EFI firmware built-in EFI shell and the "efitools" binary "KeyTool.efi") no longer works out of the box - the maintainers have removed the ".efi" binaries from the "efitools" package.

You can however extract it from the older efitools package (1.9.2-5) via the Arch archive (https://archive.archlinux.org/packages/e/efitools/) - but I never tried if it still works.

Booting into KeyTool.efi in setup mode shows "Setup mode enabled" at the top and I have the option to replace the keys, so it might work. I've never set up secure boot manually though, I'll have to look into it.

faradaylenz

Member

Registered: Yesterday

Posts: 1

Re: System "not booted in UEFI mode" in Setup mode (secure boot setup)

Hello, did you manage to find a solution to this problem?

I can reproduce what seems to be the same issue on my newly bought Lenovo Yoga Slim 7 14ILL10 (Intel Core Ultra 5 226V, Lunar Lake), BIOS version QSCN34WW (the version on the Lenovo website is outdated, QSCN33WW).

With Secure Boot disabled, the firmware not in Setup Mode, and the default keys (without Microsoft 3rd party CA), sbctl correctly detects that the system was booted in UEFI mode. However, after switching the firmware to Setup Mode, both bootctl and sbctl report that the system was not booted in EFI mode. Interestingly, many EFI variables are missing (like BootOrder, SecureBoot, SetupMode etc.), while some other are visible.

I also tried enrolling the Secure Boot keys manually (both through KeyTool.efi and the automatic systemd-boot enrollment), and secure boot correctly works, but the sbctl and bootctl still report that the system was not booted in EFI mode. I also tried to go into Setup Mode while retaining the default dbx keys, as suggested in a Framework Laptop forum by users with the same problem, but the problem persists (see https://community.frame.work/t/putting- … ls/62033/3).

Has anyone with this model or a similar Lenovo Lunar Lake laptop found a workaround? I'd be interested to know whether this is a known firmware issue and whether there is a reliable way to enroll custom Secure Boot keys. I could manually enroll them (as stated above), but I don't like the fact that the system thinks that I am not in UEFI mode.

EDIT: I have also posted on the Lenovo forums about this problem, link here: https://forums.lenovo.com/t5/Lenovo-Yog … p/10049470.

Last edited by faradaylenz (Yesterday 12:20:22)