FW13 Ryzen AI 370: UEFI setup hangs when enrolling Secure Boot certificate

[scheduler-v1]

Device Information

System Model or SKU

• Framework Laptop 13 (AMD Ryzen™ AI 300 Series)

BIOS VERSION

LFK30.04.02

DIY Edition information

Memory: 2x Crucial CT32G56C46S5
Storage: 1x Crucial CT1000P3PSSD8

Standalone Operation (Laptop Only)

Are you running your mainboard as a standalone device. Is standalone mode enabled in the BIOS?

• Yes
• No

Describe the bug

When I select Enroll Signature in the Secure Boot DB Options of the UEFI user interface, the laptop hangs (the time at the top doesn't advance), gets hot and spins the fans up. The same happens with Enroll PK in the PK Options.

Steps To Reproduce

Steps to reproduce the behavior:

1. Press F2 and start the laptop to enter UEFI setup.
2. Select Administer Secure Boot.
3. Select DB Options.
4. Select Enroll Signature.
5. The laptop hangs, gets hot and spins the fans up.

Expected behavior

I select Enroll Signature and browse an external storage medium to select my Secure Boot certificate that I use to sign my boot loader and unified kernel image. The boot loader and kernel should then be bootable with Secure Boot enabled.

Operating System (please complete the following information):

• OS/Distribution: Void Linux, but the bug also happens without anything installed.
• Version: Rolling release
• Linux Kernel Version: 6.18.44

Additional context

Most people probably enroll their Secure Boot certificates using sbctl or efitools. The UEFI specification requires the firmware to be put into Setup Mode before the Signature Database (DB) can be modified. In order to put the firmware into Setup Mode, I need to remove the Platform Key (PK). The idea was, if I could avoid this and directly enroll my certificate using the UEFI setup without modifying any already enrolled certificates, it would simplify the process. Then I ran into the described problem.

• I tried wiping the SSD; didn't work.
• I thought maybe the memory controller on the SSD might be the issue, so I took it out; didn't work.
• I had previously removed a stale Windows boot entry from the previous owner of the laptop using efibootmgr and I thought maybe the gap in boot entry numbers is a problem and the firmware gets into an infinite loop (and thus the laptop gets hot) because it expects the boot entry numbers to always increment by one, so I reflashed the firmware and loaded optimal defaults; didn't work.

At this point, I am out of things to try. The bug might be related to #233 but I'm not sure.