Lenovo System Firmware updates wipe SLIC ACPI table

[jevank]

Describe the bug

After successfully updating the system firmware on Lenovo Thinkpad laptops (X1C5 and X1C8), I discovered the loss of the ACPI SLIC table and the ability to use the activated preinstalled Windows

Steps to Reproduce Install system firmware update

Expected behavior ACPI SLIC table present

fwupd version information 1.7.9

Please note how you installed it (apt, dnf, pacman, source, etc): sources

fwupd device information

This is Lenovo Thikpad X1C8

├─System Firmware:
│     Device ID:          a45df35ac0e948ee180fe216a5f703f32dda163f
│     Summary:            UEFI ESRT device
│     Current version:    0.1.27
│     Vendor:             LENOVO (DMI:LENOVO)
│     Update State:       Success
│     Update Message:     The computer will be restarted automatically after updating BIOS completely . Do NOT turn off your computer or remove the AC adaptor while update is in progress.
│     GUIDs:              31245a58-b272-4776-9398-3df5e8b532db
│                         230c8b18-8d9b-53ec-838b-6cfc0383493a
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Supported on remote server
│                         • Needs a reboot after installation
│                         • Cryptographic hash verification is available
│                         • Device is usable for the duration of the update
│                         • Full disk encryption secrets may be invalidated when updating

[hughsie]

@mrhpearson sounds like a regression to me, accidental I assume?

[mrhpearson]

I'm not sure but I assume so - never come across this one before. Raised internal ticket LO-2000 to the FW team. Mark

[mrhpearson]

Hi @jevank

Feedback from the FW team is they don't know what change might have caused this (bear in mind many of the changes in the BIOS come from Intel). They'll need to debug but need further information on how to reproduce.

They don't see a SLIC table under ACPI in either Windows or Linux. Can you share more details on how to reproduce and check this issue. We're not seeing any SLIC entry under /sys/firmware/acpi/tables

[jevank]

Hi @mrhpearson and thanks for the support.

the SLIC table is available on laptops with preinstalled Windows 10 and requires AFAIK to Windows activation process only.

I guess the firmware update somehow make it invisible or (I hope not) wipe it. I've never seen it before using firmware updates under Windows.

What can I help? Trying downgrade to any previous versions?

[mrhpearson]

Hi - let me check what the FW team want to do with this. Kinda intrigued that they don't expect there to be a SLIC table - you're sure it was there before? (I haven't got a clue how Windows does this normally)

[jevank]

you're sure it was there before?

Absolutely. I use this table passed through to virtual machine to activate guest Windows system.

[mrhpearson]

OK - I've passed them back to them

For my understanding - I'm not seeing the table under /sys/firmware/acpi/tables on any of my systems. Is that because they're all prototypes and won't be activated - or am I looking in the wrong place. I'd like to be able to show the FW team how to reproduce it but don't think I have a system that I can do that on (joys of getting prototypes...)

Mark

[mrhpearson]

Got some feedback quite quickly:

• Can the table come back If the user flash back to the previous FW version1.26 ?
• If we confirm the table comes back we will have to narrow down on the change that causes the issue - there are '13 tags merged in this version' (which I take to mean 13 updates from Intel)

I would rather duplicate this issue in house so we can investigate and cycle thru some test loads ourselves - hopefully we can reproduce it so any guidance is appreciated

Thanks Mark

[das-menschy]

I've got the same problem. On my Thinkpad X1 Carbon 5th Generation, the MSDM table with the Windows License Product Key is also gone. I guess the deletion also happened during the last Lenovo System Firmware update 1.55 => 1.56.

I can say with 100% certainty that I had this Windows 10 Product License Key, because I saved it in my Password Manager (KeePassXC) some time ago, when it was still available! My former Windows 10 Product License Key in /sys/firmware/acpi/tables/MSDM was:

CCRRB-<redacted>-<redacted>-<redacted>-V8RC2 

Now, the file MSDM and the corresponding ACPI table don't exist anymore:

[root@linux-on-20hr002mmx ~]# ls -1 /sys/firmware/acpi/tables/
APIC
'ASF!'
BATB
BGRT
BOOT
data
DBG2
DBGP
DMAR
DSDT
dynamic
ECDT
FACP
FACS
FPDT
HPET
MCFG
POAT
SSDT1
SSDT10
SSDT2
SSDT3
SSDT4
SSDT5
SSDT6
SSDT7
SSDT8
SSDT9
TPM2
UEFI1
UEFI2
WSMT

[thmo]

Happened already 2019 to my T460s, lost Windows key, as SLIC and MSDM were wiped. Unfortunately after the two years warranty period already ended..., so I didn't follow up further on this.

See here (in German).

[hughsie]

We've added the "upload hashes of your ACPI tables before and after the update" as part of the report. Which means when people using 1.8.7 and newer upload a report we can de-deploy the firmware automatically and then ping the right person. Longer longer term we want to require vendors to do a signed report before they're allowed to move a file to the stable remote.

[mrhpearson]

I have a trial BIOS for the X1 Carbon 8 if anybody is able to reproduce this and willing to test it - please let me know.

I also got the note that the SLIC table should not be used for Windows 10 onwards - but it looks like the above is now updated for the MSDM table...so that's not very helpful.

[neokitten]

Same behavior here.

Lost my Windows Pro key on my T470 after a firmware update. The BIOS Setup shows nothing about "Preinstalled OS/License".

I cannot activate my Windows installation. I contacted the Lenovo Support, hoping they could help me somehow.

[mrhpearson]

The root cause of this problem has been fixed (73W on the X1 Carbon 5 and 99W on the T470). The FW team noted that if your windows licence keys got fixed the only way to recover it is via the Lenovo service center unfortunately - but they should be able to help you out. Closing ticket