Merge ~corey.bryant/ubuntu/+source/ironic:master into ~ubuntu-openstack-dev/ubuntu/+source/ironic:master

[Corey Bryant]

New upstream snapshot for OpenStack Bobcat.

This is an automated merge proposal.

66433f8... by Corey Bryant on 2023-10-04

New upstream version 23.0.0

1a2385d... by Corey Bryant on 2023-10-04

Merge tag '23.0.0'

Upstream version 23.0.0

a65cc36... by Corey Bryant on 2023-10-04

New upstream release for OpenStack Bobcat.

ac0de27... by Corey Bryant on 2023-10-04

d/control: Align (Build-)Depends with upstream.

109e412... by Corey Bryant on 2023-10-04

releasing package ironic version 1:23.0.0-0ubuntu1

[Corey Bryant (corey.bryant)]

Superseded by https://code.launchpad.net/~corey.bryant/ubuntu/+source/ironic/+git/ironic/+merge/452823

Unmerged commits

109e412... by Corey Bryant on 2023-10-04

releasing package ironic version 1:23.0.0-0ubuntu1

	ubuntu-build:0 (build)
	ubuntu-autopkgtest:0 (build)
	cloud-archive-build:0 (build)
	cloud-archive-autopkgtest:0 (build)

1 → 4 of 4 results

First • Previous • Next • Last

ac0de27... by Corey Bryant on 2023-10-04

d/control: Align (Build-)Depends with upstream.

a65cc36... by Corey Bryant on 2023-10-04

New upstream release for OpenStack Bobcat.

1a2385d... by Corey Bryant on 2023-10-04

Merge tag '23.0.0'

Upstream version 23.0.0

66433f8... by Corey Bryant on 2023-10-04

New upstream version 23.0.0

diff --git a/ChangeLog b/ChangeLog
index f4e38ca..4f21043 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,26 @@
 CHANGES
 =======
 
+23.0.0
+------
+
+* RedfishFirmware Interface
+* inspect\_utils, handle bracketed IPv6 redfish addr
+* Trivial: attach versions to release series
+* redfish\_address - wrap\_ipv6 address
+* Remove most prints for unit tests
+* [releasenotes] Prelude for 2023.2/bobcat
+* devstack - configurable ipv6 address mode
+* Redfish: wait for secure boot state change if it's not immediate
+* CI: Remove ubuntu focal job
+* Fix two places that can cause issues under SQLite
 * [CI] Unblock CI by fixing job regex and non-voting snmp
+* Update proliantutils driver requirements for bobcat
+* DB: Only re-query for a lock holder if we cannot lock
 * Add service steps and initial docs
 * Log an exception from heartbeat
 * log the version of the conductor starting
+* PXE: Remove DHCP option 210 from being set
 * Fully monkey patch eventlet for consistent behavior
 * Add missing release mappings for 22.0 and 22.1
 * Correct bindep.txt entries for bookworm
@@ -33,6 +49,7 @@ CHANGES
 * Support sha256/sha512 with the ilo firmware upgrade logic
 * tox: Remove basepython
 * Fix typo in deploy\_templates docs
+* Fix minor grammar issues in the help for new inspector options
 * Add python3.10 support in testing runtime
 * DB: Select upon delete for allocations
 * DB: Streamline allocation interactions
diff --git a/PKG-INFO b/PKG-INFO
index d87c849..b71bd51 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,11 +1,53 @@
 Metadata-Version: 2.1
 Name: ironic
-Version: 22.1.1.dev36
+Version: 23.0.0
 Summary: OpenStack Bare Metal Provisioning
 Home-page: https://docs.openstack.org/ironic/latest/
 Author: OpenStack
 Author-email: [e-mail]
 License: UNKNOWN
+Description: ======
+        Ironic
+        ======
+        
+        Team and repository tags
+        ------------------------
+        
+        .. image:: https://governance.openstack.org/tc/badges/ironic.svg
+            :target: https://governance.openstack.org/tc/reference/tags/index.html
+        
+        Overview
+        --------
+        
+        Ironic consists of an API and plug-ins for managing and provisioning
+        physical machines in a security-aware and fault-tolerant manner. It can be
+        used with nova as a hypervisor driver, or standalone service using bifrost.
+        By default, it will use PXE and IPMI to interact with bare metal machines.
+        Ironic also supports vendor-specific plug-ins which may implement additional
+        functionality.
+        
+        Ironic is distributed under the terms of the Apache License, Version 2.0. The
+        full terms and conditions of this license are detailed in the LICENSE file.
+        
+        Project resources
+        ~~~~~~~~~~~~~~~~~
+        
+        * Documentation: https://docs.openstack.org/ironic/latest
+        * Source: https://opendev.org/openstack/ironic
+        * Bugs: https://bugs.launchpad.net/ironic/+bugs
+        * Wiki: https://wiki.openstack.org/wiki/Ironic
+        * APIs: https://docs.openstack.org/api-ref/baremetal/index.html
+        * Release Notes: https://docs.openstack.org/releasenotes/ironic/
+        * Design Specifications: https://specs.openstack.org/openstack/ironic-specs/
+        
+        Project status, bugs, and requests for feature enhancements (RFEs) are tracked
+        in StoryBoard:
+        https://storyboard.openstack.org/#!/project/943
+        
+        For information on how to contribute to ironic, see
+        https://docs.openstack.org/ironic/latest/contributor
+        
+        
 Platform: UNKNOWN
 Classifier: Environment :: OpenStack
 Classifier: Intended Audience :: Information Technology
@@ -23,48 +65,3 @@ Provides-Extra: devstack
 Provides-Extra: guru_meditation_reports
 Provides-Extra: i18n
 Provides-Extra: test
-License-File: LICENSE
-
-======
-Ironic
-======
-
-Team and repository tags
-------------------------
-
-.. image:: https://governance.openstack.org/tc/badges/ironic.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-Overview
---------
-
-Ironic consists of an API and plug-ins for managing and provisioning
-physical machines in a security-aware and fault-tolerant manner. It can be
-used with nova as a hypervisor driver, or standalone service using bifrost.
-By default, it will use PXE and IPMI to interact with bare metal machines.
-Ironic also supports vendor-specific plug-ins which may implement additional
-functionality.
-
-Ironic is distributed under the terms of the Apache License, Version 2.0. The
-full terms and conditions of this license are detailed in the LICENSE file.
-
-Project resources
-~~~~~~~~~~~~~~~~~
-
-* Documentation: https://docs.openstack.org/ironic/latest
-* Source: https://opendev.org/openstack/ironic
-* Bugs: https://bugs.launchpad.net/ironic/+bugs
-* Wiki: https://wiki.openstack.org/wiki/Ironic
-* APIs: https://docs.openstack.org/api-ref/baremetal/index.html
-* Release Notes: https://docs.openstack.org/releasenotes/ironic/
-* Design Specifications: https://specs.openstack.org/openstack/ironic-specs/
-
-Project status, bugs, and requests for feature enhancements (RFEs) are tracked
-in StoryBoard:
-https://storyboard.openstack.org/#!/project/943
-
-For information on how to contribute to ironic, see
-https://docs.openstack.org/ironic/latest/contributor
-
-
-
diff --git a/api-ref/source/baremetal-api-v1-node-management.inc b/api-ref/source/baremetal-api-v1-node-management.inc
index 6ff275e..4d9bdaa 100644
--- a/api-ref/source/baremetal-api-v1-node-management.inc
+++ b/api-ref/source/baremetal-api-v1-node-management.inc
@@ -306,6 +306,10 @@ Change Node Boot Mode
 
 Request a change to the Node's boot mode.
 
+.. note::
+   Depending on the driver and the underlying hardware, changing boot mode may
+   result in an automatic reboot.
+
 .. versionadded:: 1.76
    A change in node's boot mode can be requested.
 
@@ -341,6 +345,10 @@ Change Node Secure Boot
 
 Request a change to the Node's secure boot state.
 
+.. note::
+   Depending on the driver and the underlying hardware, changing the secure
+   boot state may result in an automatic reboot.
+
 .. versionadded:: 1.76
    A change in node's secure boot state can be requested.
 
diff --git a/api-ref/source/baremetal-api-v1-nodes-firmware.inc b/api-ref/source/baremetal-api-v1-nodes-firmware.inc
index ed17e0b..15ea992 100644
--- a/api-ref/source/baremetal-api-v1-nodes-firmware.inc
+++ b/api-ref/source/baremetal-api-v1-nodes-firmware.inc
@@ -4,7 +4,7 @@
 Node Firmware (nodes)
 =====================
 
-.. versionadded:: 1.84
+.. versionadded:: 1.86
 
 Given a Node identifier (``uuid`` or ``name``), the API exposes the list of
 all Firmware Components associated with that Node.
diff --git a/debian/changelog b/debian/changelog
index 105559b..1783bf3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,10 @@
-ironic (1:22.1.0+git2023090714.985c7fdf-0ubuntu2) UNRELEASED; urgency=medium
+ironic (1:23.0.0-0ubuntu1) mantic; urgency=medium
 
   * d/watch: Drop major version.
+  * New upstream release for OpenStack Bobcat.
+  * d/control: Align (Build-)Depends with upstream.
 
- -- Corey Bryant <[e-mail]>  Wed, 04 Oct 2023 10:21:10 -0400
+ -- Corey Bryant <[e-mail]>  Wed, 04 Oct 2023 10:27:14 -0400
 
 ironic (1:22.1.0+git2023090714.985c7fdf-0ubuntu1) mantic; urgency=medium
 
diff --git a/debian/control b/debian/control
index a66689c..1cfb645 100644
--- a/debian/control
+++ b/debian/control
@@ -11,6 +11,21 @@ Build-Depends:
  python3-setuptools,
  python3-sphinx (>= 2.0.0),
 Build-Depends-Indep:
+*** new test-requirements.txt deps (start)
+ NOT_FOUND(pyasn1-lextudio)>=1.1.0,
+ NOT_FOUND(pyasn1-modules-lextudio)>=0.2.0,
+ NOT_FOUND(pysnmp-lextudio)>=5.0.0,
+*** new test-requirements.txt deps (end) ***
+*** new driver-requirements.txt deps (start)
+ NOT_FOUND(pyasn1-lextudio)>=1.1.0,
+ NOT_FOUND(pyasn1-modules-lextudio)>=0.2.0,
+ NOT_FOUND(pysnmp-lextudio)>=5.0.0,
+*** new driver-requirements.txt deps (end) ***
+*** new doc/requirements.txt deps (start)
+ NOT_FOUND(pyasn1-lextudio)>=1.1.0,
+ NOT_FOUND(pyasn1-modules-lextudio)>=0.2.0,
+ NOT_FOUND(pysnmp-lextudio)>=5.0.0,
+*** new doc/requirements.txt deps (end) ***
  alembic (>= 0.9.6),
  crudini,
  python3-alembic (>= 1.4.2),
diff --git a/devstack/lib/ironic b/devstack/lib/ironic
index 882b5f6..ffd6601 100644
--- a/devstack/lib/ironic
+++ b/devstack/lib/ironic
@@ -382,6 +382,7 @@ IRONIC_UWSGI=$IRONIC_BIN_DIR/ironic-api-wsgi
 
 # Lets support IPv6 testing!
 IRONIC_IP_VERSION=${IRONIC_IP_VERSION:-${IP_VERSION:-4}}
+IRONIC_IPV6_ADDRESS_MODE=${IRONIC_IPV6_ADDRESS_MODE:-dhcpv6-stateless}
 
 # Ironic connection info.  Note the port must be specified.
 if is_service_enabled tls-proxy; then
@@ -1424,11 +1425,9 @@ function configure_ironic_provision_network {
                 --subnet-range $IRONIC_PROVISION_SUBNET_PREFIX \
                 --dns-nameserver 8.8.8.8 -f value -c id)"
         else
-            # NOTE(TheJulia): Consider changing this to stateful to support UEFI once we move
-            # CI to Ubuntu Jammy as it will support v6 and v4 UEFI firmware driven boot ops.
             subnet_id="$(openstack --os-cloud $OS_CLOUD subnet create --ip-version 6 \
-                --ipv6-address-mode dhcpv6-stateless \
-                --ipv6-ra-mode dhcpv6-stateless \
+                --ipv6-address-mode $IRONIC_IPV6_ADDRESS_MODE \
+                --ipv6-ra-mode $IRONIC_IPV6_ADDRESS_MODE \
                 --dns-nameserver 2001:4860:4860::8888 \
                 ${net_segment_id:+--network-segment $net_segment_id} \
                 $IRONIC_PROVISION_PROVIDER_SUBNET_NAME \
diff --git a/doc/source/admin/drivers/redfish.rst b/doc/source/admin/drivers/redfish.rst
index 6628f48..c4694b8 100644
--- a/doc/source/admin/drivers/redfish.rst
+++ b/doc/source/admin/drivers/redfish.rst
@@ -140,6 +140,22 @@ Two clean and deploy steps are provided for key management:
 ``management.clear_secure_boot_keys``
     removes all secure boot keys from the node.
 
+Rebooting on boot mode changes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+While some hardware is able to change the boot mode or the `UEFI secure boot`_
+state immediately, other models may require a reboot for such a change to be
+applied. Furthermore, some hardware models cannot change the boot mode and the
+secure boot state simultaneously, requiring several reboots.
+
+The Bare Metal service refreshes the System resource after issuing a PATCH
+request against it. If the expected change is not observed, the node is
+rebooted, and the Bare Metal service waits until the change is applied. In the
+end, the previous power state is restored.
+
+This logic makes changing boot configuration more robust at the expense of
+several reboots in the worst case.
+
 Out-Of-Band inspection
 ======================
 
diff --git a/doc/source/contributor/webapi-version-history.rst b/doc/source/contributor/webapi-version-history.rst
index efd34d7..e2f0a73 100644
--- a/doc/source/contributor/webapi-version-history.rst
+++ b/doc/source/contributor/webapi-version-history.rst
@@ -15,8 +15,8 @@ based resources, which indicates the current step.
 
 Adds a ``firmware_interface`` field to the ``/v1/nodes`` resources.
 
-1.85 (Bobcat)
--------------
+1.85 (Bobcat, 22.1)
+-------------------
 
 This version adds a new provision state change verb called ``unhold``
 to be utilized with the new ``provision_state`` values ``clean hold``
@@ -24,14 +24,14 @@ and ``deploy hold``. The verb instructs Ironic to remove the node
 from it's present hold and to resume it's prior cleaning or
 deployment process.
 
-1.84 (Bobcat)
--------------
+1.84 (Bobcat, 22.1)
+-------------------
 
 Add callback endpoint for in-band inspection ``/v1/continue_inspection``.
 This endpoint is not designed to be used by regular users.
 
-1.83 (Bobcat)
--------------
+1.83 (Bobcat, 22.0)
+-------------------
 
 This version adds a concept of child nodes through the use of a
 ``parent_node`` field which can be set on a node.
@@ -51,8 +51,8 @@ Additionally:
 - Adds ``GET /v1/nodes?parent_node={node_ident}`` to explicitly request
   a detailed list of nodes by parent relationship.
 
-1.82 (Antelope)
-----------------------
+1.82 (Antelope, 21.4)
+---------------------
 
 This version signifies the addition of node sharding endpoints.
 
@@ -60,8 +60,8 @@ This version signifies the addition of node sharding endpoints.
 - Adds support for ``GET /v1/shards`` which returns a list of all shards and
   the count of nodes assigned to each.
 
-1.81 (Antelope)
-----------------------
+1.81 (Antelope, 21.3)
+---------------------
 
 Add endpoint to retrieve introspection data for nodes via the REST API.
 
diff --git a/driver-requirements.txt b/driver-requirements.txt
index a26c3cf..b0852d0 100644
--- a/driver-requirements.txt
+++ b/driver-requirements.txt
@@ -4,7 +4,7 @@
 # python projects they should package as optional dependencies for Ironic.
 
 # These are available on pypi
-proliantutils>=2.14.0
+proliantutils>=2.16.0
 pysnmp-lextudio>=5.0.0 # BSD
 pyasn1-lextudio>=1.1.0 # BSD
 pyasn1-modules-lextudio>=0.2.0 # BSD
diff --git a/ironic.egg-info/PKG-INFO b/ironic.egg-info/PKG-INFO
index d87c849..b71bd51 100644
--- a/ironic.egg-info/PKG-INFO
+++ b/ironic.egg-info/PKG-INFO
@@ -1,11 +1,53 @@
 Metadata-Version: 2.1
 Name: ironic
-Version: 22.1.1.dev36
+Version: 23.0.0
 Summary: OpenStack Bare Metal Provisioning
 Home-page: https://docs.openstack.org/ironic/latest/
 Author: OpenStack
 Author-email: [e-mail]
 License: UNKNOWN
+Description: ======
+        Ironic
+        ======
+        
+        Team and repository tags
+        ------------------------
+        
+        .. image:: https://governance.openstack.org/tc/badges/ironic.svg
+            :target: https://governance.openstack.org/tc/reference/tags/index.html
+        
+        Overview
+        --------
+        
+        Ironic consists of an API and plug-ins for managing and provisioning
+        physical machines in a security-aware and fault-tolerant manner. It can be
+        used with nova as a hypervisor driver, or standalone service using bifrost.
+        By default, it will use PXE and IPMI to interact with bare metal machines.
+        Ironic also supports vendor-specific plug-ins which may implement additional
+        functionality.
+        
+        Ironic is distributed under the terms of the Apache License, Version 2.0. The
+        full terms and conditions of this license are detailed in the LICENSE file.
+        
+        Project resources
+        ~~~~~~~~~~~~~~~~~
+        
+        * Documentation: https://docs.openstack.org/ironic/latest
+        * Source: https://opendev.org/openstack/ironic
+        * Bugs: https://bugs.launchpad.net/ironic/+bugs
+        * Wiki: https://wiki.openstack.org/wiki/Ironic
+        * APIs: https://docs.openstack.org/api-ref/baremetal/index.html
+        * Release Notes: https://docs.openstack.org/releasenotes/ironic/
+        * Design Specifications: https://specs.openstack.org/openstack/ironic-specs/
+        
+        Project status, bugs, and requests for feature enhancements (RFEs) are tracked
+        in StoryBoard:
+        https://storyboard.openstack.org/#!/project/943
+        
+        For information on how to contribute to ironic, see
+        https://docs.openstack.org/ironic/latest/contributor
+        
+        
 Platform: UNKNOWN
 Classifier: Environment :: OpenStack
 Classifier: Intended Audience :: Information Technology
@@ -23,48 +65,3 @@ Provides-Extra: devstack
 Provides-Extra: guru_meditation_reports
 Provides-Extra: i18n
 Provides-Extra: test
-License-File: LICENSE
-
-======
-Ironic
-======
-
-Team and repository tags
-------------------------
-
-.. image:: https://governance.openstack.org/tc/badges/ironic.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-Overview
---------
-
-Ironic consists of an API and plug-ins for managing and provisioning
-physical machines in a security-aware and fault-tolerant manner. It can be
-used with nova as a hypervisor driver, or standalone service using bifrost.
-By default, it will use PXE and IPMI to interact with bare metal machines.
-Ironic also supports vendor-specific plug-ins which may implement additional
-functionality.
-
-Ironic is distributed under the terms of the Apache License, Version 2.0. The
-full terms and conditions of this license are detailed in the LICENSE file.
-
-Project resources
-~~~~~~~~~~~~~~~~~
-
-* Documentation: https://docs.openstack.org/ironic/latest
-* Source: https://opendev.org/openstack/ironic
-* Bugs: https://bugs.launchpad.net/ironic/+bugs
-* Wiki: https://wiki.openstack.org/wiki/Ironic
-* APIs: https://docs.openstack.org/api-ref/baremetal/index.html
-* Release Notes: https://docs.openstack.org/releasenotes/ironic/
-* Design Specifications: https://specs.openstack.org/openstack/ironic-specs/
-
-Project status, bugs, and requests for feature enhancements (RFEs) are tracked
-in StoryBoard:
-https://storyboard.openstack.org/#!/project/943
-
-For information on how to contribute to ironic, see
-https://docs.openstack.org/ironic/latest/contributor
-
-
-
diff --git a/ironic.egg-info/SOURCES.txt b/ironic.egg-info/SOURCES.txt
index e1d1e3c..7da3f81 100644
--- a/ironic.egg-info/SOURCES.txt
+++ b/ironic.egg-info/SOURCES.txt
@@ -695,6 +695,7 @@ ironic/drivers/modules/network/noop.py
 ironic/drivers/modules/redfish/__init__.py
 ironic/drivers/modules/redfish/bios.py
 ironic/drivers/modules/redfish/boot.py
+ironic/drivers/modules/redfish/firmware.py
 ironic/drivers/modules/redfish/firmware_utils.py
 ironic/drivers/modules/redfish/inspect.py
 ironic/drivers/modules/redfish/management.py
@@ -975,6 +976,7 @@ ironic/tests/unit/drivers/modules/network/json_samples/network_data.json
 ironic/tests/unit/drivers/modules/redfish/__init__.py
 ironic/tests/unit/drivers/modules/redfish/test_bios.py
 ironic/tests/unit/drivers/modules/redfish/test_boot.py
+ironic/tests/unit/drivers/modules/redfish/test_firmware.py
 ironic/tests/unit/drivers/modules/redfish/test_firmware_utils.py
 ironic/tests/unit/drivers/modules/redfish/test_inspect.py
 ironic/tests/unit/drivers/modules/redfish/test_management.py
@@ -1021,6 +1023,7 @@ releasenotes/config.yaml
 releasenotes/notes/.placeholder
 releasenotes/notes/18.2-prelude-3c8609692bab70a3.yaml
 releasenotes/notes/20.1-prelude-612672742f417477.yaml
+releasenotes/notes/23.0-prelude-bobcat-ad7c24f666c22ebf.yaml
 releasenotes/notes/5.0-release-afb1fbbe595b6bc8.yaml
 releasenotes/notes/Add-port-option-support-to-ipmitool-e125d07fe13c53e7.yaml
 releasenotes/notes/Cleanfail-power-off-13b5fdcc2727866a.yaml
@@ -1265,6 +1268,7 @@ releasenotes/notes/bug-2007963-idrac-wsman-raid-apply-configuration-792ccf195057
 releasenotes/notes/bug-2008058-fix-factory-reset-status.yaml-52a6119b46e33b37.yaml
 releasenotes/notes/bug-2009762-403eac24c4823d2d.yaml
 releasenotes/notes/bug-2010613-3ab1f32aaa776f28.yaml
+releasenotes/notes/bug-2036455-edd0e97335579684.yaml
 releasenotes/notes/bug-30315-e46eafe5b575f3da.yaml
 releasenotes/notes/bug-30316-8c53358681e464eb.yaml
 releasenotes/notes/bug-30317-a972c8d879c98941.yaml
@@ -1453,6 +1457,7 @@ releasenotes/notes/fast-track-with-cleaning-438225116a11662d.yaml
 releasenotes/notes/fifteen-0da3cca48dceab8b.yaml
 releasenotes/notes/file-name-too-long-72265bb3fec704f8.yaml
 releasenotes/notes/fips-hashlib-bca9beacc2b48fe7.yaml
+releasenotes/notes/firmware-interface-8ad6f91aa1f746a0.yaml
 releasenotes/notes/fix-agent-clean-up-9a25deb85bc53d9b.yaml
 releasenotes/notes/fix-agent-ilo-temp-image-cleanup-711429d0e67807ae.yaml
 releasenotes/notes/fix-anaconda-deploy-interface-bfa2cfca22b04680.yaml
@@ -2002,6 +2007,7 @@ releasenotes/notes/releasenote-b3b25c13ea1e2844.yaml
 releasenotes/notes/reloadable-301ec2aa421abf66.yaml
 releasenotes/notes/rely-on-standalone-ports-supported-8153e1135787828b.yaml
 releasenotes/notes/removal-pre-allocation-for-oneview-09310a215b3aaf3c.yaml
+releasenotes/notes/remove-400a563030224c4f.yaml
 releasenotes/notes/remove-DEPRECATED-options-from-[agent]-7b6cce21b5f52022.yaml
 releasenotes/notes/remove-agent-heartbeat-timeout-abf8787b8477bae7.yaml
 releasenotes/notes/remove-agent-passthru-432b18e6c430cee6.yaml
@@ -2149,6 +2155,7 @@ releasenotes/notes/token-reboot-b48b5981a58a30ae.yaml
 releasenotes/notes/train-release-59ff1643ec92c10a.yaml
 releasenotes/notes/transmit-all-ports-b570009d1a008067.yaml
 releasenotes/notes/type-error-str-6826c53d7e5e1243.yaml
+releasenotes/notes/uefi-and-secureboot-waits-a783215327164e2c.yaml
 releasenotes/notes/uefi-first-prepare-e7fa1e2a78b4af99.yaml
 releasenotes/notes/uefi-grub2-by-default-6b797a9e690d2dd5.yaml
 releasenotes/notes/uefi-is-now-the-default-562b0d68adc59008.yaml
diff --git a/ironic.egg-info/entry_points.txt b/ironic.egg-info/entry_points.txt
index 7d3e573..7bb5a43 100644
--- a/ironic.egg-info/entry_points.txt
+++ b/ironic.egg-info/entry_points.txt
@@ -54,6 +54,7 @@ ramdisk = ironic.drivers.modules.ramdisk:RamdiskDeploy
 [ironic.hardware.interfaces.firmware]
 fake = ironic.drivers.modules.fake:FakeFirmware
 no-firmware = ironic.drivers.modules.noop:NoFirmware
+redfish = ironic.drivers.modules.redfish.firmware:RedfishFirmware
 
 [ironic.hardware.interfaces.inspect]
 agent = ironic.drivers.modules.inspector:AgentInspect
diff --git a/ironic.egg-info/pbr.json b/ironic.egg-info/pbr.json
index 3a310bb..21af2bb 100644
--- a/ironic.egg-info/pbr.json
+++ b/ironic.egg-info/pbr.json
@@ -1 +1 @@
-{"git_version": "985c7fdf2", "is_release": false}
 \ No newline at end of file
+{"git_version": "f78f87227", "is_release": true}
 \ No newline at end of file
diff --git a/ironic/api/controllers/v1/utils.py b/ironic/api/controllers/v1/utils.py
index 10c631d..3a7806e 100644
--- a/ironic/api/controllers/v1/utils.py
+++ b/ironic/api/controllers/v1/utils.py
@@ -2018,6 +2018,6 @@ def allow_continue_inspection_endpoint():
 def allow_firmware_interface():
     """Check if we should support firmware interface and endpoints.
 
-    Version 1.84 of the API added support for firmware interface.
+    Version 1.86 of the API added support for firmware interface.
     """
     return api.request.version.minor >= versions.MINOR_86_FIRMWARE_INTERFACE
diff --git a/ironic/common/pxe_utils.py b/ironic/common/pxe_utils.py
index a4fd438..8c61e23 100644
--- a/ironic/common/pxe_utils.py
+++ b/ironic/common/pxe_utils.py
@@ -58,7 +58,6 @@ DHCPV6_BOOTFILE_NAME = '59'  # rfc5970
 # DHCPV6_BOOTFILE_PARAMS = '60'  # rfc5970
 DHCP_TFTP_SERVER_ADDRESS = '150'  # rfc5859
 DHCP_IPXE_ENCAP_OPTS = '175'  # Tentatively Assigned
-DHCP_TFTP_PATH_PREFIX = '210'  # rfc5071
 DHCP_SERVER_IP_ADDRESS = '255'  # dnsmasq server-ip-address
 
 DEPLOY_KERNEL_RAMDISK_LABELS = ['deploy_kernel', 'deploy_ramdisk']
@@ -562,16 +561,6 @@ def dhcp_options_for_instance(task, ipxe_enabled=False, url_boot=False,
     else:
         dhcp_opts.append({'opt_name': boot_file_param,
                           'opt_value': boot_file})
-        # 210 == tftp server path-prefix or tftp root, will be used to find
-        # pxelinux.cfg directory. The pxelinux.0 loader infers this information
-        # from it's own path, but Petitboot needs it to be specified by this
-        # option since it doesn't use pxelinux.0 loader.
-        if not url_boot:
-            # Enforce trailing slash
-            prefix = os.path.join(CONF.pxe.tftp_root, '')
-            dhcp_opts.append(
-                {'opt_name': DHCP_TFTP_PATH_PREFIX,
-                 'opt_value': prefix})
 
     if not url_boot:
         dhcp_opts.append({'opt_name': DHCP_TFTP_SERVER_NAME,
diff --git a/ironic/common/utils.py b/ironic/common/utils.py
index 6bae4e7..efd3049 100644
--- a/ironic/common/utils.py
+++ b/ironic/common/utils.py
@@ -578,8 +578,12 @@ def pop_node_nested_field(node, collection, field, default=None):
 
 def wrap_ipv6(ip):
     """Wrap the address in square brackets if it's an IPv6 address."""
-    if ipaddress.ip_address(ip).version == 6:
-        return "[%s]" % ip
+    try:
+        if ipaddress.ip_address(ip).version == 6:
+            return "[%s]" % ip
+    except ValueError:
+        pass
+
     return ip
 
 
diff --git a/ironic/conductor/cleaning.py b/ironic/conductor/cleaning.py
index 1e79f97..cd2d999 100644
--- a/ironic/conductor/cleaning.py
+++ b/ironic/conductor/cleaning.py
@@ -85,6 +85,8 @@ def do_node_clean(task, clean_steps=None, disable_ramdisk=False):
     # Retrieve BIOS config settings for this node
     utils.node_cache_bios_settings(task, node)
 
+    # Retrieve Firmware Components for this node if possible
+    utils.node_cache_firmware_components(task)
     # Allow the deploy driver to set up the ramdisk again (necessary for
     # IPA cleaning)
     try:
diff --git a/ironic/conductor/steps.py b/ironic/conductor/steps.py
index 3dfbb2e..dcdfa46 100644
--- a/ironic/conductor/steps.py
+++ b/ironic/conductor/steps.py
@@ -31,9 +31,10 @@ CLEANING_INTERFACE_PRIORITY = {
     # by which interface is implementing the clean step. The clean step of the
     # interface with the highest value here, will be executed first in that
     # case.
-    'vendor': 6,
-    'power': 5,
-    'management': 4,
+    'vendor': 7,
+    'power': 6,
+    'management': 5,
+    'firmware': 4,
     'deploy': 3,
     'bios': 2,
     'raid': 1,
@@ -46,9 +47,10 @@ DEPLOYING_INTERFACE_PRIORITY = {
     # TODO(rloo): If we think it makes sense to have the interface priorities
     # the same for cleaning & deploying, replace the two with one e.g.
     # 'INTERFACE_PRIORITIES'.
-    'vendor': 6,
-    'power': 5,
-    'management': 4,
+    'vendor': 7,
+    'power': 6,
+    'management': 5,
+    'firmware': 4,
     'deploy': 3,
     'bios': 2,
     'raid': 1,
@@ -61,11 +63,12 @@ VERIFYING_INTERFACE_PRIORITY = {
     # by which interface is implementing the verify step. The verifying step of
     # the interface with the highest value here, will be executed first in
     # that case.
-    'power': 12,
-    'management': 11,
-    'boot': 8,
+    'power': 13,
+    'management': 12,
+    'firmware': 11,
     'inspect': 10,
     'deploy': 9,
+    'boot': 8,
     'bios': 7,
     'raid': 6,
     'vendor': 5,
diff --git a/ironic/conductor/utils.py b/ironic/conductor/utils.py
index 1255c86..e79ce3d 100644
--- a/ironic/conductor/utils.py
+++ b/ironic/conductor/utils.py
@@ -1828,3 +1828,15 @@ def servicing_error_handler(task, logmsg, errmsg=None, traceback=False,
 
     if set_fail_state and node.provision_state != states.SERVICEFAIL:
         task.process_event('fail')
+
+
+def node_cache_firmware_components(task):
+    """Do caching of firmware components if supported by driver"""
+
+    try:
+        LOG.debug('Getting Firmware Components for node %s', task.node.uuid)
+        task.driver.firmware.validate(task)
+        task.driver.firmware.cache_firmware_components(task)
+    except exception.UnsupportedDriverExtension:
+        LOG.warning('Firmware Components are not supported for node %s, '
+                    'skipping', task.node.uuid)
diff --git a/ironic/conf/inspector.py b/ironic/conf/inspector.py
index 6014fb3..434c863 100644
--- a/ironic/conf/inspector.py
+++ b/ironic/conf/inspector.py
@@ -20,13 +20,15 @@ from ironic.conf import auth
 
 VALID_ADD_PORTS_VALUES = {
     'all': _('all MAC addresses'),
-    'active': _('MAC addresses of NIC\'s with IP addresses'),
+    'active': _('MAC addresses of NICs with IP addresses'),
     'pxe': _('only the MAC address of the PXE NIC'),
     'disabled': _('do not create any ports'),
 }
 VALID_KEEP_PORTS_VALUES = {
-    'all': _('keep even ports with MAC\'s not present in the inventory'),
-    'present': _('keep only ports with MAC\'s present in the inventory'),
+    'all': _('keep all ports, even ones with MAC addresses that are not '
+             'present in the inventory'),
+    'present': _('keep only ports with MAC addresses present in '
+                 'the inventory'),
     'added': _('keep only ports determined by the add_ports option'),
 }
 
diff --git a/ironic/conf/redfish.py b/ironic/conf/redfish.py
index 68aa961..87a359d 100644
--- a/ironic/conf/redfish.py
+++ b/ironic/conf/redfish.py
@@ -115,6 +115,12 @@ opts = [
                default=60,
                help=_('Number of seconds to wait between checking for '
                       'failed raid config tasks')),
+    cfg.IntOpt('boot_mode_config_timeout',
+               min=0,
+               default=900,
+               help=_('Number of seconds to wait for boot mode or secure '
+                      'boot status change to take effect after a reboot. '
+                      'Set to 0 to disable waiting.')),
 ]
 
 
diff --git a/ironic/db/sqlalchemy/api.py b/ironic/db/sqlalchemy/api.py
index bf591ca..a6ab523 100644
--- a/ironic/db/sqlalchemy/api.py
+++ b/ironic/db/sqlalchemy/api.py
@@ -387,7 +387,7 @@ def _paginate_query(model, limit=None, marker=None, sort_key=None,
                 return []
             if return_base_tuple:
                 # The caller expects a tuple, lets just give it to them.
-                return res
+                return [tuple(r) for r in res]
             # Everything is a tuple in a resultset from the unified interface
             # but for objects, our model expects just object access,
             # so we extract and return them.
@@ -585,16 +585,9 @@ class Connection(api.Connection):
         # If we are not using sorting, or any other query magic,
         # we could likely just do a query execution and
         # prepare the tuple responses.
-        results = _paginate_query(models.Node, limit, marker,
-                                  sort_key, sort_dir, query,
-                                  return_base_tuple=True)
-        # Need to copy the data to close out the _paginate_query
-        # object.
-        new_result = [tuple([ent for ent in r]) for r in results]
-        # Explicitly free results so we don't hang on to it.
-        del results
-
-        return new_result
+        return _paginate_query(models.Node, limit, marker,
+                               sort_key, sort_dir, query,
+                               return_base_tuple=True)
 
     def get_node_list(self, filters=None, limit=None, marker=None,
                       sort_key=None, sort_dir=None, fields=None):
@@ -714,14 +707,17 @@ class Connection(api.Connection):
                 values(reservation=tag).
                 execution_options(synchronize_session=False))
             session.flush()
-        node = self._get_node_reservation(node.id)
         # NOTE(TheJulia): In SQLAlchemy 2.0 style, we don't
         # magically get a changed node as they moved from the
         # many ways to do things to singular ways to do things.
         if res.rowcount != 1:
             # Nothing updated and node exists. Must already be
-            # locked.
-            raise exception.NodeLocked(node=node.uuid, host=node.reservation)
+            # locked. Identify who holds it and log.
+            if utils.is_ironic_using_sqlite():
+                lock_holder = CONF.hostname
+            else:
+                lock_holder = self._get_node_reservation(node.id).reservation
+            raise exception.NodeLocked(node=node.uuid, host=lock_holder)
 
     @oslo_db_api.retry_on_deadlock
     def reserve_node(self, tag, node_id):
@@ -1481,7 +1477,8 @@ class Connection(api.Connection):
                 result = session.query(
                     field
                 ).filter(models.Conductor.online.is_(False))
-        return [row[0] for row in result]
+            result = [row[0] for row in result]
+        return result
 
     def get_online_conductors(self):
         with _session_for_read() as session:
diff --git a/ironic/drivers/modules/deploy_utils.py b/ironic/drivers/modules/deploy_utils.py
index 010e384..18a5068 100644
--- a/ironic/drivers/modules/deploy_utils.py
+++ b/ironic/drivers/modules/deploy_utils.py
@@ -1536,10 +1536,12 @@ def prepare_agent_boot(task):
     task.driver.boot.prepare_ramdisk(task, deploy_opts)
 
 
-def reboot_to_finish_step(task):
+def reboot_to_finish_step(task, timeout=None):
     """Reboot the node into IPA to finish a deploy/clean step.
 
     :param task: a TaskManager instance.
+    :param timeout: timeout (in seconds) positive integer (> 0) for any
+      power state. ``None`` indicates to use default timeout.
     :returns: states.CLEANWAIT if cleaning operation in progress
               or states.DEPLOYWAIT if deploy operation in progress.
     """
@@ -1552,7 +1554,7 @@ def reboot_to_finish_step(task):
             manager_utils.node_power_action(task, states.POWER_OFF)
         prepare_agent_boot(task)
 
-    manager_utils.node_power_action(task, states.REBOOT)
+    manager_utils.node_power_action(task, states.REBOOT, timeout)
     return get_async_step_return_state(task.node)
 
 
diff --git a/ironic/drivers/modules/fake.py b/ironic/drivers/modules/fake.py
index 625ffbb..0889098 100644
--- a/ironic/drivers/modules/fake.py
+++ b/ironic/drivers/modules/fake.py
@@ -477,6 +477,8 @@ class FakeFirmware(base.FirmwareInterface):
                      'needs to contain a dictionary with name/value pairs'),
                      'required': True}})
     def update(self, task, settings):
+        LOG.debug('Calling update clean step with settings %s.',
+                  settings)
         sleep(CONF.fake.firmware_delay)
 
     def cache_firmware_components(self, task):
diff --git a/ironic/drivers/modules/inspect_utils.py b/ironic/drivers/modules/inspect_utils.py
index 2a66edc..14caa05 100644
--- a/ironic/drivers/modules/inspect_utils.py
+++ b/ironic/drivers/modules/inspect_utils.py
@@ -342,6 +342,9 @@ def _get_bmc_addresses(node):
         if '//' in address:
             address = urllib.parse.urlparse(address).hostname
 
+        # Strip brackets in case used on IPv6 address.
+        address = address.strip('[').strip(']')
+
         try:
             addrinfo = socket.getaddrinfo(address, None, proto=socket.SOL_TCP)
         except socket.gaierror as exc:
diff --git a/ironic/drivers/modules/redfish/firmware.py b/ironic/drivers/modules/redfish/firmware.py
 new file mode 100644
index 0000000..207c61a
--- /dev/null
+++ b/ironic/drivers/modules/redfish/firmware.py
@@ -0,0 +1,452 @@
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from urllib.parse import urlparse
+
+from ironic_lib import metrics_utils
+from oslo_log import log
+from oslo_utils import importutils
+from oslo_utils import timeutils
+
+from ironic.common import exception
+from ironic.common.i18n import _
+from ironic.common import states
+from ironic.conductor import periodics
+from ironic.conductor import utils as manager_utils
+from ironic.conf import CONF
+from ironic.drivers import base
+from ironic.drivers.modules import deploy_utils
+from ironic.drivers.modules.redfish import firmware_utils
+from ironic.drivers.modules.redfish import utils as redfish_utils
+from ironic import objects
+
+LOG = log.getLogger(__name__)
+
+METRICS = metrics_utils.get_metrics_logger(__name__)
+
+sushy = importutils.try_import('sushy')
+
+
+class RedfishFirmware(base.FirmwareInterface):
+
+    _FW_SETTINGS_ARGSINFO = {
+        'settings': {
+            'description': (
+                'A list of dicts with firmware components to be updated'
+            ),
+            'required': True
+        }
+    }
+
+    def __init__(self):
+        super(RedfishFirmware, self).__init__()
+        if sushy is None:
+            raise exception.DriverLoadError(
+                driver='redfish',
+                reason=_("Unable to import the sushy library"))
+
+    def get_properties(self):
+        """Return the properties of the interface.
+
+        :returns: dictionary of <property name>:<property description> entries.
+        """
+        return redfish_utils.COMMON_PROPERTIES.copy()
+
+    def validate(self, task):
+        """Validates the driver information needed by the redfish driver.
+
+        :param task: a TaskManager instance containing the node to act on.
+        :raises: InvalidParameterValue on malformed parameter(s)
+        :raises: MissingParameterValue on missing parameter(s)
+        """
+        redfish_utils.parse_driver_info(task.node)
+
+    def cache_firmware_components(self, task):
+        """Store or update Firmware Components on the given node.
+
+        This method stores Firmware Components to the firmware_information
+        table during 'cleaning' operation. It will also update the timestamp
+        of each Firmware Component.
+
+        :param task: a TaskManager instance.
+        :raises: UnsupportedDriverExtension, if the node's driver doesn't
+            support getting Firmware Components from bare metal.
+        """
+
+        node_id = task.node.id
+        settings = []
+        # NOTE(iurygregory): currently we will only retrieve BIOS and BMC
+        # firmware information trough the redfish system and manager.
+
+        system = redfish_utils.get_system(task.node)
+
+        bios_fw = {'component': 'bios',
+                   'current_version': system.bios_version}
+        settings.append(bios_fw)
+
+        # NOTE(iurygregory): normally we only relay on the System to
+        # perform actions, but to retrieve the BMC Firmware we need to
+        # access the Manager.
+        try:
+            manager = redfish_utils.get_manager(task.node, system)
+            bmc_fw = {'component': 'bmc',
+                      'current_version': manager.firmware_version}
+            settings.append(bmc_fw)
+        except exception.RedfishError:
+            LOG.warning('No manager available to retrieve Firmware '
+                        'from the bmc of node %s', task.node.uuid)
+
+        if not settings:
+            error_msg = (_('Cannot retrieve firmware for node %s.')
+                         % task.node.uuid)
+            LOG.error(error_msg)
+            raise exception.UnsupportedDriverExtension(error_msg)
+
+        create_list, update_list, nochange_list = (
+            objects.FirmwareComponentList.sync_firmware_components(
+                task.context, node_id, settings))
+
+        if create_list:
+            for new_fw in create_list:
+                new_fw_cmp = objects.FirmwareComponent(
+                    task.context,
+                    node_id=node_id,
+                    component=new_fw['component'],
+                    current_version=new_fw['current_version']
+                )
+                new_fw_cmp.create()
+        if update_list:
+            for up_fw in update_list:
+                up_fw_cmp = objects.FirmwareComponent.get(
+                    task.context,
+                    node_id=node_id,
+                    name=up_fw['component']
+                )
+                up_fw_cmp.last_version_flashed = up_fw.get('current_version')
+                up_fw_cmp.current_version = up_fw.get('current_version')
+                up_fw_cmp.save()
+
+    @METRICS.timer('RedfishFirmware.update')
+    @base.deploy_step(priority=0, argsinfo=_FW_SETTINGS_ARGSINFO)
+    @base.clean_step(priority=0, abortable=False,
+                     argsinfo=_FW_SETTINGS_ARGSINFO,
+                     requires_ramdisk=True)
+    @base.cache_firmware_components
+    def update(self, task, settings):
+        """Update the Firmware on the node using the settings for components.
+
+        :param task: a TaskManager instance.
+        :param settings: a list of dictionaries, each dictionary contains the
+            component name and the url that will be used to update the
+            firmware.
+        :raises: UnsupportedDriverExtension, if the node's driver doesn't
+            support update via the interface.
+        :raises: InvalidParameterValue, if validation of the settings fails.
+        :raises: MissingParamterValue, if some required parameters are
+            missing.
+        :returns: states.CLEANWAIT if Firmware update with the settings is in
+            progress asynchronously of None if it is complete.
+        """
+        node = task.node
+
+        update_service = redfish_utils.get_update_service(node)
+
+        LOG.debug('Updating Firmware on node %(node_uuid)s with settings '
+                  '%(settings)s',
+                  {'node_uuid': node.uuid, 'settings': settings})
+
+        self._execute_firmware_update(node, update_service, settings)
+
+        fw_upd = settings[0]
+        wait_interval = fw_upd.get('wait')
+
+        deploy_utils.set_async_step_flags(
+            node,
+            reboot=True,
+            skip_current_step=True,
+            polling=True
+        )
+
+        return deploy_utils.reboot_to_finish_step(task, timeout=wait_interval)
+
+    def _execute_firmware_update(self, node, update_service, settings):
+        """Executes the next firmware update to the node
+
+        Executes the first firmware update in the settings list to the node.
+
+        :param node: the node that will have a firmware update executed.
+        :param update_service: the sushy firmware update service.
+        :param settings: remaining settings for firmware update that needs
+            to be executed.
+        """
+        fw_upd = settings[0]
+        component_url, cleanup = self._stage_firmware_file(node, fw_upd)
+
+        LOG.debug('Applying new firmware %(url)s for %(component)s on node '
+                  '%(node_uuid)s',
+                  {'url': fw_upd['url'], 'component': fw_upd['component'],
+                   'node_uuid': node.uuid})
+
+        task_monitor = update_service.simple_update(component_url)
+
+        fw_upd['task_monitor'] = task_monitor.task_monitor_uri
+        node.set_driver_internal_info('redfish_fw_updates', settings)
+
+        if cleanup:
+            fw_clean = node.driver_internal_info.get('firmware_cleanup')
+            if not fw_clean:
+                fw_clean = [cleanup]
+            elif cleanup not in fw_clean:
+                fw_clean.append(cleanup)
+            node.set_driver_internal_info('firmware_cleanup', fw_clean)
+
+    def _continue_updates(self, task, update_service, settings):
+        """Continues processing the firmware updates
+
+        Continues to process the firmware updates on the node.
+
+        Note that the caller must have an exclusive lock on the node.
+
+        :param task: a TaskManager instance containing the node to act on.
+        :param update_service: the sushy firmware update service
+        :param settings: the remaining firmware updates to apply
+        """
+        node = task.node
+        fw_upd = settings[0]
+        wait_interval = fw_upd.get('wait')
+        if wait_interval:
+            time_now = str(timeutils.utcnow().isoformat())
+            fw_upd['wait_start_time'] = time_now
+
+            LOG.debug('Waiting at %(time)s for %(seconds)s seconds after '
+                      '%(component)s firmware update %(url)s '
+                      'on node %(node)s',
+                      {'time': time_now,
+                       'seconds': wait_interval,
+                       'component': fw_upd['component'],
+                       'url': fw_upd['url'],
+                       'node': node.uuid})
+
+            node.set_driver_internal_info('redfish_fw_updates', settings)
+            node.save()
+            return
+
+        if len(settings) == 1:
+            self._clear_updates(node)
+
+            LOG.info('Firmware updates completed for node %(node)s',
+                     {'node': node.uuid})
+
+            manager_utils.notify_conductor_resume_clean(task)
+        else:
+            settings.pop(0)
+            self._execute_firmware_update(node,
+                                          update_service,
+                                          settings)
+            node.save()
+            manager_utils.node_power_action(task, states.REBOOT)
+
+    def _clear_updates(self, node):
+        """Clears firmware updates artifacts
+
+        Clears firmware updates from driver_internal_info and any files
+        that were staged.
+
+        Note that the caller must have an exclusive lock on the node.
+
+        :param node: the node to clear the firmware updates from
+        """
+        firmware_utils.cleanup(node)
+        node.del_driver_internal_info('redfish_fw_updates')
+        node.del_driver_internal_info('firmware_cleanup')
+        node.save()
+
+    @METRICS.timer('RedfishFirmware._query_update_failed')
+    @periodics.node_periodic(
+        purpose='checking if async update of firmware component failed',
+        spacing=CONF.redfish.firmware_update_fail_interval,
+        filters={'reserved': False, 'provision_state': states.CLEANFAIL,
+                 'maintenance': True},
+        predicate_extra_fields=['driver_internal_info'],
+        predicate=lambda n: n.driver_internal_info.get('redfish_fw_updates'),
+    )
+    def _query_update_failed(self, task, manager, context):
+
+        """Periodic job to check for failed firmware updates."""
+        # A firmware update failed. Discard any remaining firmware
+        # updates so when the user takes the node out of
+        # maintenance mode, pending firmware updates do not
+        # automatically continue.
+        LOG.error('Update firmware failed for node %(node)s. '
+                  'Discarding remaining firmware updates.',
+                  {'node': task.node.uuid})
+
+        task.upgrade_lock()
+        self._clear_updates(task.node)
+
+    @METRICS.timer('RedfishFirmware._query_update_status')
+    @periodics.node_periodic(
+        purpose='checking async update of firmware component',
+        spacing=CONF.redfish.firmware_update_fail_interval,
+        filters={'reserved': False, 'provision_state': states.CLEANWAIT},
+        predicate_extra_fields=['driver_internal_info'],
+        predicate=lambda n: n.driver_internal_info.get('redfish_fw_updates'),
+    )
+    def _query_update_status(self, task, manager, context):
+        """Periodic job to check firmware update tasks."""
+        self._check_node_redfish_firmware_update(task)
+
+    @METRICS.timer('RedfishFirmware._check_node_redfish_firmware_update')
+    def _check_node_redfish_firmware_update(self, task):
+        """Check the progress of running firmware update on a node."""
+
+        node = task.node
+
+        settings = node.driver_internal_info['redfish_fw_updates']
+        current_update = settings[0]
+
+        try:
+            update_service = redfish_utils.get_update_service(node)
+        except exception.RedfishConnectionError as e:
+            # If the BMC firmware is being updated, the BMC will be
+            # unavailable for some amount of time.
+            LOG.warning('Unable to communicate with firmware update service '
+                        'on node %(node)s. Will try again on the next poll. '
+                        'Error: %(error)s',
+                        {'node': node.uuid,
+                         'error': e})
+            return
+
+        wait_start_time = current_update.get('wait_start_time')
+        if wait_start_time:
+            wait_start = timeutils.parse_isotime(wait_start_time)
+
+            elapsed_time = timeutils.utcnow(True) - wait_start
+            if elapsed_time.seconds >= current_update['wait']:
+                LOG.debug('Finished waiting after firmware update '
+                          '%(firmware_image)s on node %(node)s. '
+                          'Elapsed time: %(seconds)s seconds',
+                          {'firmware_image': current_update['url'],
+                           'node': node.uuid,
+                           'seconds': elapsed_time.seconds})
+                current_update.pop('wait', None)
+                current_update.pop('wait_start_time', None)
+
+                self._continue_updates(task, update_service, settings)
+            else:
+                LOG.debug('Continuing to wait after firmware update '
+                          '%(firmware_image)s on node %(node)s. '
+                          'Elapsed time: %(seconds)s seconds',
+                          {'firmware_image': current_update['url'],
+                           'node': node.uuid,
+                           'seconds': elapsed_time.seconds})
+
+            return
+
+        try:
+            task_monitor = redfish_utils.get_task_monitor(
+                node, current_update['task_monitor'])
+        except exception.RedfishError:
+            # The BMC deleted the Task before we could query it
+            LOG.warning('Firmware update completed for node %(node)s, '
+                        'firmware %(firmware_image)s, but success of the '
+                        'update is unknown.  Assuming update was successful.',
+                        {'node': node.uuid,
+                         'firmware_image': current_update['url']})
+            self._continue_updates(task, update_service, settings)
+            return
+
+        if not task_monitor.is_processing:
+            # The last response does not necessarily contain a Task,
+            # so get it
+            sushy_task = task_monitor.get_task()
+
+            # Only parse the messages if the BMC did not return parsed
+            # messages
+            messages = []
+            if sushy_task.messages and not sushy_task.messages[0].message:
+                sushy_task.parse_messages()
+
+            if sushy_task.messages is not None:
+                messages = [m.message for m in sushy_task.messages]
+
+            task.upgrade_lock()
+            if (sushy_task.task_state == sushy.TASK_STATE_COMPLETED
+                    and sushy_task.task_status in
+                    [sushy.HEALTH_OK, sushy.HEALTH_WARNING]):
+                LOG.info('Firmware update succeeded for node %(node)s, '
+                         'firmware %(firmware_image)s: %(messages)s',
+                         {'node': node.uuid,
+                          'firmware_image': current_update['url'],
+                          'messages': ", ".join(messages)})
+
+                self._continue_updates(task, update_service, settings)
+            else:
+                error_msg = (_('Firmware update failed for node %(node)s, '
+                               'firmware %(firmware_image)s. '
+                               'Error: %(errors)s') %
+                             {'node': node.uuid,
+                              'firmware_image': current_update['url'],
+                              'errors': ",  ".join(messages)})
+
+                self._clear_updates(node)
+                if task.node.clean_step:
+                    manager_utils.cleaning_error_handler(task, error_msg)
+                else:
+                    manager_utils.deploying_error_handler(task, error_msg)
+
+        else:
+            LOG.debug('Firmware update in progress for node %(node)s, '
+                      'firmware %(firmware_image)s.',
+                      {'node': node.uuid,
+                       'firmware_image': current_update['url']})
+
+    def _stage_firmware_file(self, node, component_update):
+
+        try:
+            url = component_update['url']
+            name = component_update['component']
+            parsed_url = urlparse(url)
+            scheme = parsed_url.scheme.lower()
+            source = (CONF.redfish.firmware_source).lower()
+
+            # Keep it simple, in further processing TLS does not matter
+            if scheme == 'https':
+                scheme = 'http'
+
+            # If source and scheme is HTTP, then no staging,
+            # returning original location
+            if scheme == 'http' and source == scheme:
+                LOG.debug('For node %(node)s serving firmware for '
+                          '%(component)s from original location %(url)s',
+                          {'node': node.uuid, 'component': name, 'url': url})
+                return url, None
+
+            # If source and scheme is Swift, then not moving, but
+            # returning Swift temp URL
+            if scheme == 'swift' and source == scheme:
+                temp_url = firmware_utils.get_swift_temp_url(parsed_url)
+                LOG.debug('For node %(node)s serving original firmware at '
+                          'for %(component)s at %(url)s via Swift temporary '
+                          'url %(temp_url)s',
+                          {'node': node.uuid, 'component': name, 'url': url,
+                           'temp_url': temp_url})
+                return temp_url, None
+
+            # For remaining, download the image to temporary location
+            temp_file = firmware_utils.download_to_temp(node, url)
+
+            return firmware_utils.stage(node, source, temp_file)
+
+        except exception.IronicException:
+            firmware_utils.cleanup(node)
diff --git a/ironic/drivers/modules/redfish/firmware_utils.py b/ironic/drivers/modules/redfish/firmware_utils.py
index feeec2d..843597d 100644
--- a/ironic/drivers/modules/redfish/firmware_utils.py
+++ b/ironic/drivers/modules/redfish/firmware_utils.py
@@ -63,6 +63,36 @@ _UPDATE_FIRMWARE_SCHEMA = {
         "additionalProperties": False
     }
 }
+
+_FIRMWARE_INTERFACE_UPDATE_SCHEMA = {
+    "$schema": "http://json-schema.org/schema#",
+    "title": "update_firmware clean step schema",
+    "type": "array",
+    # list of firmware update images
+    "items": {
+        "type": "object",
+        "required": ["component", "url"],
+        "properties": {
+            "component": {
+                "description": "name of the firmware component to be updated",
+                "type": "string",
+                "minLenght": 1
+            },
+            "url": {
+                "description": "URL for firmware file",
+                "type": "string",
+                "minLength": 1
+            },
+            "wait": {
+                "description": "optional wait time for firmware update",
+                "type": "integer",
+                "minimum": 1
+            }
+        },
+        "additionalProperties": False
+    }
+}
+
 _FIRMWARE_SUBDIR = 'firmware'
 
 
@@ -80,6 +110,20 @@ def validate_update_firmware_args(firmware_images):
             % {'firmware_images': firmware_images, 'err': err})
 
 
+def validate_firmware_interface_update_args(settings):
+    """Validate ``update`` step input argument
+
+    :param settings: args to validate.
+    :raises: InvalidParameterValue When argument is not valid
+    """
+    try:
+        jsonschema.validate(settings, _FIRMWARE_INTERFACE_UPDATE_SCHEMA)
+    except jsonschema.ValidationError as err:
+        raise exception.InvalidParameterValue(
+            _('Invalid firmware update %(settings)s. Errors: %(err)s')
+            % {'settings': settings, 'err': err})
+
+
 def get_swift_temp_url(parsed_url):
     """Gets Swift temporary URL
 
diff --git a/ironic/drivers/modules/redfish/management.py b/ironic/drivers/modules/redfish/management.py
index 7f7dbe7..d0b8045 100644
--- a/ironic/drivers/modules/redfish/management.py
+++ b/ironic/drivers/modules/redfish/management.py
@@ -14,6 +14,7 @@
 #    under the License.
 
 import collections
+import time
 from urllib.parse import urlparse
 
 from ironic_lib import metrics_utils
@@ -44,6 +45,8 @@ METRICS = metrics_utils.get_metrics_logger(__name__)
 
 sushy = importutils.try_import('sushy')
 
+BOOT_MODE_CONFIG_INTERVAL = 15
+
 if sushy:
     BOOT_DEVICE_MAP = {
         sushy.BOOT_SOURCE_TARGET_PXE: boot_devices.PXE,
@@ -327,9 +330,13 @@ class RedfishManagement(base.ManagementInterface):
         """
         system = redfish_utils.get_system(task.node)
 
+        # NOTE(dtantsur): check the readability of the current mode before
+        # modifying anything. I suspect it can become None transiently after
+        # the update, while we need to know if it is supported *at all*.
+        get_mode_unsupported = (system.boot.get('mode') is None)
+
         try:
             system.set_system_boot_options(mode=BOOT_MODE_MAP_REV[mode])
-
         except sushy.exceptions.SushyError as e:
             error_msg = (_('Setting boot mode to %(mode)s '
                            'failed for node %(node)s. '
@@ -342,7 +349,7 @@ class RedfishManagement(base.ManagementInterface):
             # getting or setting the boot mode. When setting failed and the
             # mode attribute is missing from the boot field, raising
             # UnsupportedDriverExtension will allow the deploy to continue.
-            if system.boot.get('mode') is None:
+            if get_mode_unsupported:
                 LOG.info(_('Attempt to set boot mode on node %(node)s '
                            'failed to set boot mode as the node does not '
                            'appear to support overriding the boot mode. '
@@ -352,6 +359,66 @@ class RedfishManagement(base.ManagementInterface):
                     driver=task.node.driver, extension='set_boot_mode')
             raise exception.RedfishError(error=error_msg)
 
+        # NOTE(dtantsur): this case is rather hypothetical, but in our own
+        # emulator, it's possible that mode is constantly set to None, while
+        # the request to change the mode succeeds.
+        if get_mode_unsupported:
+            LOG.warning('The request to set boot mode for node %(node)s to '
+                        '%(value)s has succeeded, but the current mode is '
+                        'not known. Skipping reboot and assuming '
+                        'the operation has succeeded.',
+                        {'node': task.node.uuid, 'value': mode})
+            return
+
+        self._wait_for_boot_mode(task, system, mode)
+        LOG.info('Boot mode for node %(node)s has been set to '
+                 '%(value)s', {'node': task.node.uuid, 'value': mode})
+
+    def _wait_for_boot_mode(self, task, system, mode):
+        system.refresh(force=True)
+
+        # NOTE(dtantsur/janders): at least Dell machines change boot mode via
+        # a BIOS configuration job. A reboot is needed to apply it.
+        if system.boot.get('mode') == BOOT_MODE_MAP_REV[mode]:
+            LOG.debug('Node %(node)s is already configured with requested '
+                      'boot mode %(new_value)s.',
+                      {'node': task.node.uuid,
+                       'new_value': BOOT_MODE_MAP_REV[mode]})
+            return
+
+        LOG.info('Rebooting node %(node)s to change boot mode from '
+                 '%(old_value)s to %(new_value)s',
+                 {'node': task.node.uuid,
+                  'old_value': system.boot.get('mode'),
+                  'new_value': BOOT_MODE_MAP_REV[mode]})
+
+        old_power_state = task.driver.power.get_power_state(task)
+        manager_utils.node_power_action(task, states.REBOOT)
+
+        if CONF.redfish.boot_mode_config_timeout:
+            threshold = time.time() + CONF.redfish.boot_mode_config_timeout
+            while (time.time() <= threshold
+                   and system.boot.get('mode') != BOOT_MODE_MAP_REV[mode]):
+                LOG.debug('Still waiting for boot mode of node %(node)s '
+                          'to become %(value)s, current is %(current)s',
+                          {'node': task.node.uuid,
+                           'value': BOOT_MODE_MAP_REV[mode],
+                           'current': system.boot.get('mode')})
+                time.sleep(BOOT_MODE_CONFIG_INTERVAL)
+                system.refresh(force=True)
+
+            if system.boot.get('mode') != BOOT_MODE_MAP_REV[mode]:
+                msg = (_('Timeout reached while waiting for boot mode of '
+                         'node %(node)s to become %(value)s, '
+                         'current is %(current)s')
+                       % {'node': task.node.uuid,
+                          'value': BOOT_MODE_MAP_REV[mode],
+                          'current': system.boot.get('mode')})
+                LOG.error(msg)
+                raise exception.RedfishError(error=msg)
+
+        manager_utils.node_power_action(task, old_power_state)
+
     def get_boot_mode(self, task):
         """Get the current boot mode for a node.
 
@@ -1142,9 +1209,45 @@ class RedfishManagement(base.ManagementInterface):
                    % {'node': task.node.uuid, 'value': state, 'exc': exc})
             LOG.error(msg)
             raise exception.RedfishError(error=msg)
-        else:
-            LOG.info('Secure boot state for node %(node)s has been set to '
-                     '%(value)s', {'node': task.node.uuid, 'value': state})
+
+        self._wait_for_secure_boot(task, sb, state)
+        LOG.info('Secure boot state for node %(node)s has been set to '
+                 '%(value)s', {'node': task.node.uuid, 'value': state})
+
+    def _wait_for_secure_boot(self, task, sb, state):
+        # NOTE(dtantsur): at least Dell machines change secure boot status via
+        # a BIOS configuration job. A reboot is needed to apply it.
+        sb.refresh(force=True)
+        if sb.enabled == state:
+            return
+
+        LOG.info('Rebooting node %(node)s to change secure boot state to '
+                 '%(value)s', {'node': task.node.uuid, 'value': state})
+
+        old_power_state = task.driver.power.get_power_state(task)
+        manager_utils.node_power_action(task, states.REBOOT)
+
+        if CONF.redfish.boot_mode_config_timeout:
+            threshold = time.time() + CONF.redfish.boot_mode_config_timeout
+            while time.time() <= threshold and sb.enabled != state:
+                LOG.debug(
+                    'Still waiting for secure boot state of node %(node)s '
+                    'to become %(value)s, current is %(current)s',
+                    {'node': task.node.uuid, 'value': state,
+                     'current': sb.enabled})
+                time.sleep(BOOT_MODE_CONFIG_INTERVAL)
+                sb.refresh(force=True)
+
+            if sb.enabled != state:
+                msg = (_('Timeout reached while waiting for secure boot state '
+                         'of node %(node)s to become %(state)s, '
+                         'current is %(current)s')
+                       % {'node': task.node.uuid, 'state': state,
+                          'current': sb.enabled})
+                LOG.error(msg)
+                raise exception.RedfishError(error=msg)
+
+        manager_utils.node_power_action(task, old_power_state)
 
     def _reset_keys(self, task, reset_type):
         system = redfish_utils.get_system(task.node)
diff --git a/ironic/drivers/modules/redfish/utils.py b/ironic/drivers/modules/redfish/utils.py
index e85e2ec..4182c84 100644
--- a/ironic/drivers/modules/redfish/utils.py
+++ b/ironic/drivers/modules/redfish/utils.py
@@ -28,6 +28,7 @@ import tenacity
 
 from ironic.common import exception
 from ironic.common.i18n import _
+from ironic.common import utils
 from ironic.conf import CONF
 
 sushy = importutils.try_import('sushy')
@@ -97,7 +98,7 @@ def parse_driver_info(node):
                                                  'info': missing_info})
 
     # Validate the Redfish address
-    address = driver_info['redfish_address']
+    address = utils.wrap_ipv6(driver_info['redfish_address'])
     try:
         parsed = rfc3986.uri_reference(address)
     except TypeError:
@@ -474,3 +475,39 @@ def wait_until_get_system_ready(node):
     driver_info = parse_driver_info(node)
     system_id = driver_info['system_id']
     return _get_system(driver_info, system_id)
+
+
+def get_manager(node, system, manager_id=None):
+    """Get a node's manager.
+
+    :param system: a Sushy system object
+    :param manager_id: the id of the manager
+    :return: a sushy Manager
+    :raises: RedfishError when the System doesn't have Managers associated
+    """
+
+    try:
+        sushy_manager = None
+        available_managers = system.managers
+        if available_managers:
+            if manager_id is None:
+                sushy_manager = available_managers[0]
+            else:
+                for manager in available_managers:
+                    if manager.identity == manager_id:
+                        sushy_manager = manager
+        if sushy_manager is None:
+            raise Exception("Couldn't find any Sushy Manager")
+        return sushy_manager
+    except sushy.exceptions.MissingAttributeError as e:
+        LOG.error('Redfish Managers for node %(node)s are not associated '
+                  'with system %(system)s. Error %(error)s',
+                  {'system': system.identity,
+                   'node': node.uuid, 'error': e})
+        raise exception.RedfishError(error=e)
+    except Exception as exc:
+        LOG.error('Redfish Manager was not found for '
+                  'node %(node)s under system %(system)s. Error %(error)s',
+                  {'system': system.identity,
+                   'node': node.uuid, 'error': exc})
+        raise exception.RedfishError(error=exc)
diff --git a/ironic/drivers/redfish.py b/ironic/drivers/redfish.py
index 3852cd3..094119e 100644
--- a/ironic/drivers/redfish.py
+++ b/ironic/drivers/redfish.py
@@ -21,6 +21,7 @@ from ironic.drivers.modules import noop_mgmt
 from ironic.drivers.modules import pxe
 from ironic.drivers.modules.redfish import bios as redfish_bios
 from ironic.drivers.modules.redfish import boot as redfish_boot
+from ironic.drivers.modules.redfish import firmware as redfish_firmware
 from ironic.drivers.modules.redfish import inspect as redfish_inspect
 from ironic.drivers.modules.redfish import management as redfish_mgmt
 from ironic.drivers.modules.redfish import power as redfish_power
@@ -69,3 +70,7 @@ class RedfishHardware(generic.GenericHardware):
     def supported_raid_interfaces(self):
         """List of supported raid interfaces."""
         return [redfish_raid.RedfishRAID, noop.NoRAID, agent.AgentRAID]
+
+    @property
+    def supported_firmware_interfaces(self):
+        return [redfish_firmware.RedfishFirmware, noop.NoFirmware]
diff --git a/ironic/objects/firmware.py b/ironic/objects/firmware.py
index 2a0f5f2..d30bc16 100644
--- a/ironic/objects/firmware.py
+++ b/ironic/objects/firmware.py
@@ -145,11 +145,15 @@ class FirmwareComponentList(base.IronicObjectListBase, base.IronicObject):
         for cmp in components:
             if cmp['component'] in current_components_dict:
                 values = current_components_dict[cmp['component']]
-
-                cv_changed = cmp['current_version'] \
-                    != values.get('current_version')
-                lvf_changed = cmp['last_version_flashed'] \
-                    != values.get('last_version_flashed')
+                if values.get('last_version_flashed') is None:
+                    lvf_changed = False
+                    cv_changed = cmp['current_version'] \
+                        != values.get('current_version')
+                else:
+                    lvf_changed = cmp['current_version'] \
+                        != values.get('last_version_flashed')
+                    cv_changed = cmp['current_version'] \
+                        != values.get('current_version')
 
                 if cv_changed or lvf_changed:
                     update_list.append(cmp)
diff --git a/ironic/tests/unit/api/base.py b/ironic/tests/unit/api/base.py
index 5f53e30..7a0638f 100644
--- a/ironic/tests/unit/api/base.py
+++ b/ironic/tests/unit/api/base.py
@@ -104,7 +104,6 @@ class BaseApiTest(db_base.DbTestCase):
         :param path_prefix: prefix of the url path
         """
         full_path = path_prefix + path
-        print('%s: %s %s' % (method.upper(), full_path, params))
         response = getattr(self.app, "%s_json" % method)(
             str(full_path),
             params=params,
@@ -113,7 +112,7 @@ class BaseApiTest(db_base.DbTestCase):
             extra_environ=extra_environ,
             expect_errors=expect_errors
         )
-        print('GOT:%s' % response)
+        print(method.upper(), full_path, "WITH", params, "GOT", str(response))
         return response
 
     def put_json(self, path, params, expect_errors=False, headers=None,
@@ -187,13 +186,12 @@ class BaseApiTest(db_base.DbTestCase):
         :param path_prefix: prefix of the url path
         """
         full_path = path_prefix + path
-        print('DELETE: %s' % (full_path))
         response = self.app.delete(str(full_path),
                                    headers=headers,
                                    status=status,
                                    extra_environ=extra_environ,
                                    expect_errors=expect_errors)
-        print('GOT:%s' % response)
+        print("DELETE", full_path, "GOT", str(response))
         return response
 
     def get_json(self, path, expect_errors=False, headers=None,
@@ -225,15 +223,14 @@ class BaseApiTest(db_base.DbTestCase):
         all_params.update(params)
         if q:
             all_params.update(query_params)
-        print('GET: %s %r' % (full_path, all_params))
         response = self.app.get(full_path,
                                 params=all_params,
                                 headers=headers,
                                 extra_environ=extra_environ,
                                 expect_errors=expect_errors)
+        print("GET", full_path, "WITH", params, "GOT", str(response))
         if not expect_errors:
             response = response.json
-        print('GOT:%s' % response)
         return response
 
     def validate_link(self, link, bookmark=False, headers=None):
diff --git a/ironic/tests/unit/api/controllers/v1/test_port.py b/ironic/tests/unit/api/controllers/v1/test_port.py
index 31885f4..088fe3c 100644
--- a/ironic/tests/unit/api/controllers/v1/test_port.py
+++ b/ironic/tests/unit/api/controllers/v1/test_port.py
@@ -1114,7 +1114,6 @@ class TestListPortsByShard(test_api_base.BaseApiTest):
 
         res = self.get_json('/ports?shard=shard1,shard2', headers=self.headers)
         self.assertEqual(2, len(res['ports']))
-        print(res['ports'][0])
         self.assertNotEqual(res['ports'][0]['address'], bad_shard_address)
         self.assertNotEqual(res['ports'][1]['address'], bad_shard_address)
 
diff --git a/ironic/tests/unit/api/test_acl.py b/ironic/tests/unit/api/test_acl.py
index 0481843..ded1d0b 100644
--- a/ironic/tests/unit/api/test_acl.py
+++ b/ironic/tests/unit/api/test_acl.py
@@ -102,7 +102,6 @@ class TestACLBase(base.BaseApiTest):
         # in troubleshooting ACL testing. This is a pattern
         # followed in API unit testing in ironic, and
         # really does help.
-        print('API ACL Testing Path %s %s' % (method, path))
         if headers:
             for k, v in headers.items():
                 rheaders[k] = v.format(**self.format_data)
@@ -185,8 +184,6 @@ class TestACLBase(base.BaseApiTest):
         if assert_dict_contains:
             for k, v in assert_dict_contains.items():
                 self.assertIn(k, response)
-                print(k)
-                print(v)
                 if str(v) == "None":
                     # Compare since the variable loaded from the
                     # json ends up being null in json or None.
@@ -219,13 +216,6 @@ class TestACLBase(base.BaseApiTest):
                     # a filtered view in these cases.
                     self.assertEqual(0, len(items))
 
-        # NOTE(TheJulia): API tests in Ironic tend to have a pattern
-        # to print request and response data to aid in development
-        # and troubleshooting. As such the prints should remain,
-        # at least until we are through primary development of the
-        # this test suite.
-        print('ACL Test GOT %s' % response)
-
 
 @ddt.ddt
 class TestRBACBasic(TestACLBase):
diff --git a/ironic/tests/unit/common/test_neutron.py b/ironic/tests/unit/common/test_neutron.py
index c3595a1..fe238df 100644
--- a/ironic/tests/unit/common/test_neutron.py
+++ b/ironic/tests/unit/common/test_neutron.py
@@ -678,7 +678,6 @@ class TestNeutronNetworkActions(db_base.DbTestCase):
 
         network_data = neutron.get_neutron_port_data('port1', 'vif1')
 
-        print(network_data)
         expected_port = {
             'id': 'port1',
             'type': 'vif',
diff --git a/ironic/tests/unit/common/test_pxe_utils.py b/ironic/tests/unit/common/test_pxe_utils.py
index 190bdfb..a57441f 100644
--- a/ironic/tests/unit/common/test_pxe_utils.py
+++ b/ironic/tests/unit/common/test_pxe_utils.py
@@ -895,9 +895,6 @@ class TestPXEUtils(db_base.DbTestCase):
             expected_info = [{'opt_name': '67',
                               'opt_value': bootfile,
                               'ip_version': ip_version},
-                             {'opt_name': '210',
-                              'opt_value': '/tftp-path/',
-                              'ip_version': ip_version},
                              {'opt_name': '66',
                               'opt_value': '192.0.2.1',
                               'ip_version': ip_version},
@@ -2165,8 +2162,6 @@ class iPXEBuildConfigOptionsTestCase(db_base.DbTestCase):
         if iso_boot:
             self.node.instance_info = {'boot_iso': 'http://test.url/file.iso'}
             self.node.save()
-            print(expected_options)
-            print(image_info)
             iso_url = os.path.join(http_url, self.node.uuid, 'boot_iso')
             expected_options.update(
                 {
diff --git a/ironic/tests/unit/common/test_utils.py b/ironic/tests/unit/common/test_utils.py
index 8d8e4aa..96c6612 100644
--- a/ironic/tests/unit/common/test_utils.py
+++ b/ironic/tests/unit/common/test_utils.py
@@ -321,6 +321,12 @@ class GenericUtilsTestCase(base.TestCase):
             self.assertFalse(utils.is_fips_enabled())
             m.assert_called_once_with('/proc/sys/crypto/fips_enabled', 'r')
 
+    def test_wrap_ipv6(self):
+        self.assertEqual('[2001:DB8::1]', utils.wrap_ipv6('2001:DB8::1'))
+        self.assertEqual('example.com', utils.wrap_ipv6('example.com'))
+        self.assertEqual('192.168.24.1', utils.wrap_ipv6('192.168.24.1'))
+        self.assertEqual('[2001:DB8::1]', utils.wrap_ipv6('[2001:DB8::1]'))
+
 
 class TempFilesTestCase(base.TestCase):
 
diff --git a/ironic/tests/unit/conductor/test_steps.py b/ironic/tests/unit/conductor/test_steps.py
index 09d267a..64317c1 100644
--- a/ironic/tests/unit/conductor/test_steps.py
+++ b/ironic/tests/unit/conductor/test_steps.py
@@ -585,6 +585,11 @@ class NodeCleaningStepsTestCase(db_base.DbTestCase):
             'abortable': False, 'argsinfo': None, 'interface': 'vendor',
             'priority': 1, 'requires_ramdisk': True,
             'step': 'log_passthrough'}
+        self.firmware_step = {
+            'abortable': False, 'argsinfo': {}, 'interface': 'firmware',
+            'priority': 0, 'requires_ramdisk': True,
+            'step': 'update'
+        }
 
         # Automated cleaning should be executed in this order
         self.clean_steps = [self.deploy_erase, self.power_update,
@@ -595,6 +600,8 @@ class NodeCleaningStepsTestCase(db_base.DbTestCase):
             'argsinfo': {'arg1': {'description': 'desc1', 'required': True},
                          'arg2': {'description': 'desc2'}}}
 
+    @mock.patch('ironic.drivers.modules.fake.FakeFirmware.get_clean_steps',
+                lambda self, taks: [])
     @mock.patch('ironic.drivers.modules.fake.FakeBIOS.get_clean_steps',
                 lambda self, task: [])
     @mock.patch('ironic.drivers.modules.fake.FakeDeploy.get_clean_steps',
@@ -619,6 +626,8 @@ class NodeCleaningStepsTestCase(db_base.DbTestCase):
 
         self.assertEqual(self.clean_steps, steps)
 
+    @mock.patch('ironic.drivers.modules.fake.FakeFirmware.get_clean_steps',
+                lambda self, task: [])
     @mock.patch('ironic.drivers.modules.fake.FakeVendorB.get_clean_steps',
                 lambda self, task: [])
     @mock.patch('ironic.drivers.modules.fake.FakeBIOS.get_clean_steps',
diff --git a/ironic/tests/unit/db/test_nodes.py b/ironic/tests/unit/db/test_nodes.py
index 3dee718..b10d367 100644
--- a/ironic/tests/unit/db/test_nodes.py
+++ b/ironic/tests/unit/db/test_nodes.py
@@ -15,6 +15,7 @@
 
 """Tests for manipulating Nodes via the DB API"""
 
+import copy
 import datetime
 from unittest import mock
 
@@ -29,6 +30,7 @@ from sqlalchemy.orm import exc as sa_orm_exc
 
 from ironic.common import exception
 from ironic.common import states
+from ironic.common import utils as common_utils
 from ironic.db.sqlalchemy import api as dbapi
 from ironic.db.sqlalchemy.api import Connection as db_conn
 from ironic.db.sqlalchemy.models import NodeInventory
@@ -1037,6 +1039,39 @@ class DbNodeTestCase(base.DbTestCase):
         res = self.dbapi.get_node_by_uuid(uuid)
         self.assertEqual(r1, res.reservation)
 
+    def test_reserve_node_reads_reservation_once_sqlite(self):
+        node = utils.create_test_node()
+        uuid = node.uuid
+
+        r1 = 'fake-reservation'
+
+        with mock.patch.object(db_conn, '_get_node_reservation',
+                               autospec=True) as mock_get_res:
+            mock_get_res.return_value = node
+            self.dbapi.reserve_node(r1, uuid)
+            mock_get_res.assert_called_once_with(mock.ANY, node.uuid)
+
+    @mock.patch.object(common_utils, 'is_ironic_using_sqlite', autospec=True)
+    def test_reserve_node_reads_reservation_twice(self, is_sqlite_mock):
+        # Ensure we re-query for who holds the reservation *when* lock fails
+        # to trigger.
+        node = utils.create_test_node()
+        uuid = node.uuid
+        is_sqlite_mock.return_value = False
+        r1 = 'fake-reservation'
+        self.dbapi.update_node(node.id, {'reservation': r1})
+        locked_node = copy.copy(node)
+        locked_node.reservation = r1
+        with mock.patch.object(db_conn, '_get_node_reservation',
+                               autospec=True) as mock_get_res:
+            mock_get_res.side_effect = [node, locked_node]
+            self.assertRaisesRegex(exception.NodeLocked,
+                                   'locked by host fake-reservation',
+                                   self.dbapi.reserve_node, r1, uuid)
+            mock_get_res.assert_has_calls([
+                mock.call(mock.ANY, node.uuid),
+                mock.call(mock.ANY, node.id)])
+
     def test_release_reservation(self):
         node = utils.create_test_node()
         uuid = node.uuid
diff --git a/ironic/tests/unit/drivers/modules/ilo/test_management.py b/ironic/tests/unit/drivers/modules/ilo/test_management.py
index f087c4d..9379954 100644
--- a/ironic/tests/unit/drivers/modules/ilo/test_management.py
+++ b/ironic/tests/unit/drivers/modules/ilo/test_management.py
@@ -1681,7 +1681,7 @@ class Ilo5ManagementTestCase(db_base.DbTestCase):
             ilo_mock_object.do_disk_erase.assert_called_once_with(
                 'HDD', 'overwrite')
             self.assertEqual(states.CLEANWAIT, result)
-            mock_power.assert_called_once_with(task, states.REBOOT)
+            mock_power.assert_called_once_with(task, states.REBOOT, None)
 
     @mock.patch.object(deploy_utils, 'build_agent_options',
                        autospec=True)
@@ -1712,7 +1712,7 @@ class Ilo5ManagementTestCase(db_base.DbTestCase):
             ilo_mock_object.do_disk_erase.assert_called_once_with(
                 'SSD', 'block')
             self.assertEqual(states.CLEANWAIT, result)
-            mock_power.assert_called_once_with(task, states.REBOOT)
+            mock_power.assert_called_once_with(task, states.REBOOT, None)
 
     @mock.patch.object(deploy_utils, 'build_agent_options',
                        autospec=True)
@@ -1746,7 +1746,7 @@ class Ilo5ManagementTestCase(db_base.DbTestCase):
             ilo_mock_object.do_disk_erase.assert_called_once_with(
                 'SSD', 'block')
             self.assertEqual(states.CLEANWAIT, result)
-            mock_power.assert_called_once_with(task, states.REBOOT)
+            mock_power.assert_called_once_with(task, states.REBOOT, None)
 
     @mock.patch.object(ilo_management.LOG, 'info', autospec=True)
     @mock.patch.object(ilo_management.Ilo5Management,
@@ -1802,7 +1802,7 @@ class Ilo5ManagementTestCase(db_base.DbTestCase):
             ilo_mock_object.do_disk_erase.assert_called_once_with(
                 'HDD', 'zero')
             self.assertEqual(states.CLEANWAIT, result)
-            mock_power.assert_called_once_with(task, states.REBOOT)
+            mock_power.assert_called_once_with(task, states.REBOOT, None)
 
     @mock.patch.object(ilo_management.LOG, 'info', autospec=True)
     @mock.patch.object(ilo_common, 'get_ilo_object', autospec=True)
diff --git a/ironic/tests/unit/drivers/modules/ilo/test_raid.py b/ironic/tests/unit/drivers/modules/ilo/test_raid.py
index fcb0314..c102a5d 100644
--- a/ironic/tests/unit/drivers/modules/ilo/test_raid.py
+++ b/ironic/tests/unit/drivers/modules/ilo/test_raid.py
@@ -84,7 +84,7 @@ class Ilo5RAIDTestCase(db_base.DbTestCase):
                 self.assertFalse(
                     task.node.driver_internal_info.get(
                         'skip_current_deploy_step'))
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
 
     def test__prepare_for_read_raid_create_raid_cleaning(self):
         self.node.clean_step = {'step': 'create_configuration',
@@ -122,7 +122,7 @@ class Ilo5RAIDTestCase(db_base.DbTestCase):
                 self.assertEqual(
                     task.node.driver_internal_info.get(
                         'skip_current_deploy_step'), False)
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
 
     def test__prepare_for_read_raid_delete_raid_cleaning(self):
         self.node.clean_step = {'step': 'create_configuration',
diff --git a/ironic/tests/unit/drivers/modules/redfish/test_bios.py b/ironic/tests/unit/drivers/modules/redfish/test_bios.py
index 1d30730..bccaad0 100644
--- a/ironic/tests/unit/drivers/modules/redfish/test_bios.py
+++ b/ironic/tests/unit/drivers/modules/redfish/test_bios.py
@@ -203,10 +203,11 @@ class RedfishBiosTestCase(db_base.DbTestCase):
             if fast_track:
                 mock_power_action.assert_has_calls([
                     mock.call(task, states.POWER_OFF),
-                    mock.call(task, states.REBOOT),
+                    mock.call(task, states.REBOOT, None),
                 ])
             else:
-                mock_power_action.assert_called_once_with(task, states.REBOOT)
+                mock_power_action.assert_called_once_with(
+                    task, states.REBOOT, None)
             if step == 'factory_reset':
                 bios.reset_bios.assert_called_once()
             if step == 'apply_configuration':
diff --git a/ironic/tests/unit/drivers/modules/redfish/test_firmware.py b/ironic/tests/unit/drivers/modules/redfish/test_firmware.py
 new file mode 100644
index 0000000..c3e984c
--- /dev/null
+++ b/ironic/tests/unit/drivers/modules/redfish/test_firmware.py
@@ -0,0 +1,40 @@
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from unittest import mock
+
+from oslo_utils import importutils
+
+from ironic.tests.unit.db import base as db_base
+from ironic.tests.unit.db import utils as db_utils
+from ironic.tests.unit.objects import utils as obj_utils
+
+sushy = importutils.try_import('sushy')
+
+INFO_DICT = db_utils.get_test_redfish_info()
+
+
[e-mail]('oslo_utils.eventletutils.EventletEvent.wait',
+            lambda *args, **kwargs: None)
+class RedfishFirmwareTestCase(db_base.DbTestCase):
+
+    def setUp(self):
+        super(RedfishFirmwareTestCase, self).setUp()
+        self.config(enabled_bios_interfaces=['redfish'],
+                    enabled_hardware_types=['redfish'],
+                    enabled_power_interfaces=['redfish'],
+                    enabled_boot_interfaces=['redfish-virtual-media'],
+                    enabled_management_interfaces=['redfish'],
+                    enabled_firmware_interfaces=['redfish'])
+        self.node = obj_utils.create_test_node(
+            self.context, driver='redfish', driver_info=INFO_DICT)
diff --git a/ironic/tests/unit/drivers/modules/redfish/test_management.py b/ironic/tests/unit/drivers/modules/redfish/test_management.py
index 1d752d9..3a9dca2 100644
--- a/ironic/tests/unit/drivers/modules/redfish/test_management.py
+++ b/ironic/tests/unit/drivers/modules/redfish/test_management.py
@@ -28,10 +28,12 @@ from ironic.common import states
 from ironic.conductor import task_manager
 from ironic.conductor import utils as manager_utils
 from ironic.conf import CONF
+from ironic.drivers.modules import boot_mode_utils
 from ironic.drivers.modules import deploy_utils
 from ironic.drivers.modules.redfish import boot as redfish_boot
 from ironic.drivers.modules.redfish import firmware_utils
 from ironic.drivers.modules.redfish import management as redfish_mgmt
+from ironic.drivers.modules.redfish import power as redfish_power
 from ironic.drivers.modules.redfish import utils as redfish_utils
 from ironic.tests.unit.db import base as db_base
 from ironic.tests.unit.db import utils as db_utils
@@ -268,8 +270,10 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                 boot_devices.PXE,
                 task.node.driver_internal_info['redfish_boot_device'])
 
+    @mock.patch.object(boot_mode_utils, 'sync_boot_mode', autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_boot_device_persistency_vendor(self, mock_get_system):
+    def test_set_boot_device_persistency_vendor(self, mock_get_system,
+                                                mock_sync_boot_mode):
         fake_system = mock_get_system.return_value
         fake_system.boot.get.return_value = \
             sushy.BOOT_SOURCE_ENABLED_CONTINUOUS
@@ -288,18 +292,16 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                                       shared=False) as task:
                 task.driver.management.set_boot_device(
                     task, boot_devices.PXE, persistent=True)
+                fake_system.set_system_boot_options.assert_called_once_with(
+                    sushy.BOOT_SOURCE_TARGET_PXE, enabled=expected)
                 if vendor == 'SuperMicro':
-                    fake_system.set_system_boot_options.assert_has_calls(
-                        [mock.call(sushy.BOOT_SOURCE_TARGET_PXE,
-                                   enabled=expected),
-                         mock.call(mode=sushy.BOOT_SOURCE_MODE_UEFI)])
+                    mock_sync_boot_mode.assert_called_once_with(task)
                 else:
-                    fake_system.set_system_boot_options.assert_has_calls(
-                        [mock.call(sushy.BOOT_SOURCE_TARGET_PXE,
-                                   enabled=expected)])
+                    mock_sync_boot_mode.assert_not_called()
 
                 # Reset mocks
                 fake_system.set_system_boot_options.reset_mock()
+                mock_sync_boot_mode.reset_mock()
                 mock_get_system.reset_mock()
 
     def test_restore_boot_device(self):
@@ -391,34 +393,46 @@ class RedfishManagementTestCase(db_base.DbTestCase):
             self.assertEqual(list(redfish_mgmt.BOOT_MODE_MAP_REV),
                              supported_boot_modes)
 
+    @mock.patch.object(redfish_mgmt.RedfishManagement, '_wait_for_boot_mode',
+                       autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_boot_mode(self, mock_get_system):
+    def test_set_boot_mode(self, mock_get_system, mock_wait):
         boot_attribute = {
             'target': sushy.BOOT_SOURCE_TARGET_PXE,
             'enabled': sushy.BOOT_SOURCE_ENABLED_CONTINUOUS,
-            'mode': sushy.BOOT_SOURCE_MODE_BIOS,
+            'mode': None,
         }
         fake_system = mock.Mock(boot=boot_attribute)
-        fake_system = mock.Mock()
         mock_get_system.return_value = fake_system
         with task_manager.acquire(self.context, self.node.uuid,
                                   shared=False) as task:
             expected_values = [
-                (boot_modes.LEGACY_BIOS, sushy.BOOT_SOURCE_MODE_BIOS),
-                (boot_modes.UEFI, sushy.BOOT_SOURCE_MODE_UEFI)
+                (boot_modes.LEGACY_BIOS, sushy.BOOT_SOURCE_MODE_BIOS,
+                 sushy.BOOT_SOURCE_MODE_UEFI),
+                (boot_modes.UEFI, sushy.BOOT_SOURCE_MODE_UEFI,
+                 sushy.BOOT_SOURCE_MODE_BIOS),
+                (boot_modes.LEGACY_BIOS, sushy.BOOT_SOURCE_MODE_BIOS, None),
+                (boot_modes.UEFI, sushy.BOOT_SOURCE_MODE_UEFI, None),
             ]
 
-            for mode, expected in expected_values:
+            for mode, expected, current in expected_values:
+                boot_attribute['mode'] = current
                 task.driver.management.set_boot_mode(task, mode=mode)
 
                 # Asserts
                 fake_system.set_system_boot_options.assert_called_once_with(
                     mode=expected)
                 mock_get_system.assert_called_once_with(task.node)
+                if current is not None:
+                    mock_wait.assert_called_once_with(task.driver.management,
+                                                      task, fake_system, mode)
+                else:
+                    mock_wait.assert_not_called()
 
                 # Reset mocks
                 fake_system.set_system_boot_options.reset_mock()
                 mock_get_system.reset_mock()
+                mock_wait.reset_mock()
 
     @mock.patch.object(sushy, 'Sushy', autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
@@ -462,6 +476,44 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                 mode=sushy.BOOT_SOURCE_MODE_UEFI)
             mock_get_system.assert_called_once_with(task.node)
 
+    @mock.patch.object(manager_utils, 'node_power_action', autospec=True)
+    def test_wait_for_boot_mode_immediate(self, mock_power):
+        fake_system = mock.Mock(spec=['boot', 'refresh'],
+                                boot={'mode': sushy.BOOT_SOURCE_MODE_UEFI})
+        with task_manager.acquire(self.context, self.node.uuid,
+                                  shared=False) as task:
+            task.driver.management._wait_for_boot_mode(
+                task, fake_system, boot_modes.UEFI)
+            fake_system.refresh.assert_called_once_with(force=True)
+            mock_power.assert_not_called()
+
+    @mock.patch('time.sleep', lambda _: None)
+    @mock.patch.object(redfish_power.RedfishPower, 'get_power_state',
+                       autospec=True)
+    @mock.patch.object(manager_utils, 'node_power_action', autospec=True)
+    def test_wait_for_boot_mode(self, mock_power, mock_get_power):
+        attempts = 3
+
+        def side_effect(force):
+            nonlocal attempts
+            attempts -= 1
+            if attempts <= 0:
+                fake_system.boot['mode'] = sushy.BOOT_SOURCE_MODE_UEFI
+
+        fake_system = mock.Mock(spec=['boot', 'refresh'],
+                                boot={'mode': sushy.BOOT_SOURCE_MODE_BIOS})
+        fake_system.refresh.side_effect = side_effect
+        with task_manager.acquire(self.context, self.node.uuid,
+                                  shared=False) as task:
+            task.driver.management._wait_for_boot_mode(
+                task, fake_system, boot_modes.UEFI)
+            fake_system.refresh.assert_called_with(force=True)
+            self.assertEqual(3, fake_system.refresh.call_count)
+            mock_power.assert_has_calls([
+                mock.call(task, states.REBOOT),
+                mock.call(task, mock_get_power.return_value),
+            ])
+
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
     def test_get_boot_mode(self, mock_get_system):
         boot_attribute = {
@@ -865,7 +917,8 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                 task.node, reboot=True, skip_current_step=True, polling=True)
             mock_get_async_step_return_state.assert_called_once_with(
                 task.node)
-            mock_node_power_action.assert_called_once_with(task, states.REBOOT)
+            mock_node_power_action.assert_called_once_with(
+                task, states.REBOOT, None)
 
     @mock.patch.object(redfish_mgmt.RedfishManagement, '_stage_firmware_file',
                        autospec=True)
@@ -919,7 +972,8 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                 task.node, reboot=True, skip_current_step=True, polling=True)
             mock_get_async_step_return_state.assert_called_once_with(
                 task.node)
-            mock_node_power_action.assert_called_once_with(task, states.REBOOT)
+            mock_node_power_action.assert_called_once_with(
+                task, states.REBOOT, None)
 
     @mock.patch.object(redfish_mgmt.RedfishManagement, '_stage_firmware_file',
                        autospec=True)
@@ -979,7 +1033,8 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                 task.node, reboot=True, skip_current_step=True, polling=True)
             mock_get_async_step_return_state.assert_called_once_with(
                 task.node)
-            mock_node_power_action.assert_called_once_with(task, states.REBOOT)
+            mock_node_power_action.assert_called_once_with(
+                task, states.REBOOT, None)
 
     def test_update_firmware_invalid_args(self):
         with task_manager.acquire(self.context, self.node.uuid,
@@ -1462,61 +1517,84 @@ class RedfishManagementTestCase(db_base.DbTestCase):
                               task.driver.management.get_secure_boot_state,
                               task)
 
+    @mock.patch.object(redfish_mgmt.RedfishManagement, '_wait_for_secure_boot',
+                       autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_secure_boot_state(self, mock_get_system):
+    def test_set_secure_boot_state(self, mock_get_system, mock_wait):
         fake_system = mock_get_system.return_value
         fake_system.secure_boot.enabled = False
         fake_system.boot = {'mode': sushy.BOOT_SOURCE_MODE_UEFI}
         with task_manager.acquire(self.context, self.node.uuid,
-                                  shared=True) as task:
+                                  shared=False) as task:
             task.driver.management.set_secure_boot_state(task, True)
             fake_system.secure_boot.set_enabled.assert_called_once_with(True)
+            mock_wait.assert_called_once_with(task.driver.management,
+                                              task, fake_system.secure_boot,
+                                              True)
 
+    @mock.patch.object(redfish_mgmt.RedfishManagement, '_wait_for_secure_boot',
+                       autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_secure_boot_state_boot_mode_unknown(self, mock_get_system):
+    def test_set_secure_boot_state_boot_mode_unknown(self, mock_get_system,
+                                                     mock_wait):
         fake_system = mock_get_system.return_value
         fake_system.secure_boot.enabled = False
         fake_system.boot = {}
         with task_manager.acquire(self.context, self.node.uuid,
-                                  shared=True) as task:
+                                  shared=False) as task:
             task.driver.management.set_secure_boot_state(task, True)
             fake_system.secure_boot.set_enabled.assert_called_once_with(True)
+            mock_wait.assert_called_once_with(task.driver.management,
+                                              task, fake_system.secure_boot,
+                                              True)
 
+    @mock.patch.object(redfish_mgmt.RedfishManagement, '_wait_for_secure_boot',
+                       autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_secure_boot_state_boot_mode_no_change(self, mock_get_system):
+    def test_set_secure_boot_state_boot_mode_no_change(self, mock_get_system,
+                                                       mock_wait):
         fake_system = mock_get_system.return_value
         fake_system.secure_boot.enabled = False
         fake_system.boot = {'mode': sushy.BOOT_SOURCE_MODE_BIOS}
         with task_manager.acquire(self.context, self.node.uuid,
-                                  shared=True) as task:
+                                  shared=False) as task:
             task.driver.management.set_secure_boot_state(task, False)
-            self.assertFalse(fake_system.secure_boot.set_enabled.called)
+            fake_system.secure_boot.set_enabled.assert_not_called()
+            mock_wait.assert_not_called()
 
+    @mock.patch.object(redfish_mgmt.RedfishManagement, '_wait_for_secure_boot',
+                       autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_secure_boot_state_boot_mode_incorrect(self, mock_get_system):
+    def test_set_secure_boot_state_boot_mode_incorrect(self, mock_get_system,
+                                                       mock_wait):
         fake_system = mock_get_system.return_value
         fake_system.secure_boot.enabled = False
         fake_system.boot = {'mode': sushy.BOOT_SOURCE_MODE_BIOS}
         with task_manager.acquire(self.context, self.node.uuid,
-                                  shared=True) as task:
+                                  shared=False) as task:
             self.assertRaisesRegex(
                 exception.RedfishError, 'requires UEFI',
                 task.driver.management.set_secure_boot_state, task, True)
-            self.assertFalse(fake_system.secure_boot.set_enabled.called)
+            fake_system.secure_boot.set_enabled.assert_not_called()
+            mock_wait.assert_not_called()
 
+    @mock.patch.object(redfish_mgmt.RedfishManagement, '_wait_for_secure_boot',
+                       autospec=True)
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
-    def test_set_secure_boot_state_boot_mode_fails(self, mock_get_system):
+    def test_set_secure_boot_state_boot_mode_fails(self, mock_get_system,
+                                                   mock_wait):
         fake_system = mock_get_system.return_value
         fake_system.secure_boot.enabled = False
         fake_system.secure_boot.set_enabled.side_effect = \
             sushy.exceptions.SushyError
         fake_system.boot = {'mode': sushy.BOOT_SOURCE_MODE_UEFI}
         with task_manager.acquire(self.context, self.node.uuid,
-                                  shared=True) as task:
+                                  shared=False) as task:
             self.assertRaisesRegex(
                 exception.RedfishError, 'Failed to set secure boot',
                 task.driver.management.set_secure_boot_state, task, True)
             fake_system.secure_boot.set_enabled.assert_called_once_with(True)
+            mock_wait.assert_not_called()
 
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
     def test_set_secure_boot_state_not_implemented(self, mock_get_system):
@@ -1528,11 +1606,76 @@ class RedfishManagementTestCase(db_base.DbTestCase):
 
         mock_get_system.return_value = NoSecureBoot()
         with task_manager.acquire(self.context, self.node.uuid,
-                                  shared=True) as task:
+                                  shared=False) as task:
             self.assertRaises(exception.UnsupportedDriverExtension,
                               task.driver.management.set_secure_boot_state,
                               task, True)
 
+    @mock.patch.object(manager_utils, 'node_power_action', autospec=True)
+    def test_wait_for_secure_boot_immediate(self, mock_power):
+        fake_sb = mock.Mock(spec=['enabled', 'refresh'], enabled=True)
+        with task_manager.acquire(self.context, self.node.uuid,
+                                  shared=False) as task:
+            task.driver.management._wait_for_secure_boot(task, fake_sb, True)
+            fake_sb.refresh.assert_called_once_with(force=True)
+            mock_power.assert_not_called()
+
+    @mock.patch('time.sleep', lambda _: None)
+    @mock.patch.object(redfish_power.RedfishPower, 'get_power_state',
+                       autospec=True)
+    @mock.patch.object(manager_utils, 'node_power_action', autospec=True)
+    def test_wait_for_secure_boot(self, mock_power, mock_get_power):
+        attempts = 3
+
+        def side_effect(force):
+            nonlocal attempts
+            attempts -= 1
+            if attempts <= 0:
+                fake_sb.enabled = True
+
+        fake_sb = mock.Mock(spec=['enabled', 'refresh'], enabled=False)
+        fake_sb.refresh.side_effect = side_effect
+        with task_manager.acquire(self.context, self.node.uuid,
+                                  shared=False) as task:
+            task.driver.management._wait_for_secure_boot(task, fake_sb, True)
+            fake_sb.refresh.assert_called_with(force=True)
+            self.assertEqual(3, fake_sb.refresh.call_count)
+            mock_power.assert_has_calls([
+                mock.call(task, states.REBOOT),
+                mock.call(task, mock_get_power.return_value),
+            ])
+
+    @mock.patch.object(redfish_mgmt, 'BOOT_MODE_CONFIG_INTERVAL', 0.1)
+    @mock.patch.object(redfish_power.RedfishPower, 'get_power_state',
+                       autospec=True)
+    @mock.patch.object(manager_utils, 'node_power_action', autospec=True)
+    def test_wait_for_secure_boot_timeout(self, mock_power, mock_get_power):
+        CONF.set_override('boot_mode_config_timeout', 1, group='redfish')
+        fake_sb = mock.Mock(spec=['enabled', 'refresh'], enabled=False)
+        with task_manager.acquire(self.context, self.node.uuid,
+                                  shared=False) as task:
+            self.assertRaisesRegex(
+                exception.RedfishError, 'Timeout reached',
+                task.driver.management._wait_for_secure_boot,
+                task, fake_sb, True)
+            fake_sb.refresh.assert_called_with(force=True)
+            mock_power.assert_called_once_with(task, states.REBOOT)
+
+    @mock.patch.object(redfish_power.RedfishPower, 'get_power_state',
+                       autospec=True)
+    @mock.patch.object(manager_utils, 'node_power_action', autospec=True)
+    def test_wait_for_secure_boot_no_wait(self, mock_power, mock_get_power):
+        CONF.set_override('boot_mode_config_timeout', 0, group='redfish')
+        fake_sb = mock.Mock(spec=['enabled', 'refresh'], enabled=False)
+        with task_manager.acquire(self.context, self.node.uuid,
+                                  shared=False) as task:
+            task.driver.management._wait_for_secure_boot(task, fake_sb, True)
+            fake_sb.refresh.assert_called_once_with(force=True)
+            mock_power.assert_has_calls([
+                mock.call(task, states.REBOOT),
+                mock.call(task, mock_get_power.return_value),
+            ])
+
     @mock.patch.object(redfish_utils, 'get_system', autospec=True)
     def test_reset_secure_boot_to_default(self, mock_get_system):
         with task_manager.acquire(self.context, self.node.uuid,
diff --git a/ironic/tests/unit/drivers/modules/redfish/test_raid.py b/ironic/tests/unit/drivers/modules/redfish/test_raid.py
index 843be73..e651d8b 100644
--- a/ironic/tests/unit/drivers/modules/redfish/test_raid.py
+++ b/ironic/tests/unit/drivers/modules/redfish/test_raid.py
@@ -406,7 +406,8 @@ class RedfishRAIDTestCase(db_base.DbTestCase):
                 task.node, reboot=True, skip_current_step=True, polling=True)
             mock_get_async_step_return_state.assert_called_once_with(
                 task.node)
-            mock_node_power_action.assert_called_once_with(task, states.REBOOT)
+            mock_node_power_action.assert_called_once_with(
+                task, states.REBOOT, None)
             mock_build_agent_options.assert_called_once_with(task.node)
             self.assertEqual(mock_prepare_ramdisk.call_count, 1)
             # Async operation, raid_config shouldn't be updated yet
@@ -1123,7 +1124,8 @@ class RedfishRAIDTestCase(db_base.DbTestCase):
                 task.node, reboot=True, skip_current_step=True, polling=True)
             mock_get_async_step_return_state.assert_called_once_with(
                 task.node)
-            mock_node_power_action.assert_called_once_with(task, states.REBOOT)
+            mock_node_power_action.assert_called_once_with(
+                task, states.REBOOT, None)
             mock_build_agent_options.assert_called_once_with(task.node)
             self.assertEqual(mock_prepare_ramdisk.call_count, 1)
             self.assertEqual(
diff --git a/ironic/tests/unit/drivers/modules/redfish/test_utils.py b/ironic/tests/unit/drivers/modules/redfish/test_utils.py
index 01b7089..5e91c15 100644
--- a/ironic/tests/unit/drivers/modules/redfish/test_utils.py
+++ b/ironic/tests/unit/drivers/modules/redfish/test_utils.py
@@ -168,6 +168,14 @@ class RedfishUtilsTestCase(db_base.DbTestCase):
         response = redfish_utils.parse_driver_info(self.node)
         self.assertEqual(self.parsed_driver_info, response)
 
+    def test_parse_driver_info_default_scheme_ipv6_brackets_added(self):
+        test_redfish_address = '2001:DB8::1'
+        self.node.driver_info['redfish_address'] = test_redfish_address
+        response = redfish_utils.parse_driver_info(self.node)
+        self.parsed_driver_info['address'] = ("https://[%s]"
+                                              % test_redfish_address)
+        self.assertEqual(self.parsed_driver_info, response)
+
     def test_get_task_monitor(self):
         redfish_utils._get_connection = mock.Mock()
         fake_monitor = mock.Mock()
diff --git a/ironic/tests/unit/drivers/modules/test_agent_base.py b/ironic/tests/unit/drivers/modules/test_agent_base.py
index c589d52..6d285cb 100644
--- a/ironic/tests/unit/drivers/modules/test_agent_base.py
+++ b/ironic/tests/unit/drivers/modules/test_agent_base.py
@@ -1593,7 +1593,7 @@ class AgentDeployMixinTest(AgentDeployMixinBaseTest):
             agent_base._post_step_reboot(task, 'clean')
             self.assertTrue(mock_build_opt.called)
             self.assertTrue(mock_prepare.called)
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
             self.assertTrue(task.node.driver_internal_info['cleaning_reboot'])
             self.assertNotIn('agent_secret_token',
                              task.node.driver_internal_info)
@@ -1612,7 +1612,7 @@ class AgentDeployMixinTest(AgentDeployMixinBaseTest):
             agent_base._post_step_reboot(task, 'deploy')
             self.assertTrue(mock_build_opt.called)
             self.assertTrue(mock_prepare.called)
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
             self.assertTrue(
                 task.node.driver_internal_info['deployment_reboot'])
             self.assertNotIn('agent_secret_token',
@@ -1633,7 +1633,7 @@ class AgentDeployMixinTest(AgentDeployMixinBaseTest):
             agent_base._post_step_reboot(task, 'clean')
             self.assertTrue(mock_build_opt.called)
             self.assertTrue(mock_prepare.called)
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
             self.assertIn('agent_secret_token',
                           task.node.driver_internal_info)
 
@@ -1649,7 +1649,7 @@ class AgentDeployMixinTest(AgentDeployMixinBaseTest):
         with task_manager.acquire(self.context, self.node['uuid'],
                                   shared=False) as task:
             agent_base._post_step_reboot(task, 'clean')
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
             mock_handler.assert_called_once_with(task, mock.ANY,
                                                  traceback=True)
             self.assertNotIn('cleaning_reboot',
@@ -1667,7 +1667,7 @@ class AgentDeployMixinTest(AgentDeployMixinBaseTest):
         with task_manager.acquire(self.context, self.node['uuid'],
                                   shared=False) as task:
             agent_base._post_step_reboot(task, 'deploy')
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
             mock_handler.assert_called_once_with(task, mock.ANY,
                                                  traceback=True)
             self.assertNotIn('deployment_reboot',
@@ -1686,7 +1686,7 @@ class AgentDeployMixinTest(AgentDeployMixinBaseTest):
         with task_manager.acquire(self.context, self.node['uuid'],
                                   shared=False) as task:
             agent_base._post_step_reboot(task, 'service')
-            mock_reboot.assert_called_once_with(task, states.REBOOT)
+            mock_reboot.assert_called_once_with(task, states.REBOOT, None)
             mock_handler.assert_called_once_with(task, mock.ANY,
                                                  traceback=True)
             self.assertNotIn('servicing_reboot',
@@ -1829,7 +1829,7 @@ class ContinueCleaningTest(AgentDeployMixinBaseTest):
         with task_manager.acquire(self.context, self.node['uuid'],
                                   shared=False) as task:
             self.deploy.continue_cleaning(task)
-            reboot_mock.assert_called_once_with(task, states.REBOOT)
+            reboot_mock.assert_called_once_with(task, states.REBOOT, None)
 
     @mock.patch.object(cleaning, 'continue_node_clean', autospec=True)
     @mock.patch.object(agent_client.AgentClient, 'get_commands_status',
@@ -2147,7 +2147,7 @@ class ContinueServiceTest(AgentDeployMixinBaseTest):
         with task_manager.acquire(self.context, self.node['uuid'],
                                   shared=False) as task:
             self.deploy.continue_servicing(task)
-            reboot_mock.assert_called_once_with(task, states.REBOOT)
+            reboot_mock.assert_called_once_with(task, states.REBOOT, None)
 
     @mock.patch.object(servicing, 'continue_node_service', autospec=True)
     @mock.patch.object(agent_client.AgentClient, 'get_commands_status',
diff --git a/ironic/tests/unit/drivers/modules/test_inspect_utils.py b/ironic/tests/unit/drivers/modules/test_inspect_utils.py
index f6f5ab0..a7b2ac2 100644
--- a/ironic/tests/unit/drivers/modules/test_inspect_utils.py
+++ b/ironic/tests/unit/drivers/modules/test_inspect_utils.py
@@ -442,6 +442,12 @@ class GetBMCAddressesTestCase(db_base.DbTestCase):
             driver_info={'redfish_address': 'https://192.0.2.1/redfish'})
         self.assertEqual({'192.0.2.1'}, utils._get_bmc_addresses(node))
 
+    def test_normal_ipv6_as_url(self):
+        node = obj_utils.create_test_node(
+            self.context,
+            driver_info={'redfish_address': 'https://[2001:db8::42]/redfish'})
+        self.assertEqual({'2001:db8::42'}, utils._get_bmc_addresses(node))
+
     @mock.patch.object(socket, 'getaddrinfo', autospec=True)
     def test_resolved_host(self, mock_getaddrinfo):
         mock_getaddrinfo.return_value = [
@@ -474,6 +480,12 @@ class GetBMCAddressesTestCase(db_base.DbTestCase):
         mock_getaddrinfo.assert_called_once_with(
             'example.com', None, proto=socket.SOL_TCP)
 
+    def test_redfish_bmc_address_ipv6_brackets_no_scheme(self):
+        node = obj_utils.create_test_node(
+            self.context,
+            driver_info={'redfish_address': '[2001:db8::42]'})
+        self.assertEqual({'2001:db8::42'}, utils._get_bmc_addresses(node))
+
 
 class LookupCacheTestCase(db_base.DbTestCase):
 
diff --git a/ironic/tests/unit/drivers/test_redfish.py b/ironic/tests/unit/drivers/test_redfish.py
index b692c61..be34fbf 100644
--- a/ironic/tests/unit/drivers/test_redfish.py
+++ b/ironic/tests/unit/drivers/test_redfish.py
@@ -33,7 +33,8 @@ class RedfishHardwareTestCase(db_base.DbTestCase):
                     enabled_boot_interfaces=['redfish-virtual-media'],
                     enabled_management_interfaces=['redfish'],
                     enabled_inspect_interfaces=['redfish'],
-                    enabled_bios_interfaces=['redfish'])
+                    enabled_bios_interfaces=['redfish'],
+                    enabled_firmware_interfaces=['redfish'])
 
     def test_default_interfaces(self):
         node = obj_utils.create_test_node(self.context, driver='redfish')
diff --git a/releasenotes/notes/23.0-prelude-bobcat-ad7c24f666c22ebf.yaml b/releasenotes/notes/23.0-prelude-bobcat-ad7c24f666c22ebf.yaml
 new file mode 100644
index 0000000..1c27277
--- /dev/null
+++ b/releasenotes/notes/23.0-prelude-bobcat-ad7c24f666c22ebf.yaml
@@ -0,0 +1,17 @@
+---
+prelude: |
+    Ironic is proud to announce the release of 23.0, the capstone release of a
+    six month OpenStack 2023.2 (Bobcat) cycle.
+
+    Our focus this cycle has been on improving the ability for operators to
+    secure and service their Ironic nodes. There are also, as always, a myriad
+    of quality of life fixes, including improvements to sqlite support,
+    and graceful shutdown of conductors.
+
+    We hope the latest release of Ironic serves you well!
+upgrade: |
+    Ironic 23.0 is part of the OpenStack 2023.2 (Bobcat) release. This a
+    non-SLURP release, meaning users of a 2023.1 (Antelope) cycle Ironic release
+    can upgrade directly to the release accompanying 2024.1 (Caracal) when
+    available. For more information, please visit
+    `Release Cadence Adjustment <https://governance.openstack.org/tc/resolutions/20220210-release-cadence-adjustment.html?_ga=2.126966605.1175089434.1694620440-1981816456.1685478379>`_.
diff --git a/releasenotes/notes/add-hold-states-7be5804d6f3a119a.yaml b/releasenotes/notes/add-hold-states-7be5804d6f3a119a.yaml
index 5eec68b..521e581 100644
--- a/releasenotes/notes/add-hold-states-7be5804d6f3a119a.yaml
+++ b/releasenotes/notes/add-hold-states-7be5804d6f3a119a.yaml
@@ -11,7 +11,7 @@ features:
     to start over.
   - |
     Adds the ability to send an ``unhold`` provision state verb utilizing
-    API version *1.84*.
+    API version *1.85*.
 other:
   - |
     Fixes the generated state machine diagram and updates it to match the
diff --git a/releasenotes/notes/bug-2036455-edd0e97335579684.yaml b/releasenotes/notes/bug-2036455-edd0e97335579684.yaml
 new file mode 100644
index 0000000..72a000b
--- /dev/null
+++ b/releasenotes/notes/bug-2036455-edd0e97335579684.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes an issue where inspection would fail if an IPv6 address wrapped in
+    brackets is used for the redfish BMC address. See bug:
+    `2036455 <https://bugs.launchpad.net/ironic/+bug/2036455>`_.
diff --git a/releasenotes/notes/firmware-interface-8ad6f91aa1f746a0.yaml b/releasenotes/notes/firmware-interface-8ad6f91aa1f746a0.yaml
 new file mode 100644
index 0000000..06964b1
--- /dev/null
+++ b/releasenotes/notes/firmware-interface-8ad6f91aa1f746a0.yaml
@@ -0,0 +1,31 @@
+---
+features:
+  - |
+    Adds Firmware Interface support to ironic, we would like to receive
+    feedback since this is a new feature we introduced and we as a developer
+    community have limited hardware access, reach out to us in case of any
+    unexpected behavior.
+
+    - Adds version 1.86 of the Bare Metal API, which includes:
+
+      * List all firmware components of a node via the
+        ``GET /v1/nodes/{node_ident}/firmware`` API.
+
+      * The ``firmware_interface`` field of the node resource. A firmware
+        interface can be set when creating or updating a node.
+
+      * The ``default_firmware_interface`` and ``enabled_firmware_interface``
+        fields of the driver resource.
+
+    - Adds new configuration options for the firmware interface feature:
+
+      * Firmware interfaces are enabled via
+        ``[DEFAULT]/enabled_firmware_interfaces``. A default firmware
+        interface to use when creating or updating nodes can be specified with
+        ``[DEFAULT]/default_firmware_interface``.
+
+    - Available interfaces: ``redfish``, ``no-firmware`` and ``fake``.
+
+    - Support to update firmware of BIOS and BMC via ``update`` step, can be
+      done via clean or deploy steps, the node should be using the
+      ``redfish`` driver and set the  ``firmware_interface``.
diff --git a/releasenotes/notes/remove-400a563030224c4f.yaml b/releasenotes/notes/remove-400a563030224c4f.yaml
 new file mode 100644
index 0000000..1ce686a
--- /dev/null
+++ b/releasenotes/notes/remove-400a563030224c4f.yaml
@@ -0,0 +1,9 @@
+---
+other:
+  - |
+    While investigating `bug 2033430 <https://bugs.launchpad.net/ironic/+bug/2033430>`_
+    we discovered we were emitting DHCP option 210 *only* with OVN, and never
+    emitted it with dnsmasq because it was not being set previously. Our
+    internal notes also indicated this was for PXELinux support, but was
+    never actually needed. As it was excess, and redundant configuration
+    being provided to Neutron, it has been removed.
diff --git a/releasenotes/notes/uefi-and-secureboot-waits-a783215327164e2c.yaml b/releasenotes/notes/uefi-and-secureboot-waits-a783215327164e2c.yaml
 new file mode 100644
index 0000000..44ae3c6
--- /dev/null
+++ b/releasenotes/notes/uefi-and-secureboot-waits-a783215327164e2c.yaml
@@ -0,0 +1,20 @@
+---
+fixes:
+  - |
+    While updating boot mode or secure boot state in the Redfish driver,
+    the node is now rebooted if the change is not detected on the System
+    resource refresh. Ironic then waits up to
+    ``[redfish]boot_mode_config_timeout`` seconds until the change is applied.
+upgrade:
+  - |
+    Changing the boot mode or the secure boot state via the direct API
+    (``/v1/nodes/{node_ident}/states/boot_mode`` and
+    ``/v1/nodes/{node_ident}/states/secure_boot`` accordingly) may now
+    result in a reboot. This happens when the change cannot be applied
+    immediately. Previously, the change would be applied whenever the next
+    reboot happens for any unrelated reason, causing inconsistent behavior.
+issues:
+  - |
+    When boot mode needs to be changed during provisioning, an additional
+    reboot may happen on certain hardware. This is to ensure consistent
+    behavior when any boot setting change results in a separate internal job.
diff --git a/releasenotes/source/2023.1.rst b/releasenotes/source/2023.1.rst
index d123847..dc91336 100644
--- a/releasenotes/source/2023.1.rst
+++ b/releasenotes/source/2023.1.rst
@@ -1,6 +1,6 @@
-===========================
-2023.1 Series Release Notes
-===========================
+=============================================
+2023.1 Series (21.2.0 - 21.4.x) Release Notes
+=============================================
 
 .. release-notes::
    :branch: stable/2023.1
diff --git a/setup.cfg b/setup.cfg
index c14a312..9f31ef9 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -86,6 +86,7 @@ ironic.hardware.interfaces.deploy =
 ironic.hardware.interfaces.firmware = 
 	fake = ironic.drivers.modules.fake:FakeFirmware
 	no-firmware = ironic.drivers.modules.noop:NoFirmware
+	redfish = ironic.drivers.modules.redfish.firmware:RedfishFirmware
 ironic.hardware.interfaces.inspect = 
 	agent = ironic.drivers.modules.inspector:AgentInspect
 	fake = ironic.drivers.modules.fake:FakeInspect
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 120a06e..ea1446a 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -60,7 +60,7 @@
             voting: false
         - ironic-inspector-tempest-rbac-scope-enforced:
             voting: false
-        - bifrost-integration-tinyipa-ubuntu-focal:
+        - bifrost-integration-tinyipa-ubuntu-jammy:
             voting: false
         - bifrost-integration-redfish-vmedia-uefi-centos-9:
             voting: false