ThinkPad L13 Gen 2 on LVFS?

nre commented 2 years ago

Hello @mrhpearson

Will the ThinkPad L13 Gen 2 be on LVFS?

My 20VH-CTO1WW isn't Yoga but they seem to share the same firmware updates. The Yoga is certified for Ubuntu 20.04 although it isn't on Lenovo's list. I did get an Ubuntu driver update for L13 Gen 2.

Thanks!

Previous issues: #101.

mrhpearson commented 2 years ago

Hi, L13 G2 should be on the list...it has completed it's certification. Not sure how that got missed. I'll go and bug the firmware team as to why the updates aren't on LVFS - they are supposed to be.

Mark

nre commented 2 years ago

@mrhpearson System firmware for vPro and non-vPro are in testing. Thank you!

Non-vPro versions >= 1.10 have a hard requirement on ME firmware 15.0.23.1706 but I don't see <requires> in the testing metadata.

I understand that it is still in testing. But the Vantage app (which I have no experience with because I don't have Windows) has not always respected this hard requirement and the result has been BSODs and at least one brick in July-August, December [1][2] and two days ago.

I think Linux users are even less likely to have the required ME version because the available installer is a non-capsule exe. (I installed it using WinPE on a thumb drive.)

The requirement is documented in the README: "Important! R1FET36W (1.10) or above requires MEFW 15.0.23.1706(R1FRG03W) update first, or system might run in problem."

hughsie commented 2 years ago

@mrhpearson if you want me to demote the firmware back to embargo say the word.

mrhpearson commented 2 years ago

Yeah - let's put it back to embargo and I'll send them a note on why. Thanks for flagging this.

hughsie commented 2 years ago

let's put it back to embargo

Done.

mrhpearson commented 2 years ago

Thanks - it was apparently a mistake for it to be in Testing in the first place, they had meant to put it in Embargo whilst they updated the metadata. We're expecting this to be ready next week

nre commented 2 years ago

@mrhpearson The non-vPro ME firmware 15.0.23.1706 (R1FRN17W) is now in testing without <requires>.

The README for package R1FRG03W (ME 15.0.23.1706 and other firmware updates) says "non Vpro system BIOS should be R1FET35W(v1.09) or later". (The complete dependency hell is described near the end: "Requires BIOS R1FET35W(v1.09) to update. Also, R1FET36W or above requires r1frg03w (MEFW version 15.0.23.1706) to update first.")

Is it worth checking that the requirement doesn't apply to this ME alone?

pshem commented 2 years ago

Windows 10 just updated my UEFI(to R1FET42W) without updating ME firmware first. Any tips for how I can update ME firmware/downgrade UEFI now to fix it? Linux(Ubuntu 21.04 specifically) kernel panics on booting, Windows crashes within a minute of booting, and the ISO on a USB stick (from https://support.lenovo.com/gb/en/downloads/ds541927-bios-update-utility-bootable-cd-for-windows-10-64-bit-thinkpad-l13-l13-yoga) doesn't get detected.

nre commented 2 years ago

@pshem That link is to BIOS for L13 Gen 1 but R1FET42W is for non-vPro L13 Gen 2. I suggest that you downgrade to L13 Gen 2 non-vPro BIOS v1.09 (scroll down to see the table with that BIOS) before updating ME. There is more info in Lenovo's forums and it is better to ask for help there.

pshem commented 2 years ago

@pshem That link is to BIOS for L13 Gen 1 but R1FET42W is for non-vPro L13 Gen 2. I suggest that you downgrade to L13 Gen 2 non-vPro BIOS v1.09 (scroll down to see the table with that BIOS) before updating ME. There is more info in Lenovo's forums and it is better to ask for help there.

Thank you, that explains why I couldn't get the numerical and letter versions of the BIOS version to match between the website and what I saw in the BIOS. I was able to follow https://askubuntu.com/questions/651281/write-bootable-bios-update-iso-to-usb-stick and downgrade to BIOS to 1.09 as you advised :D

xscd commented 2 years ago

Hello, apparently the non-vpro (https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadR1FRN.firmware) is on stable and I see the update when I run fwupdmgr update.

Screenshot from 2022-03-21 11-47-49

However I can't apply the update it just doesn't work, after reboot I see the LENOVO logo with something "applying firmware update" for a split of second but then it just reboots into fedora and I see the update is still available.

Thinks I have tried: disable secure boot and try return bios to defaults and try *run fwupdmgr with sudo

One more thing is I think I already have the latest update so this could be also a mismatch of the version algorithm? Here is my BIOS and ME version: photo_2022-03-21_14-05-51

In the screenshot of fwupdmgr the update shows as 0.23.1706 to 240.0.23.1706 but I already have 15.0.23.1706 on my BIOS. So I am confused what these "0", "15" and "240" is on front of 23.1706 (https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadR1FRN.firmware also mentions the 15 and 240 numbers) so I got a little confused of whats going on and why the update can't be applied (or if its applied but there is a problem somewhere that still shows an update available)

xscd commented 2 years ago

This seems related to #89

mrhpearson commented 2 years ago

Hold off on the ME FW update - that is still under testing and it does look like they have something wonky going on with the numbers (I'll flag it to the FW team) The BIOS FW is now in stable: https://fwupd.org/lvfs/firmware/9503 but I'm seeing a failed report against that. I don't have that system to test against unfortunately. I'm flagging that to the team as well. What a mess :(

tjyrinki commented 2 years ago

Just stating (the probably obvious) that I've a non-VPro L13 Gen 2 laptop which is on R1FET40W and no upgrades are being offered. Reading above, I'll restrain myself from experimenting and simply keep on R1FET40W until fwupdmgr tells me otherwise some sunny day... mostly the power related fixes in R1FET42W would be probably beneficial.

mrhpearson commented 2 years ago

Just as a note - FW has been promoted to testing for the L13 G2. https://fwupd.org/lvfs/firmware/11087 https://fwupd.org/lvfs/firmware/11082 I would still recommend waiting for it to move to stable...but I'm told that internal testing so far has been positive

xscd commented 2 years ago

Thanks for the update @mrhpearson however the links you provided aren't valid? Or they aren't visible yet since its in testing? Its the https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadR1FRN.firmware 15.0.35.1951 update you talk about I assume.

xscd commented 2 years ago

Also anyone in this thread wild enough to try it out? Let us know how it went :)

xscd commented 2 years ago

I successfully updated it!

But there seems an issue with versioning. fwupdmgr thinks there is an update but I just applied it:

mrhpearson commented 2 years ago

Oh - we've had a lot of issues with ME versioning...but that one is a new one. Excuse me while I go and headbutt a wall....

Could you do me a favour and check what version is reported in the BIOS setup screen (F1 during early boot).

Thanks Mark

PS - sorry for the slow reply, I lost a bunch of emails in my inbox, and am catching up again.

xscd commented 2 years ago

Hi Mark, I actually posted it already above :laughing: I hope this is it? If you need any other info let me know. Happy to help!

mrhpearson commented 2 years ago

Doh - sorry...not sure how I missed that.

OK - so good news is this looks like something wonky in how the ME is reporting the version to the ESRT tables. We've had a ton of issues where it hasn't been updating it so this is new that it's putting in a bad value...sigh.

Could you check what is reported in the esrt tables so we can confirm that is what is wrong. I think if you do this: find /sys/firmware/efi/esrt/entries -name fw_version -exec cat {} \; that should dump the values and I can figure it out from there.

Thanks!

xscd commented 2 years ago

[tree@fedora ~]$ sudo find /sys/firmware/efi/esrt/entries -name fw_version -exec cat {} \;
16777218
1
65554
1
0
1
4028827551
1409356129
10001
1
1
2295711

mrhpearson commented 2 years ago

@hughsie - think I might need your help interpreting numbers here...not sure if this is fwupd or metainfo issue or something else. Would you mind double checking my logic please?

4028827551 = 0xF023079f 0x79f = 1951 (correct) 0x23 = 35 (correct) 0xF0 = 240 (correct for triplet format - and = 15.0 for the ME's weirdo quad format)

So I'm not sure fwupdmgr in the above thinks the version is 0.35.1951. That seems wrong.

I checked the metainfo has the format stored as triplet so am not sure why the top byte seemingly gets dropped. I haven't looked at code yet I'm afraid :)

Mark

mrhpearson commented 2 years ago

just as a note - both the System FW and ME FW have been moved to stable, which was ultimately what this ticket was raised for...so that's solved. I won't close it until we get confirmation on the weird display issues for the ME FW

MartijnVdS commented 2 years ago

For some reason, this (Lenovo) update popped up on my MSI Summit E13 Evo Flip, which seems incorrect and potentially dangerous.

I have not tried to install the update, as I need this machine to work.

# fwupdmgr get-upgrades
Devices with no available firmware updates: 
 • Micron 3400 MTFDKBA1T0TFH
 • System Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI dbx
MS-13P2
│
└─Intel Management Engine:
  │   Device ID:          2292ae5236790b47884e37cf162dcf23bfcd1c60
  │   Summary:            UEFI ESRT device
  │   Current version:    0.30.1776
  │   Vendor:             Lenovo (DMI:Micro-Star International Co., Ltd.)
  │   Update State:       Success
  │   GUID:               19aef08f-2701-4db3-b90b-d4bc1412ade7
  │   Device Flags:       • Internal device
  │                       • Updatable
  │                       • System requires external power source
  │                       • Supported on remote server
  │                       • Needs a reboot after installation
  │                       • Device is usable for the duration of the update
  │ 
  └─ThinkPad L13 Gen 2:
        New version:      240.35.1951
        Remote ID:        lvfs
        Release ID:       13426
        Summary:          Lenovo ThinkPad L13 Gen 2 Consumer ME Firmware
        License:          Proprietary
        Size:             4,1 MB
        Created:          2016-07-08
        Urgency:          High
        Details:          https://pcsupport.lenovo.com/de/en/search?query=R1FRN18W
        Vendor:           Lenovo
        Release Flags:    • Is upgrade
        Description:      
        description (en_US): Lenovo ThinkPad L13 gen2 Consumer ME Firmware

hughsie commented 2 years ago

this (Lenovo) update popped up on my MSI Summit E13 Evo Flip

Totally unexpected. Can you attach a fwupdmgr get-devices --json please. The vendor ID will stop the update being applied (phew), but one of the vendors is doing a Bad Thing (tm).

hughsie commented 2 years ago

@mrhpearson in the meantime, can you check if the Lenovo ThinkPad L13 ME GUID is actually generated, rather than using some kind of default value please. Two vendors generating the same GUID seems hugely implausible.

hughsie commented 2 years ago

It also looks like that GUID is used on a Asus TUF Dash F15 FX516PM Laptop too. @mrhpearson I think you probably need to escalate and file an issue internally.

MartijnVdS commented 2 years ago

this (Lenovo) update popped up on my MSI Summit E13 Evo Flip

Totally unexpected. Can you attach a fwupdmgr get-devices --json please. The vendor ID will stop the update being applied (phew), but one of the vendors is doing a Bad Thing (tm).

Here it is: fwupdmgr.json

mrhpearson commented 2 years ago

Ack - and confirming with the FW team. For my reference - internal ticket LO-1765

hughsie commented 2 years ago

Fwiw, we can DMI lock the L13 firmware if needed, but we'd need to coordinate with the ME team as all future updates for that ID would need DMI requirements too.

achimfrase commented 2 years ago

I also get this update notification. I didn't try to install it because it looks totally wrong and dangerous to me.

$ fwupdmgr get-updates Geräte mit keinen verfügbaren Firmware-Aktualisierungen: • System Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI dbx • WDC WDS100T2B0C-00PXH0 NUC11TNKi5 │ └─Intel Management Engine: │ Gerätekennung: 2292ae5236790b47884e37cf162dcf23bfcd1c60 │ Zusammenfassung: UEFI ESRT device │ Aktuelle Version: 0.35.1898 │ Anbieter: Lenovo (DMI:Intel Corp.) │ Aktualisierungsstatus:Erfolg │ GUID: 19aef08f-2701-4db3-b90b-d4bc1412ade7 │ Device Flags: • Internes Gerät │ • Aktualisierbar │ • System benötigt externe Stromquelle │ • Unterstützt auf dem entfernten Server │ • Benötigt einen Neustart nach der Installation │ • Das Gerät ist während der Dauer der Aktualisierung nutzbar │ └─ThinkPad L13 Gen 2: Neue Version: 240.35.1951 Remote ID: lvfs Release ID: 13426 Zusammenfassung: Lenovo ThinkPad L13 Gen 2 Consumer ME Firmware Lizenz: Proprietär Größe: 4,1 MB Erstellt: 2016-07-08 Dringlichkeit: Hoch Details: https://pcsupport.lenovo.com/de/en/search?query=R1FRN18W Anbieter: Lenovo nuc11.txt

    Release Flags:    • Is upgrade
    Beschreibung:     
    description (en_US): Lenovo ThinkPad L13 gen2 Consumer ME Firmware

hughsie commented 2 years ago

I've moved the firmware out of the stable remote, it's not even had one success report yet. I'll defer to @mrhpearson for the medium term plan.

mrhpearson commented 2 years ago

Thanks @hughsie - waiting for an update from the FW team I'm afraid

Just curious that this is showing up on multiple devices (@achimfrase - what is your system?). Seems very peculiar that we've got what looks like a GUID clash on more than two different platforms...

hughsie commented 2 years ago

@achimfrase has a Intel® NUC 11 Pro Kit NUC11TNKi5 -- so I suspect the ME GUID is the reference one from Intel...

ghost commented 2 years ago

@achimfrase has a Intel® NUC 11 Pro Kit NUC11TNKi5 -- so I suspect the ME GUID is the reference one from Intel...

Also offered for another NUC11 model - this one a PABi7. Something is seriously wrong with this picture. I know not to install this because I have no idea what the ramifications are, since Intel themselves don't have a similar version number for NUC11's, but I can just imagine that it's something bad. Any other user might install this and brick their whole computer right out of their warranty (firmware update issues are excluded from warranty service). The update needs to be pulled entirely and fwupd needs to have its device categorization routines examined more thoroughly so this never happens again in the future.

hughsie commented 2 years ago

Any other user might install this and brick their whole computer

The update won't be signed using the correct key, so even if it was deployed it wouldn't be used. I don't even think it can be deployed for new fwupd updates as the vendor ID is wrong.

The update needs to be pulled entirely

It's been moved out of the stable remote while we work out what happened.

fwupd needs to have its device categorization routines examined more thoroughly

The update says "I install onto 19aef08f-2701-4db3-b90b-d4bc1412ade7" and it seems at least 4 different machines seem to share this "Globally Unique" ID, so there have been some problems along the chain somewhere. We've got quite a few layers of protection, so please don't worry.

xscd commented 2 years ago

It's been moved out of the stable remote while we work out what happened.

Its still in stable FYI or was there some progress that fixed appearing on wrong vendors?

hughsie commented 2 years ago

that fixed appearing on wrong vendors

Ya, we added a CHID requirement for Lenovo systems, and updated the LVFS so we always require a CHID for those GUIDs.

tjyrinki commented 2 years ago

Same as xscd, the ME update shows up on an actual L13 Gen 2 (Lenovo Ubuntu pre-installed variant) even though the version is the "same" (sans 0/240) already.

And after "update", it both allows sending a report about the successful update and doing the update yet again - and I can guess, looping forever.

nre commented 2 years ago

fwupd reads the versions correctly. Another device has the full version that we expect for ME:

"Intel Management Engine": Version 1509034 == 0x1706aa == 0.23.1706
"UEFI Device Firmware": Version 4028040874 == 0xf01706aa == 240.23.1706 == 15.0.23.1706

 FwupdDevice:
  DeviceId:             a45df35ac0e948ee180fe216a5f703f32dda163f
  Name:                 Intel Management Engine
  Guid:                 19aef08f-2701-4db3-b90b-d4bc1412ade7
  Guid:                 950e547f-0090-5a43-a74f-497902f980a9
  Summary:              UEFI ESRT device
  Plugin:               uefi_capsule
  Protocol:             org.uefi.capsule
  Flags:                internal|updatable|require-ac|supported|registered|needs-reboot|usable-during-update
  Vendor:               Lenovo
  VendorId:             DMI:LENOVO
  Version:              0.23.1706
  VersionFormat:        triplet
  VersionRaw:           0x001706aa
  Icon:                 audio-card
  Created:              2022-06-17
  UpdateState:          success

FwupdDevice:
  DeviceId:             a083ebc5138e5e071ef7270cc9a8280722cc7adf
  Name:                 UEFI Device Firmware
  Guid:                 bc7f67ec-c74a-424a-9575-305f278a37bd
  Guid:                 aa3c65b2-df2a-595f-956e-43b4d16b1f3a
  Summary:              UEFI ESRT device
  Plugin:               uefi_capsule
  Protocol:             org.uefi.capsule
  Flags:                internal|updatable|require-ac|registered|needs-reboot|usable-during-update
  VendorId:             DMI:LENOVO
  Version:              4028040874
  VersionLowest:        1
  VersionFormat:        number
  VersionRaw:           0xf01706aa
  VersionLowestRaw:     0xf01706aa
  Icon:                 audio-card
  Created:              2022-06-17
  UpdateState:          success

FuDevice      using a45df35ac0e948ee180fe216a5f703f32dda163f for /sys/firmware/efi/esrt/entries/entry0
FuPlugin      emit added from uefi_capsule: a45df35ac0e948ee180fe216a5f703f32dda163f
XbSilo        ignoring for OR statement: indexed string '950e547f-0090-5a43-a74f-497902f980a9' was unfound
FuEngine      HWID provided 6de5d951-d755-576b-bd09-c5cf66b27234
XbSilo        ignoring for OR statement: element name suggests is unknown in silo
XbSilo        ignoring for OR statement: element name X-categories is unknown in silo
FuDevice      a45df35ac0e948ee180fe216a5f703f32dda163f device overwriting name value: UEFI Device Firmware->Intel Management Engine
FuDevice      changing verfmt for a45df35ac0e948ee180fe216a5f703f32dda163f: number->triplet
FuDevice      changing version for a45df35ac0e948ee180fe216a5f703f32dda163f: 1509034->0.23.1706
FuPlugin      fu_plugin_device_registered(dell_dock)
FuPlugin      fu_plugin_device_registered(pci_bcr)
FuPlugin      fu_plugin_device_registered(thunderbolt)
FuPlugin      fu_plugin_device_registered(tpm)
FuPlugin      fu_plugin_device_registered(uefi_pk)
FuPlugin      fu_plugin_device_registered(usi_dock)
FuPlugin      fu_plugin_device_registered(msr)
FuPlugin      fu_plugin_device_registered(uefi_capsule)
FuDeviceList  ::added a45df35ac0e948ee180fe216a5f703f32dda163f

FuDevice      using a083ebc5138e5e071ef7270cc9a8280722cc7adf for /sys/firmware/efi/esrt/entries/entry8
FuPlugin      emit added from uefi_capsule: a083ebc5138e5e071ef7270cc9a8280722cc7adf
XbSilo        ignoring for OR statement: indexed string 'bc7f67ec-c74a-424a-9575-305f278a37bd' was unfound
FuPlugin      fu_plugin_device_registered(dell_dock)
FuPlugin      fu_plugin_device_registered(pci_bcr)
FuPlugin      fu_plugin_device_registered(thunderbolt)
FuPlugin      fu_plugin_device_registered(tpm)
FuPlugin      fu_plugin_device_registered(uefi_pk)
FuPlugin      fu_plugin_device_registered(usi_dock)
FuPlugin      fu_plugin_device_registered(msr)
FuPlugin      fu_plugin_device_registered(uefi_capsule)
FuDeviceList  ::added a083ebc5138e5e071ef7270cc9a8280722cc7adf

/sys/firmware/efi/esrt/entries/entry0
capsule_flags: 0x0
fw_class: 19aef08f-2701-4db3-b90b-d4bc1412ade7
fw_type: 2
fw_version: 1509034
last_attempt_status: 0
last_attempt_version: 0
lowest_supported_fw_version: 0

/sys/firmware/efi/esrt/entries/entry8
capsule_flags: 0x8010
fw_class: bc7f67ec-c74a-424a-9575-305f278a37bd
fw_type: 2
fw_version: 4028040874
last_attempt_status: 0
last_attempt_version: 0
lowest_supported_fw_version: 1

xscd commented 1 year ago

thinkpad l13 users getting titanium firmware updates. cc @mrhpearson

Screenshot from 2022-07-22 14-01-40

ganchair commented 1 year ago

Can someone here try to apply the latest BIOS update and see if they will encounter an error like this: https://forums.lenovo.com/t5/ThinkPad-L-R-and-SL-series-Laptops/Intel-L13-GEN-2-20VJ-Wrong-BIOS-Image-Is-Being-Distributed-On-The-Support-Page/m-p/5161220

It may related to Intel ME firmware so I am a little stuck and need some additional info. Would be good that someone with 15.0.23.1706 Intel ME firmware can update their BIOS with 1.19 (https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-l-series-laptops/thinkpad-l13-gen-2-type-20vh-20vj/downloads/driver-list/component?name=BIOS%2FUEFI)

Disclosure: I am @xscd. This is my successor GitHub account.

nre commented 1 year ago

Non-vPro BIOS 1.20 was released on LVFS stable three days ago but it <requires><firmware compare="ge" version="240.35.1951">19aef08f-2701-4db3-b90b-d4bc1412ade7</firmware></requires>.

ME firmware 240.35.1951 has been in LVFS testing since July and has never been on https://pcsupport.lenovo.com for L13 gen 2 so I presume that Windows users never got it (unless Vantage has it).

BIOS 1.20 has been on https://pcsupport.lenovo.com for the past month for Windows users (but not other users because the ISO version is faulty).

@mrhpearson

Does BIOS 1.20 really require ME 240.35.1951 if Windows users don't have that?
Is it safe to release ME 240.35.1951 now that the GUID problem is fixed?
Does BIOS 1.20 fix the ME-version problem or will ME 240.35.1951 fix that when it is released?

ganchair commented 1 year ago

hi @nre I have ME firmware 240.35.1951 installed yet I don't see the non-vpro bios update from fwupd. about the faulty bios image there is a new v3 release but that also failed to install with a different error. https://forums.lenovo.com/t5/ThinkPad-L-R-and-SL-series-Laptops/Intel-L13-GEN-2-20VJ-Wrong-BIOS-Image-Is-Being-Distributed-On-The-Support-Page/m-p/5161220?page=1#5752369

ganchair commented 1 year ago

about the 240.35.1951 firmware if I remember right there was a short period of time where it was listed in pcsupport lenovo but then taken down.

ganchair commented 1 year ago

tried the V3 image with defaulting my BIOS led to a stuck bios update session (waited over 30 mins) had to shutdown my device. nothing bad happened nothing updated guess that V3 image is also borked.

mrhpearson commented 1 year ago

Afraid I don't know the answers to those questions. @ChiWei-Chen - do you?

Mark

nre commented 1 year ago

@ganchair If fwupd thinks your ME firmware version is 0.35.1951 (because of the ME-version problem) then it will also think that it doesn't meet the requirement of >= 240.35.1951.

Otherwise check that you are on mains power instead of battery and that you don't have Boot Order Lock enabled in BIOS. I think fwupdmgr get-devices -vvvv showed me those problems when I had them.

ganchair commented 1 year ago

yes it thinks like that.

(fwupdmgr:37354): FuMain-DEBUG: 23:17:02.323: FwupdDevice:
  DeviceId:             a45df35ac0e948ee180fe216a5f703f32dda163f
  Name:                 Intel Management Engine
  Guid:                 19aef08f-2701-4db3-b90b-d4bc1412ade7
  Summary:              UEFI ESRT device
  Plugin:               uefi_capsule
  Protocol:             org.uefi.capsule
  Flags:                internal|updatable|require-ac|registered|needs-reboot|usable-during-update
  Vendor:               Lenovo
  VendorId:             DMI:LENOVO
  Version:              0.35.1951
  VersionFormat:        triplet
  VersionRaw:           0x0023079f
  Created:              2022-09-26
  UpdateState:          success

fwupd / firmware-lenovo

ThinkPad L13 Gen 2 on LVFS? #172