Open rugubara opened 2 years ago
mrhpearson
commented
2 years ago Hi, Which FW did you update? And did it update cleanly and with no errors displayed. I can flag this to the FW team, it's not expected behaviour, but I want to make sure they know which update to focus on. Thanks Mark
rugubara
commented
2 years ago I think it was the System firmware on 2022-01-19 0.1.43 to 0.1.44. If I read the history correctly, other updates didn't succeed due to boot entry reset.
PF16W6Y2 /var/tmp/portage/sys-devel/gcc-11.2.1_p20220115/temp # fwupdmgr get-history
20M90019RT
│
├─UEFI Device Firmware:
│ │ Device ID: 0f3c64df11304fc5711ef77a93e3e042e2738907
│ │ Previous version: 0.1.15
│ │ Update State: Success
│ │ Last modified: 2019-12-21 13:21
│ │ GUID: 88b8ba7e-296b-4f9e-929f-dcc19318dbcf
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 0.1.16
│ License: Unknown
│
├─SAMSUNG MZVLB512HAJQ-000L7:
│ │ Device ID: c6a0cfba7c7d81e253fce571e1d1e9f6003ae1c7
│ │ Previous version: 4L2QEXA7
│ │ Update State: Success
│ │ Last modified: 2020-03-14 19:30
│ │ GUID: 6e54c992-d302-59ab-b454-2d26ddd63e6d
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 5L2QEXA7
│ License: Unknown
│
├─System Firmware:
│ │ Device ID: 65b6a9dc7b7df18bdff003584b51bf21373e3aa6
│ │ Previous version: 0.1.40
│ │ Update State: Success
│ │ Last modified: 2021-04-27 20:51
│ │ GUID: 1e1fe415-74e8-49e1-9508-106b3d13d50d
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Cryptographic hash verification is available
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 0.1.41
│ Remote ID: lvfs
│ License: Unknown
│
├─Intel Management Engine:
│ │ Device ID: 619057f1d0da67b3fa4e9f74e09fc9218ce32643
│ │ Previous version: 192.70.1652
│ │ Update State: Failed
│ │ Update Error: (null)/fwupdx64.efi cannot be found
│ │ Last modified: 2021-06-16 07:08
│ │ GUID: 971682af-21a0-46e3-91c0-825702c2ba70
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 192.72.1757
│ Remote ID: lvfs
│ License: Unknown
│
├─Intel Management Engine:
│ │ Device ID: 349bb341230b1a86e5effe7dfe4337e1590227bd
│ │ Previous version: 192.70.1652
│ │ Update State: Transient failure
│ │ Update Error: boot entry missing; perhaps 'Boot Order Lock' enabled in the BIOS: no 'Linux Firmware Updater' entry found
│ │ Last modified: 2022-01-19 17:52
│ │ GUID: 971682af-21a0-46e3-91c0-825702c2ba70
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Device is usable for the duration of the update
│ │
│ └─ThinkPad P52/P72:
│ New version: 192.81.1753
│ Remote ID: lvfs
│ Release ID: 8841
│ Summary: Lenovo ThinkPad P52/P72 Corporate ME Firmware
│ License: Proprietary
│ Size: 12,2 MB
│ Created: 2021-06-07
│ Urgency: High
│ Details: https://pcsupport.lenovo.com/de/en/search?query=N2CRM29W
│ Vendor: Lenovo
│ Flags: is-upgrade
│ Description:
│ • 0 Intel Platform Update
│
│ Version 12.0.81.1753 (LVFS: 192.81.1753)
│
│ Problem Fixes
│
│ • Intel CSME PSIRT-TA-00459 IPU 2021.1
│ • Mitigated the following security vulnerability under issues
│
└─System Firmware:
│ Device ID: a45df35ac0e948ee180fe216a5f703f32dda163f
│ Previous version: 0.1.43
│ Update State: Success
│ Last modified: 2022-01-19 17:53
│ GUID: 1e1fe415-74e8-49e1-9508-106b3d13d50d
│ Device Flags: • Internal device
│ • Updatable
│ • System requires external power source
│ • Supported on remote server
│ • Needs a reboot after installation
│ • Reported to remote server
│ • Device is usable for the duration of the update
│
└─ThinkPad P52/P72:
New version: 0.1.44
Remote ID: lvfs
Release ID: 10904
Summary: Lenovo ThinkPad P52/P72 System Firmware
License: Proprietary
Size: 16,2 MB
Created: 2021-10-28
Urgency: Critical
Vendor: Lenovo
Description:
Lenovo ThinkPad P52P72 System Firmware Version 1.44
Important updates:
• Update includes a security fix.
New functions or enhancements:
• Updated the CPU microcode.
• Updated the Diagnostics module to version 04.18.000.
Feedback from the FW team is the only time they'll be touching the efi variables is if you go into the setup and reset to defaults. Otherwise they shouldn't be touching them. We're trying to reproduce but so far haven't been sucessful
rugubara
commented
2 years ago Another update I installed on my P52, and again the boot entries were reset. i suspected that it might happen and I captured the efibootmgr output just before the update and just after. 20220507.txt
PF16W6Y2 ~ # fwupdmgr get-history
20M90019RT
│
├─UEFI Device Firmware:
│ │ Device ID: 0f3c64df11304fc5711ef77a93e3e042e2738907
│ │ Previous version: 0.1.15
│ │ Update State: Success
│ │ Last modified: 2019-12-21 13:21
│ │ GUID: 88b8ba7e-296b-4f9e-929f-dcc19318dbcf
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 0.1.16
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─SAMSUNG MZVLB512HAJQ-000L7:
│ │ Device ID: c6a0cfba7c7d81e253fce571e1d1e9f6003ae1c7
│ │ Previous version: 4L2QEXA7
│ │ Update State: Success
│ │ Last modified: 2020-03-14 19:30
│ │ GUID: 6e54c992-d302-59ab-b454-2d26ddd63e6d
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 5L2QEXA7
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─System Firmware:
│ │ Device ID: 65b6a9dc7b7df18bdff003584b51bf21373e3aa6
│ │ Previous version: 0.1.40
│ │ Update State: Success
│ │ Last modified: 2021-04-27 20:51
│ │ GUID: 1e1fe415-74e8-49e1-9508-106b3d13d50d
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Cryptographic hash verification is available
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 0.1.41
│ Remote ID: lvfs
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─Intel Management Engine:
│ │ Device ID: 619057f1d0da67b3fa4e9f74e09fc9218ce32643
│ │ Previous version: 192.70.1652
│ │ Update State: Failed
│ │ Update Error: (null)/fwupdx64.efi cannot be found
│ │ Last modified: 2021-06-16 07:08
│ │ GUID: 971682af-21a0-46e3-91c0-825702c2ba70
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 192.72.1757
│ Remote ID: lvfs
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─Intel Management Engine:
│ │ Device ID: 349bb341230b1a86e5effe7dfe4337e1590227bd
│ │ Previous version: 192.70.1652
│ │ Update State: Transient failure
│ │ Update Error: boot entry missing; perhaps 'Boot Order Lock' enabled in the BIOS: no 'Linux Firmware Updater' entry found
│ │ Last modified: 2022-05-07 13:35
│ │ GUID: 971682af-21a0-46e3-91c0-825702c2ba70
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Device is usable for the duration of the update
│ │
│ └─ThinkPad P52/P72:
│ New version: 192.85.1869
│ Remote ID: lvfs
│ Release ID: 11618
│ Summary: Lenovo ThinkPad P52/P72 Corporate ME Firmware
│ License: Proprietary
│ Size: 12,2 MB
│ Created: 2021-11-10
│ Urgency: High
│ Details: https://pcsupport.lenovo.com/de/en/search?query=N2CRG30W
│ Vendor: Lenovo
│ Release Flags: • Is upgrade
│ Description:
│ • 0 Intel Platform Update
│
│ Version 12.0.85.1869 (LVFS: 192.85.1869)
│
│ Problem Fixes
│
│ • Intel TA-00575 IPU 2021.2 CSME
│ • Mitigated the following security vulnerability under issues.
│ • Intel TA-00539 IPU 2021.2 CSME
│ • Mitigated the following security vulnerabilities under issues.
│
└─System Firmware:
│ Device ID: a45df35ac0e948ee180fe216a5f703f32dda163f
│ Previous version: 0.1.44
│ Update State: Success
│ Last modified: 2022-05-07 13:38
│ GUID: 1e1fe415-74e8-49e1-9508-106b3d13d50d
│ Device Flags: • Internal device
│ • Updatable
│ • System requires external power source
│ • Supported on remote server
│ • Needs a reboot after installation
│ • Device is usable for the duration of the update
│
└─ThinkPad P52/P72:
New version: 0.1.46
Remote ID: lvfs
Release ID: 12990
Summary: Lenovo ThinkPad P52/P72 System Firmware
License: Proprietary
Size: 16,2 MB
Created: 2022-03-22
Urgency: Critical
Vendor: Lenovo
Description:
Lenovo ThinkPad P52P72 System Firmware Version 1.46
New functions or enhancements:
• Updated the Diagnostics module to version 04.22.000.
Problem fixes:
• Fixed an issue where always show "Configuring Thunderbolt Controller..." message on every boot.
Another update I installed on my P52, and again the boot entries were reset. i suspected that it might happen and I captured the efibootmgr output just before the update and just after. 20220507.txt
PF16W6Y2 ~ # fwupdmgr get-history
20M90019RT
│
├─UEFI Device Firmware:
│ │ Device ID: 0f3c64df11304fc5711ef77a93e3e042e2738907
│ │ Previous version: 0.1.15
│ │ Update State: Success
│ │ Last modified: 2019-12-21 13:21
│ │ GUID: 88b8ba7e-296b-4f9e-929f-dcc19318dbcf
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 0.1.16
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─SAMSUNG MZVLB512HAJQ-000L7:
│ │ Device ID: c6a0cfba7c7d81e253fce571e1d1e9f6003ae1c7
│ │ Previous version: 4L2QEXA7
│ │ Update State: Success
│ │ Last modified: 2020-03-14 19:30
│ │ GUID: 6e54c992-d302-59ab-b454-2d26ddd63e6d
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 5L2QEXA7
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─System Firmware:
│ │ Device ID: 65b6a9dc7b7df18bdff003584b51bf21373e3aa6
│ │ Previous version: 0.1.40
│ │ Update State: Success
│ │ Last modified: 2021-04-27 20:51
│ │ GUID: 1e1fe415-74e8-49e1-9508-106b3d13d50d
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Cryptographic hash verification is available
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 0.1.41
│ Remote ID: lvfs
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─Intel Management Engine:
│ │ Device ID: 619057f1d0da67b3fa4e9f74e09fc9218ce32643
│ │ Previous version: 192.70.1652
│ │ Update State: Failed
│ │ Update Error: (null)/fwupdx64.efi cannot be found
│ │ Last modified: 2021-06-16 07:08
│ │ GUID: 971682af-21a0-46e3-91c0-825702c2ba70
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Reported to remote server
│ │ • Device is usable for the duration of the update
│ │
│ └─ New version: 192.72.1757
│ Remote ID: lvfs
│ License: Unknown
│ Description:
│ The vendor did not supply any release notes.
│
├─Intel Management Engine:
│ │ Device ID: 349bb341230b1a86e5effe7dfe4337e1590227bd
│ │ Previous version: 192.70.1652
│ │ Update State: Transient failure
│ │ Update Error: boot entry missing; perhaps 'Boot Order Lock' enabled in the BIOS: no 'Linux Firmware Updater' entry found
│ │ Last modified: 2022-05-07 13:35
│ │ GUID: 971682af-21a0-46e3-91c0-825702c2ba70
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • System requires external power source
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Device is usable for the duration of the update
│ │
│ └─ThinkPad P52/P72:
│ New version: 192.85.1869
│ Remote ID: lvfs
│ Release ID: 11618
│ Summary: Lenovo ThinkPad P52/P72 Corporate ME Firmware
│ License: Proprietary
│ Size: 12,2 MB
│ Created: 2021-11-10
│ Urgency: High
│ Details: https://pcsupport.lenovo.com/de/en/search?query=N2CRG30W
│ Vendor: Lenovo
│ Release Flags: • Is upgrade
│ Description:
│ • 0 Intel Platform Update
│
│ Version 12.0.85.1869 (LVFS: 192.85.1869)
│
│ Problem Fixes
│
│ • Intel TA-00575 IPU 2021.2 CSME
│ • Mitigated the following security vulnerability under issues.
│ • Intel TA-00539 IPU 2021.2 CSME
│ • Mitigated the following security vulnerabilities under issues.
│
└─System Firmware:
│ Device ID: a45df35ac0e948ee180fe216a5f703f32dda163f
│ Previous version: 0.1.44
│ Update State: Success
│ Last modified: 2022-05-07 13:38
│ GUID: 1e1fe415-74e8-49e1-9508-106b3d13d50d
│ Device Flags: • Internal device
│ • Updatable
│ • System requires external power source
│ • Supported on remote server
│ • Needs a reboot after installation
│ • Device is usable for the duration of the update
│
└─ThinkPad P52/P72:
New version: 0.1.46
Remote ID: lvfs
Release ID: 12990
Summary: Lenovo ThinkPad P52/P72 System Firmware
License: Proprietary
Size: 16,2 MB
Created: 2022-03-22
Urgency: Critical
Vendor: Lenovo
Description:
Lenovo ThinkPad P52P72 System Firmware Version 1.46
New functions or enhancements:
• Updated the Diagnostics module to version 04.22.000.
Problem fixes:
• Fixed an issue where always show "Configuring Thunderbolt Controller..." message on every boot.
Thanks for the notes - it does look like your EFI variables are completely wiped, at least that is my guess. I've forwarded the details to the FW team for their comment (as a note for myself, internal ticket LO-1716) LO-1716 In the above you also have some interesting failure logs for the ME update. I've no idea if they're related - but they do stand out.
Can you check you don't have 'Boot Order Lock' enabled in the BIOS - just in case that's responsible.
Thanks Mark
AndriyKalashnykov
commented
2 years ago I have had same behavior i.e. boot table was reset. Now i want to upgrade bios to from 0.1.41 to 0.1.46 and can't afford any downtime. Can anybody provide steps to upgrade BIOS without loosing boot table or how to put it back where it was after the upgrade so i can continue from where i started but with new BIOS?
mrhpearson
commented
2 years ago I followed up with the FW team on this and we can't reproduce and they are adamant that they don't deliberately reset them at any point.
@hughsie - I'm grasping at straws - but I assume we need to update the efiboot variable to run the linux firmware updater on the next boot? e.g from this capture
BootNext: 0001
BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0000,0018,0019,001A,001B,001C,001D,001E,001F,0020,0021,0022,0001
Boot0000* gentoo HD(2,GPT,534c523b-b9fa-bb45-b5af-ac06f1a856a0,0x2000800,0xfa000)/File(\EFI\gentoo\grubx64.efi)
Boot0001* Linux-Firmware-Updater HD(2,GPT,534c523b-b9fa-bb45-b5af-ac06f1a856a0,0x2000800,0xfa000)/File(\EFI\gentoo\fwupdx64.efi)Something would have gone in and at minimum updated the BootOrder to make entry 0001 the first one? So it's possible that the boot variables were wrong before the updater was called.
Is there any way we can discount OS, fwupdx64 or shim or grub doing something wonky in this area? I don't know the efiboot variable storage well enough - but is it checksummed or something like that?
I agree that BIOS seems like a likely culprit...but they're telling me they don't touch this space (unless the user does something manually) so I'm a bit stuck.
Mark
jonbrenner
commented
1 year ago I can confirm that updating to 1.53, as well as earlier firmware versions, removes my EFI boot entry. I use EFISTUB booting to directly boot a unified kernel image, discounting the idea that an intermediate bootloader could be to blame:
Boot0000* Arch Linux (Secure Boot) HD(1,GPT,22c1fcf0-d66f-4484-a807-30596dc41360,0x800,0xfa000)/File(Arch\linux-signed.efi)
Describe the bug Recent update of the UEFI firmware and Intel ME has reset the boot table to the default one. Original boot order:
After update:
Steps to Reproduce fwupdmgr update
Expected behavior The boot order table should remain intact
fwupd version information Please provide the version of the daemon and client.
Installed via emerge - package management tool of Gentoo
fwupd device information Please provide the output of the fwupd devices recognized in your system.
System UEFI configuration Please provide the output of the following commands:
Additional questions