Set the record straight

2 files changed, 40 insertions, 7 deletions

diff --git a/guides/sysadmin/machines/amdahl30/killing-time.org b/guides/sysadmin/machines/amdahl30/killing-time.org
index 8745932..e4ef53d 100644
--- a/guides/sysadmin/machines/amdahl30/killing-time.org
+++ b/guides/sysadmin/machines/amdahl30/killing-time.org
@@ -218,8 +218,8 @@ that.  The =amd_pstate= warning is back; the "Power Profile" slider is
 no longer accessible in the systray widget; no discernible effect
 in-game anyway.
 ** Addendum Ⅱ — BIOS update
-For the modest price of [[file:maintenance.org::*Our protagonist sets forth][breaking Secure Boot]], the =amd_pstate= driver
-now manages to initialize successfully without me having to mess with
+For the modest price of [[file:maintenance.org::*Our protagonist sets forth][a BIOS update]], the =amd_pstate= driver now
+initializes successfully without me having to mess with
 {{{glitch(Overclocking Settings)}}}.  Welcome back =amd_pstate= 🤝
 * Sᴇᴠᴇʀᴀʟ Wᴇᴇᴋꜱ Lᴀᴛᴇʀ
 - [[https://www.gamingonlinux.com/forum/topic/5475/page=1/][ridge reports]] "bad frame pacing on ADMGPU",
@@ -343,9 +343,8 @@ clang-devel python3-ply rust rust-bindgen rust-cbindgen~.
 
 - (FTR: chronologically, this is the point where I caved—not sure why,
   I think seeing the amount of unhappy kernel noises in journalctl got
-  to me—and grabbed the latest BIOS from msi.com, flashed it, breaking
-  Secure Boot & restoring =amd_pstate= 🤷 see addendum Ⅱ in the
-  previous section)
+  to me—and grabbed the latest BIOS from msi.com, flashed it,
+  restoring =amd_pstate=.  See addendum Ⅱ in the previous section)
 * This is insane
 Selected subset of moving parts; "testability" considering ease of
 clean reverts:
diff --git a/guides/sysadmin/machines/amdahl30/maintenance.org b/guides/sysadmin/machines/amdahl30/maintenance.org
index 7546447..18a30dc 100644
--- a/guides/sysadmin/machines/amdahl30/maintenance.org
+++ b/guides/sysadmin/machines/amdahl30/maintenance.org
@@ -146,8 +146,42 @@ Off the top of my head:
 - that dbx update?
 - ~sudo blarney-grub2 --pretty -pls --with-sugar=top --with-sugar=top~?
 - dracut?
+
+dbx update: nope.
+
+~efibootmgr~ only shows =opensuse=, not =opensuse-secure=.
+- After ~udpate-bootloader --install~, =opensuse-secure= shows up; no
+  change though, enabling Secure Boot still lands me in =grub rescue=.
+- Change bootorder with =-o 0,1=?
+
+  #+begin_example
+  $ sudo udpate-bootloader --install
+  $ sudo efibootmgr
+  BootCurrent: 0001
+  Timeout: 1 seconds
+  BootOrder: 0001,0000
+  Boot0000* opensuse-secureboot   HD(1,GPT,2ffd6bee-1b1e-4088-8fdf-0c9321c861a3,0x800,0x100000)/File(\EFI\OPENSUSE\SHIM.EFI)
+  Boot0001* opensuse      HD(1,GPT,2ffd6bee-1b1e-4088-8fdf-0c9321c861a3,0x800,0x100000)/File(\EFI\OPENSUSE\GRUBX64.EFI)0000424f
+  $ sudo efibootmgr -o 0,1
+  BootCurrent: 0001
+  Timeout: 1 seconds
+  BootOrder: 0000,0001
+  Boot0000* opensuse-secureboot   HD(1,GPT,2ffd6bee-1b1e-4088-8fdf-0c9321c861a3,0x800,0x100000)/File(\EFI\OPENSUSE\SHIM.EFI)
+  Boot0001* opensuse      HD(1,GPT,2ffd6bee-1b1e-4088-8fdf-0c9321c861a3,0x800,0x100000)/File(\EFI\OPENSUSE\GRUBX64.EFI)0000424f
+  #+end_example
+
+  Does not seem to persist after reboot 🤷
+*** The Twist
+#+begin_example
+$ sudo journalctl --grep 'secure boot .*abled'
+Nov 28 20:37:13 localhost kernel: secureboot: Secure boot disabled
+[… an so on, for every boot until today …]
+#+end_example
+
+… I'm an idiot; I never had Secure Boot enabled on that machine,
+apparently.  I guess the BIOS update just turned it on silently.
 * SSD
 LDLC's off-brand SSD died, fortunately within the warranty period.
 Replaced it, and… I guess I should shoehorn a joke about "a descent
-into hell" or "the beginning of a nightmare", but that just twists [[./killing-time.org][the
-knife]] ☹️
+into hell" or "the beginning of a nightmare", but that just twists
+[[./killing-time.org][the knife]] ☹️