failed to update to 0: authentication signing error

[personaingrata]

today i updated "Lenovo Embedded Controller" via gnome-firmware on my Thinkpad P14s Gen 3 to 0.1.15. i signed fwupdx64.efi with my secure boot keys and the update went through. i thought business like usual but after rebooting, gnome-firmware reports "failed to update to 0: authentication signing error" and "Current Version 0"

fwupdmgr get-history
LENOVO 21AKCTO1WW ... │
└─Embedded Controller: │ Gerätekennung: 97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e │ Vorherige Version: 0.1.14 │ Aktualisierungsstatus:Fehlgeschlagen │ Aktualisierungsfehler:failed to update to 0: authentication signing error │ Zuletzt geändert: 2023-03-13 15:03 │ GUID: 7ddc47a5-a390-4571-a943-2636de3504d2 │ Device Flags: • Internes Gerät │ • Aktualisierbar │ • System benötigt externe Stromquelle │ • Unterstützt auf dem entfernten Server │ • Benötigt einen Neustart nach der Installation │ • Das Gerät ist während der Dauer der Aktualisierung nutzbar │ └─ Neue Version: 0.1.15 Remote ID: lvfs Lizenz: Unbekannt Beschreibung:
Der Anbieter hat keine Versionshinweise zur Verfügung gestellt.

i downloaded the file from the fwupd website and tried to manually reinstall v0.1.14 and 0.1.15 but the output is the following fwupdmgr install 66473a15f7c7b9056c765ddbb7ca51af6ec9b30d635832138eb3f2ad79654d11-Lenovo-ThinkPad-T14Gen3-P14sGen3-T16-P16s-SystemFirmware-1.15.cab Entpacken … [ - ] Not compatible with firmware version 0, requires >= 0.1.0

fwupdmgr downgrade 97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e [1] Keine Herabstufungen für Embedded Controller: No releases found

fwupdmgr --version [2] compile org.freedesktop.fwupd 1.8.12 compile com.hughsie.libxmlb 0.3.11 compile com.hughsie.libjcat 0.1.12 runtime org.freedesktop.fwupd-efi 1.4 compile org.freedesktop.gusb 0.4.5 runtime com.hughsie.libjcat 0.1.13 runtime com.dell.libsmbios 2.4 runtime org.freedesktop.gusb 0.4.5 runtime org.kernel 6.1.15-hardened1-1-hardened runtime org.freedesktop.fwupd 1.8.12 `

efivar -l | grep fw
0abba7dc-e516-4167-bbf5-4d9d1c739416-fwupd-7ddc47a5-a390-4571-a943-2636de3504d2-0 `

the bios reports firmware version for the Embedded Controller as 0.1.14. it seems like the update grilled my notebook and that i`m stuck on this version. how can i fix this?

[hughsie]

Can you supply all the requested debugging data with the LANG set to en_US please? I'm afraid my German is super bad.

[personaingrata]

thanks for looking into this, here's the requested output. please let me know if you need more information.

$ fwupdmgr --version
compile org.freedesktop.fwupd 1.8.12 compile com.hughsie.libxmlb 0.3.11 compile com.hughsie.libjcat 0.1.12 runtime org.freedesktop.fwupd-efi 1.4 compile org.freedesktop.gusb 0.4.5 runtime com.hughsie.libjcat 0.1.13 runtime com.dell.libsmbios 2.4 runtime org.freedesktop.gusb 0.4.5 runtime org.kernel 6.1.19-hardened1-1-hardened runtime org.freedesktop.fwupd 1.8.12

$ fwupdmgr get-devices --show-all-devices
LENOVO 21AKCTO1WW │ ├─Unknown Device: │ Device ID: 6b5a06645e27c4e94b6e67d5185c46d11ec9ad67 │ GUID: c96751f4-16e8-59ea-975d-69d3dac88d7d ← GPIO\ID_INTC1055:00 │
├─12th Gen Intel Core™ i7-1280P: │ │ Device ID: 4bde70ba4e39b28f9eab1628f9dd6e6244c03027 │ │ Current version: 0x00000429 │ │ Vendor: Intel │ │ GUIDs: b9a2dd81-159e-5537-a7db-e7101d164d3f ← cpu │ │ 30249f37-d140-5d3e-9319-186b1bd5cac3 ← CPUID\PRO_0&FAM_06 │ │ ab855c04-4ff6-54af-8a8a-d8193daa0cd8 ← CPUID\PRO_0&FAM_06&MOD_9A │ │ 3ebbde86-d03e-549a-a8fd-02ebf9aa537a ← CPUID\PRO_0&FAM_06&MOD_9A&STP_3 │ │ Device Flags: • Internal device │ │ │ ├─USB4 host controller: │ │ Device ID: c202b5b5e24d8e97ce97f872ce34d40115323411 │ │ Summary: Unmatched performance for high-speed I/O │ │ Vendor: INTEL (THUNDERBOLT:0x8087) │ │ GUIDs: 5041b15d-6e1c-5681-86b3-bb1d56993357 ← THUNDERBOLT\VEN_8087&DEV_463E │ │ d651f364-21d8-5cc3-9790-dd019a8958ef ← THUNDERBOLT\VEN_8087&DEV_463E&REV_00 │ │ e72e778e-94f7-5ed2-b560-1c1262ee217c ← TBT-fixed │ │ Device Flags: • Internal device │ │ • System requires external power source │ │ • Signed Payload │ │
│ └─USB4 host controller: │ Device ID: 54c483b1c38d4297467bfdd5bef286c5a1e803c8 │ Summary: Unmatched performance for high-speed I/O │ Vendor: INTEL (THUNDERBOLT:0x8087) │ GUIDs: 5041b15d-6e1c-5681-86b3-bb1d56993357 ← THUNDERBOLT\VEN_8087&DEV_463E │ d651f364-21d8-5cc3-9790-dd019a8958ef ← THUNDERBOLT\VEN_8087&DEV_463E&REV_00 │ e72e778e-94f7-5ed2-b560-1c1262ee217c ← TBT-fixed │ Device Flags: • Internal device │ • System requires external power source │ • Signed Payload │
├─Alder Lake-P Integrated Graphics Controller: │ Device ID: 5792b48846ce271fab11c4a545f7a3df0d36e00a │ Current version: 0c │ Vendor: Intel Corporation (PCI:0x8086) │ GUIDs: eaad9970-8e4d-56da-88ab-41a8c1e2811f ← PCI\VEN_8086&DEV_46A6 │ ed0b9458-c2f1-54c5-9063-dea8f75b4039 ← PCI\VEN_8086&DEV_46A6&REV_0C │ 252c4720-3ca4-5c9e-869f-67c99c8a53a0 ← PCI\VEN_8086&DEV_46A6&SUBSYS_17AA22EA │ ada74489-5c34-5122-a8bb-19079db09cfa ← PCI\VEN_8086&DEV_46A6&SUBSYS_17AA22EA&REV_0C │ c4625510-a985-517c-8800-0ecfc6f68c8f ← PCI\VEN_8086&DEV_46A6&REV_00 │ 0f7adb81-1c81-5f97-9953-74396febcba2 ← PCI\VEN_8086&DEV_46A6&SUBSYS_17AA22EA&REV_00 │ Device Flags: • Internal device │ • Cryptographic hash verification is available │
├─Embedded Controller: │ Device ID: 97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e │ Summary: UEFI ESRT device │ Current version: 0 │ Vendor: Lenovo (DMI:LENOVO) │ Update State: Failed │ Update Error: failed to update to 0: authentication signing error │ GUID: 7ddc47a5-a390-4571-a943-2636de3504d2 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─Fingerprint Sensor: │ Device ID: 0d5d05911800242bb1f35287012cdcbd9b381148 │ Summary: Match-On-Chip fingerprint sensor │ Current version: 01000300 │ Vendor: Goodix (USB:0x27C6) │ Install Duration: 10 seconds │ Serial Number: UID0914BF40_XXXX_MOC_B0 │ GUIDs: 14450e82-8667-54c3-98e1-098d8c6dc3b8 ← USB\VID_27C6&PID_6594 │ 6322b4f7-0571-5f07-8538-e041bbc70677 ← USB\VID_27C6&PID_6594&REV_0100 │ Device Flags: • Updatable │ • Device can recover flash failures │ • Signed Payload │
├─Integrated Camera: │ Device ID: 3fa281ddf80d8a06b8ee5d8beb48d38ee95a9627 │ Current version: 54.20 │ Vendor: Chicony Electronics Co.,Ltd. (USB:0x04F2) │ Serial Number: 0001 │ GUIDs: bcd2c020-e315-55aa-b7e1-7d2d7108037e ← USB\VID_04F2&PID_B74F │ e655dc91-2a57-558b-8213-3a4f047f53f0 ← USB\VID_04F2&PID_B74F&REV_5420 │ Device Flags: • Updatable │
├─Intel Management Engine: │ Device ID: 2292ae5236790b47884e37cf162dcf23bfcd1c60 │ Summary: UEFI ESRT device │ Current version: 0.15.1810 │ Vendor: Lenovo (DMI:LENOVO) │ Update State: Success │ GUID: 4e78ce68-5389-4a95-bf10-e3568c30caf8 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─SSD 980 PRO 2TB: │ Device ID: 03281da317dccd2b18de2bd1cc70a782df40ed7e │ Summary: NVM Express solid state drive │ Current version: 5B2QGXA7 │ Vendor: Samsung (NVME:0x144D) │ Serial Number: S69ENF0R829350P │ GUIDs: bec63ed7-a95f-54fe-b8cc-8e9fee64ba5a ← NVME\VEN_144D&DEV_A80A │ 60c89aac-f321-515b-b419-3cf02aa9d375 ← NVME\VEN_144D&DEV_A80A&REV_00 │ 310f81b5-6fce-501e-acfb-487d10501e78 ← NVME\VEN_144D&DEV_A80A&SUBSYS_144DA801 │ 4d7a2791-106b-5e72-9cfb-8ea3d89f5421 ← NVME\VEN_144D&DEV_A80A&SUBSYS_144DA801&REV_00 │ c8bffd05-1744-5cdd-ad4d-0fbc3b20e3c2 ← Samsung SSD 980 PRO 2TB │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ • Signed Payload │
├─System Firmware: │ │ Device ID: 5bfc5b91c18ef8b751d3d052af77b69ebf738038 │ │ Summary: UEFI ESRT device │ │ Current version: 0.1.31 │ │ Vendor: Lenovo (DMI:LENOVO) │ │ Update State: Success │ │ GUIDs: 4174782a-7813-405e-86f5-c878eb1a1da7 │ │ 230c8b18-8d9b-53ec-838b-6cfc0383493a ← main-system-firmware │ │ Device Flags: • Internal device │ │ • Updatable │ │ • System requires external power source │ │ • Supported on remote server │ │ • Needs a reboot after installation │ │ • Cryptographic hash verification is available │ │ • Device is usable for the duration of the update │ │ │ ├─AMT [unprovisioned]: │ │ Device ID: 8d5470e73fd9a31eaa460b2b6aea95483fe3f14c │ │ Summary: Hardware and firmware technology for remote out-of-band management │ │ Current version: 16.0.15.1810 │ │ Bootloader Version:16.0.15.1810 │ │ Vendor: Intel Corporation (MEI:0x8086) │ │ GUIDs: 12f80028-b4b7-4b2d-aca8-46e0ff65814c │ │ fccad2fe-62ae-5879-b7a9-4ead7bce50f4 ← MEI\VEN_8086&DEV_51E0 │ │ 4837b81a-56c3-501f-8b4c-1e71882379fe ← MEI\VEN_8086&DEV_51E0&REV_01 │ │ fbd11f41-e534-579d-95ca-5ce8234ff1e9 ← MEI\VEN_8086&DEV_51E0&SUBSYS_17AA22E8 │ │ 55536761-3724-57aa-bbee-4c79193d80c0 ← MEI\VEN_8086&DEV_51E0&SUBSYS_17AA22E8&REV_01 │ │ Device Flags: • Internal device │ │
│ ├─BootGuard Configuration: │ │ Device ID: b0d4430dfa6bde9f0c22680df36dbc8c15c80753 │ │ Current version: 01 │ │ Vendor: Intel Corporation (MEI:0x8086) │ │ GUIDs: dd17041c-09ea-4b17-a271-5b989867ec65 │ │ fccad2fe-62ae-5879-b7a9-4ead7bce50f4 ← MEI\VEN_8086&DEV_51E0 │ │ 4837b81a-56c3-501f-8b4c-1e71882379fe ← MEI\VEN_8086&DEV_51E0&REV_01 │ │ fbd11f41-e534-579d-95ca-5ce8234ff1e9 ← MEI\VEN_8086&DEV_51E0&SUBSYS_17AA22E8 │ │ 55536761-3724-57aa-bbee-4c79193d80c0 ← MEI\VEN_8086&DEV_51E0&SUBSYS_17AA22E8&REV_01 │ │ Device Flags: • Internal device │ │
│ ├─UEFI Platform Key: │ │ Device ID: 6924110cde4fa051bfdc600a60620dc7aa9d3c6a │ │ Summary: Platform Key │ │ GUID: b6716f4c-f639-5190-b473-0b8aba06e287 ← UEFI\CRT_7E3DA64B5F664BFC531DB45DD10F2A504C171A37 │ │
│ └─UEFI dbx: │ Device ID: 362301da643102b9f38477387e2193e57abaa590 │ Summary: UEFI revocation database │ Current version: 190 │ Minimum Version: 190 │ Vendor: UEFI:Linux Foundation │ Install Duration: 1 second │ GUIDs: 9f43b2ca-afbb-5499-b8a3-c902c185ae30 ← UEFI\CRT_13A369E8E207FDAD1F3D1B7F1259C2EE6A662B28EEBF1A1D0C69580B3D797449 │ 1431b52a-4a2e-53f6-858b-38b6dcbdac26 ← UEFI\CRT_13A369E8E207FDAD1F3D1B7F1259C2EE6A662B28EEBF1A1D0C69580B3D797449&ARCH_X64 │ Device Flags: • Internal device │ • Updatable │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ • Only version upgrades are allowed │ • Signed Payload │
├─TPM: │ Device ID: c6a80ac3a22083423992a3cb15018989f37834d6 │ Current version: 1.512.0.0 │ Vendor: ST Microelectronics (TPM:STM) │ GUIDs: ff71992e-52f7-5eea-94ef-883e56e034c6 ← system-tpm │ 84df3581-f896-54d2-bd1a-372602f04c32 ← TPM\VEN_STM&DEV_0001 │ bfaed10a-bbc1-525b-a329-35da2f63e918 ← TPM\VENSTM&MOD │ 70b7b833-7e1a-550a-a291-b94a12d0f319 ← TPM\VEN_STM&DEV_0001&VER_2.0 │ 06f005e9-cb62-5d1a-82d9-13c534c53c48 ← TPM\VENSTM&MOD&VER_2.0 │ Device Flags: • Internal device │
├─TU117GLM [T550 Laptop GPU]: │ Device ID: 594baa45f6742120d71dd82166e762f1529c2a8a │ Current version: a1 │ Vendor: NVIDIA Corporation (PCI:0x10DE, PCI:0x8086) │ GUIDs: 5823f225-ebe9-57fb-be04-9d73b6adc0fa ← PCI\VEN_10DE&DEV_1FB7 │ e60ab19a-ac54-5f62-84dd-a8339ac38462 ← PCI\VEN_10DE&DEV_1FB7&REV_A1 │ de46c9f0-6183-5f1b-8f73-6e04c9bdc62c ← PCI\VEN_10DE&DEV_1FB7&SUBSYS_17AA22EA │ c7607c94-73e5-5cc3-93af-c24a98919845 ← PCI\VEN_10DE&DEV_1FB7&SUBSYS_17AA22EA&REV_A1 │ 28c23e3a-0b82-5bef-a5e0-674e82c6c431 ← PCI\VEN_8086&DEV_463D │ 04ae2718-db07-5eb5-9579-94b58f6e4785 ← PCI\VEN_8086&DEV_463D&REV_02 │ a994fee9-7b8d-50ad-bfa7-213fd8db5963 ← PCI\VEN_8086&DEV_463D&SUBSYS_17AA22E8 │ 10d48b32-0312-5389-a489-0815f99b72b7 ← PCI\VEN_8086&DEV_463D&SUBSYS_17AA22E8&REV_02 │ Device Flags: • Internal device │ • Cryptographic hash verification is available │
├─UEFI Device Firmware: │ Device ID: a45df35ac0e948ee180fe216a5f703f32dda163f │ Summary: UEFI ESRT device │ Current version: 70154 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 4e88068b-41b2-4e05-893c-db0b43f7d348 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: 349bb341230b1a86e5effe7dfe4337e1590227bd │ Summary: UEFI ESRT device │ Current version: 1 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 69585d92-b50a-4ad7-b265-2eb1ae066574 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: 632acf4927c0b5fb53519d6beed3b60adb73f1d5 │ Summary: UEFI ESRT device │ Current version: 984850 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: d91340eb-9ddf-42a0-8134-c77b957802d3 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: ae1abd099407b1d95698d69b7273f7fed5c6f35c │ Summary: UEFI ESRT device │ Current version: 16842753 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 8732d319-352c-4072-892e-2c96cc974ade │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: 4b78f537b7d3e281a2ecbc83048b8856fb9eb98e │ Summary: UEFI ESRT device │ Current version: 0 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 6ec8a07f-c38b-4e3e-b9bc-19cf17607d4e │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: 2656b5b7e7c4f91fef1537f93095449cda5fb264 │ Summary: UEFI ESRT device │ Current version: 1 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 6bb2b62b-2f2b-4f1b-8b6b-0d99aa341cd6 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: de4826630a1fc5be5355c9b6b2c4052051f350c6 │ Summary: UEFI ESRT device │ Current version: 66048 │ Minimum Version: 66048 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 604d2426-a7e7-4f37-b2f2-cde61692ad18 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: f95c9218acd12697af946874bfe4239587209232 │ Summary: UEFI ESRT device │ Current version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 76ca0ad8-4a14-4389-b7e5-fd88791762ad │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: d96de5c124b60ed6241ebcb6bb2c839cb5580786 │ Summary: UEFI ESRT device │ Current version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 626d93db-2c42-48c3-915a-71f968a81b04 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: f37fb01122dd62c773f4e84ec89737e059712d59 │ Summary: UEFI ESRT device │ Current version: 21536 │ Minimum Version: 1 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 7a62e423-610e-4573-9621-8d09799eab8a │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: 36efb79c255f402f619fa9eb53cd659db51f2a04 │ Summary: UEFI ESRT device │ Current version: 0 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 41e18891-fb01-4da3-a483-5b05ccbb5767 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: 11a7fbdd09ce583e58b899660fe10f147fd155a2 │ Summary: UEFI ESRT device │ Current version: 196608 │ Minimum Version: 57374 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: 54cb734c-975c-4a74-9556-57ae6d9a2229 │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
├─UEFI Device Firmware: │ Device ID: a083ebc5138e5e071ef7270cc9a8280722cc7adf │ Summary: UEFI ESRT device │ Current version: 3345747 │ Vendor: DMI:LENOVO │ Update State: Success │ GUID: c49a33d3-806b-4055-b4a8-668ad1d4e20b │ Device Flags: • Internal device │ • Updatable │ • System requires external power source │ • Needs a reboot after installation │ • Device is usable for the duration of the update │
└─Unifying Receiver: Device ID: 3801e1f7043b9abdf1f873bf0bf0b945402e4238 Summary: Miniaturised USB wireless receiver Current version: RQR24.11_B0036 Bootloader Version: BOT03.02_B0009 Vendor: HIDRAW:0x046D|USB:0x046D Install Duration: 30 seconds GUIDs: cc4cbfa9-bf9d-540b-b92b-172ce31013c1 279ed287-3607-549e-bacc-f873bb9838c4 ← HIDRAW\VEN_046D&DEV_C52B fcf55bf5-767b-51ce-9c17-f6f538c4ee9f ← HIDRAW\VEN_046D&DEV_C52B&REV_00 Device Flags: • Updatable • Supported on remote server • Signed Payload

$ efibootmgr -v
BootCurrent: 0002 Timeout: 0 seconds BootOrder: 0003,0002,0000,001C,001E,0010,0011,0012,0013,0014,0015,0016,0017,0018,0019,0001,001F,001D,0020,0021,0022,0023,0024 Boot0000 GRUB HD(1,GPT,8c0ad4ca-0ca5-47ab-a81c-f3b5644c95a4,0x800,0x100000)/File(\EFI\GRUB\grubx64.efi) dp: 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 00 00 10 00 00 00 00 00 ca d4 0a 8c a5 0c ab 47 a8 1c f3 b5 64 4c 95 a4 02 02 / 04 04 30 00 5c 00 45 00 46 00 49 00 5c 00 47 00 52 00 55 00 42 00 5c 00 67 00 72 00 75 00 62 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 00 00 / 7f ff 04 00 Boot0001 Windows Boot Manager HD(1,GPT,9e8798a8-56e0-4c1c-91b9-8ce6b1a757cc,0x800,0xff801)/File(\EFI\Microsoft\Boot\bootmgfw.efi)57494e444f5753000100000088000000780000004200430044004f0042004a004500430054003d007b00390064006500610038003600320063002d0035006300640064002d0034006500370030002d0061006300630031002d006600330032006200330034003400640034003700390035007d00000031000100000010000000040000007fff0400 dp: 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 01 f8 0f 00 00 00 00 00 a8 98 87 9e e0 56 1c 4c 91 b9 8c e6 b1 a7 57 cc 02 02 / 04 04 46 00 5c 00 45 00 46 00 49 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 42 00 6f 00 6f 00 74 00 5c 00 62 00 6f 00 6f 00 74 00 6d 00 67 00 66 00 77 00 2e 00 65 00 66 00 69 00 00 00 / 7f ff 04 00 data: 57 49 4e 44 4f 57 53 00 01 00 00 00 88 00 00 00 78 00 00 00 42 00 43 00 44 00 4f 00 42 00 4a 00 45 00 43 00 54 00 3d 00 7b 00 39 00 64 00 65 00 61 00 38 00 36 00 32 00 63 00 2d 00 35 00 63 00 64 00 64 00 2d 00 34 00 65 00 37 00 30 00 2d 00 61 00 63 00 63 00 31 00 2d 00 66 00 33 00 32 00 62 00 33 00 34 00 34 00 64 00 34 00 37 00 39 00 35 00 7d 00 00 00 31 00 01 00 00 00 10 00 00 00 04 00 00 00 7f ff 04 00 Boot0002 Shim HD(1,GPT,8c0ad4ca-0ca5-47ab-a81c-f3b5644c95a4,0x800,0x100000)/File(\EFI\GRUB\BOOTx64.efi) dp: 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 00 00 10 00 00 00 00 00 ca d4 0a 8c a5 0c ab 47 a8 1c f3 b5 64 4c 95 a4 02 02 / 04 04 30 00 5c 00 45 00 46 00 49 00 5c 00 47 00 52 00 55 00 42 00 5c 00 42 00 4f 00 4f 00 54 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 00 00 / 7f ff 04 00 Boot0003 Linux-Firmware-Updater HD(1,GPT,8c0ad4ca-0ca5-47ab-a81c-f3b5644c95a4,0x800,0x100000)/File(\EFI\GRUB\fwupdx64.efi) dp: 04 01 2a 00 01 00 00 00 00 08 00 00 00 00 00 00 00 00 10 00 00 00 00 00 ca d4 0a 8c a5 0c ab 47 a8 1c f3 b5 64 4c 95 a4 02 02 / 04 04 32 00 5c 00 45 00 46 00 49 00 5c 00 47 00 52 00 55 00 42 00 5c 00 66 00 77 00 75 00 70 00 64 00 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 00 00 / 7f ff 04 00 Boot0010 Setup FvFile(721c8b66-426c-4e86-8e99-3457c46ab0b9) dp: 04 06 14 00 66 8b 1c 72 6c 42 86 4e 8e 99 34 57 c4 6a b0 b9 / 7f ff 04 00 Boot0011 Boot Menu FvFile(126a762d-5758-4fca-8531-201a7f57f850) dp: 04 06 14 00 2d 76 6a 12 58 57 ca 4f 85 31 20 1a 7f 57 f8 50 / 7f ff 04 00 Boot0012 Diagnostic Splash Screen FvFile(a7d8d9a6-6ab0-4aeb-ad9d-163e59a7a380) dp: 04 06 14 00 a6 d9 d8 a7 b0 6a eb 4a ad 9d 16 3e 59 a7 a3 80 / 7f ff 04 00 Boot0013 Lenovo Diagnostics FvFile(3f7e615b-0d45-4f80-88dc-26b234958560) dp: 04 06 14 00 5b 61 7e 3f 45 0d 80 4f 88 dc 26 b2 34 95 85 60 / 7f ff 04 00 Boot0014 Asset Information FvFile(da465b87-a26f-4c12-b78a-0361428fa026) dp: 04 06 14 00 87 5b 46 da 6f a2 12 4c b7 8a 03 61 42 8f a0 26 / 7f ff 04 00 Boot0015 Regulatory Information FvFile(478c92a0-2622-42b7-a65d-5894169e4d24) dp: 04 06 14 00 a0 92 8c 47 22 26 b7 42 a6 5d 58 94 16 9e 4d 24 / 7f ff 04 00 Boot0016 ThinkShield secure wipe FvFile(3593a0d5-bd52-43a0-808e-cbff5ece2477) dp: 04 06 14 00 d5 a0 93 35 52 bd a0 43 80 8e cb ff 5e ce 24 77 / 7f ff 04 00 Boot0017 ThinkShield Passwordless Power-On Device Manager FvFile(08448b41-7f83-49be-82a7-0e84790ab133) dp: 04 06 14 00 41 8b 44 08 83 7f be 49 82 a7 0e 84 79 0a b1 33 / 7f ff 04 00 Boot0018 Wi-Fi Configuration FvFile(d3aaff0f-cb22-4792-896c-802c2e9383ba)2d004100700070000000 dp: 04 06 14 00 0f ff aa d3 22 cb 92 47 89 6c 80 2c 2e 93 83 ba / 7f ff 04 00 data: 2d 00 41 00 70 00 70 00 00 00 Boot0019 Intel(R) MEBx FvFile(29a70110-7762-4211-ae88-fab19b7665be) dp: 04 06 14 00 10 01 a7 29 62 77 11 42 ae 88 fa b1 9b 76 65 be / 7f ff 04 00 Boot001A Startup Interrupt Menu FvFile(f46ee6f4-4785-43a3-923d-7f786c3c8479) dp: 04 06 14 00 f4 e6 6e f4 85 47 a3 43 92 3d 7f 78 6c 3c 84 79 / 7f ff 04 00 Boot001B Rescue and Recovery FvFile(665d3f60-ad3e-4cad-8e26-db46eee9f1b5) dp: 04 06 14 00 60 3f 5d 66 3e ad ad 4c 8e 26 db 46 ee e9 f1 b5 / 7f ff 04 00 Boot001C USB CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,86701296aa5a7848b66cd49dd3ba6a55) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b 86 70 12 96 aa 5a 78 48 b6 6c d4 9d d3 ba 6a 55 / 7f ff 04 00 Boot001D USB FDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,6ff015a28830b543a8b8641009461e49) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b 6f f0 15 a2 88 30 b5 43 a8 b8 64 10 09 46 1e 49 / 7f ff 04 00 Boot001E NVMe0 VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,001c199932d94c4eae9aa0b6e98eb8a400) dp: 03 0a 25 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b 00 1c 19 99 32 d9 4c 4e ae 9a a0 b6 e9 8e b8 a4 00 / 7f ff 04 00 Boot001F USB HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,33e821aaaf33bc4789bd419f88c50803) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b 33 e8 21 aa af 33 bc 47 89 bd 41 9f 88 c5 08 03 / 7f ff 04 00 Boot0020 PXE BOOT VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,78a84aaf2b2afc4ea79cf5cc8f3d3803) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b 78 a8 4a af 2b 2a fc 4e a7 9c f5 cc 8f 3d 38 03 / 7f ff 04 00 Boot0021 LENOVO CLOUD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,ad38ccbbf7edf04d959cf42aa74d3650)/Uri(https://download.lenovo.com/pccbbs/cdeploy/efi/boot.efi) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b ad 38 cc bb f7 ed f0 4d 95 9c f4 2a a7 4d 36 50 / 03 18 3b 00 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 6c 65 6e 6f 76 6f 2e 63 6f 6d 2f 70 63 63 62 62 73 2f 63 64 65 70 6c 6f 79 2f 65 66 69 2f 62 6f 6f 74 2e 65 66 69 / 7f ff 04 00 Boot0022 ON-PREMISE VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,ad38ccbbf7edf04d959cf42aa74d3650)/Uri() dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b ad 38 cc bb f7 ed f0 4d 95 9c f4 2a a7 4d 36 50 / 03 18 04 00 / 7f ff 04 00 Boot0023 Other CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,aea2090adfde214e8b3a5e471856a35400) dp: 03 0a 25 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b ae a2 09 0a df de 21 4e 8b 3a 5e 47 18 56 a3 54 00 / 7f ff 04 00 Boot0024 Other HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,ca88c2349e7ae947beeb43038a5aeae700) dp: 03 0a 25 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b ca 88 c2 34 9e 7a e9 47 be eb 43 03 8a 5a ea e7 00 / 7f ff 04 00 Boot0025 IDER BOOT CDROM PciRoot(0x0)/Pci(0x14,0x0)/USB(11,1) dp: 02 01 0c 00 d0 41 03 0a 00 00 00 00 / 01 01 06 00 00 14 / 03 05 06 00 0b 01 / 7f ff 04 00 Boot0026 IDER BOOT Floppy PciRoot(0x0)/Pci(0x14,0x0)/USB(11,0) dp: 02 01 0c 00 d0 41 03 0a 00 00 00 00 / 01 01 06 00 00 14 / 03 05 06 00 0b 00 / 7f ff 04 00 Boot0027 ATA HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,91af625956449f41a7b91f4f892ab0f6) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b 91 af 62 59 56 44 9f 41 a7 b9 1f 4f 89 2a b0 f6 / 7f ff 04 00 Boot0028 ATAPI CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,aea2090adfde214e8b3a5e471856a354) dp: 03 0a 24 00 d2 38 78 bc 82 0f 60 4d 83 16 c0 68 ee 79 d2 5b ae a2 09 0a df de 21 4e 8b 3a 5e 47 18 56 a3 54 / 7f ff 04 00

$ efivar -l | grep fw
0abba7dc-e516-4167-bbf5-4d9d1c739416-fwupd-7ddc47a5-a390-4571-a943-2636de3504d2-0

$ tree /boot
/boot ├── grub │   ├── fonts │   │   └── unicode.pf2 │   ├── grub.cfg │   ├── grubenv │   ├── locale │   │   ├── ast.mo │   │   ├── ca.mo │   │   ├── da.mo │   │   ├── de_CH.mo │   │   ├── de@hebrew.mo │   │   ├── de.mo │   │   ├── en@arabic.mo │   │   ├── en@cyrillic.mo │   │   ├── en@greek.mo │   │   ├── en@hebrew.mo │   │   ├── en@piglatin.mo │   │   ├── en@quot.mo │   │   ├── eo.mo │   │   ├── es.mo │   │   ├── fi.mo │   │   ├── fr.mo │   │   ├── gl.mo │   │   ├── hr.mo │   │   ├── hu.mo │   │   ├── id.mo │   │   ├── it.mo │   │   ├── ja.mo │   │   ├── ka.mo │   │   ├── ko.mo │   │   ├── lg.mo │   │   ├── lt.mo │   │   ├── nb.mo │   │   ├── nl.mo │   │   ├── pa.mo │   │   ├── pl.mo │   │   ├── pt_BR.mo │   │   ├── pt.mo │   │   ├── ro.mo │   │   ├── ru.mo │   │   ├── sl.mo │   │   ├── sr.mo │   │   ├── sv.mo │   │   ├── tr.mo │   │   ├── uk.mo │   │   ├── vi.mo │   │   ├── zh_CN.mo │   │   └── zh_TW.mo │   ├── themes │   │   ├── background1.png │   │   ├── background2.png │   │   ├── background.png │   │   └── starfield │   │   ├── blob_w.png │   │   ├── boot_menu_c.png │   │   ├── boot_menu_e.png │   │   ├── boot_menu_ne.png │   │   ├── boot_menu_n.png │   │   ├── boot_menu_nw.png │   │   ├── boot_menu_se.png │   │   ├── boot_menu_s.png │   │   ├── boot_menu_sw.png │   │   ├── boot_menu_w.png │   │   ├── COPYING.CC-BY-SA-3.0 │   │   ├── dejavu_10.pf2 │   │   ├── dejavu_12.pf2 │   │   ├── dejavu_14.pf2 │   │   ├── dejavu_16.pf2 │   │   ├── dejavu_bold_14.pf2 │   │   ├── README │   │   ├── slider_c.png │   │   ├── slider_n.png │   │   ├── slider_s.png │   │   ├── starfield.png │   │   ├── terminal_box_c.png │   │   ├── terminal_box_e.png │   │   ├── terminal_box_ne.png │   │   ├── terminal_box_n.png │   │   ├── terminal_box_nw.png │   │   ├── terminal_box_se.png │   │   ├── terminal_box_s.png │   │   ├── terminal_box_sw.png │   │   ├── terminal_box_w.png │   │   └── theme.txt │   ├── unicode.pf2 │   └── x86_64-efi │   ├── acpi.mod │   ├── adler32.mod │   ├── affs.mod │   ├── afs.mod │   ├── afsplitter.mod │   ├── ahci.mod │   ├── all_video.mod │   ├── aout.mod │   ├── appleldr.mod │   ├── archelp.mod │   ├── ata.mod │   ├── at_keyboard.mod │   ├── backtrace.mod │   ├── bfs.mod │   ├── bitmap.mod │   ├── bitmap_scale.mod │   ├── blocklist.mod │   ├── boot.mod │   ├── boottime.mod │   ├── bsd.mod │   ├── bswap_test.mod │   ├── btrfs.mod │   ├── bufio.mod │   ├── cacheinfo.mod │   ├── cat.mod │   ├── cbfs.mod │   ├── cbls.mod │   ├── cbmemc.mod │   ├── cbtable.mod │   ├── cbtime.mod │   ├── chain.mod │   ├── cmdline_cat_test.mod │   ├── cmp.mod │   ├── cmp_test.mod │   ├── command.lst │   ├── configfile.mod │   ├── core.efi │   ├── cpio_be.mod │   ├── cpio.mod │   ├── cpuid.mod │   ├── crc64.mod │   ├── cryptodisk.mod │   ├── crypto.lst │   ├── crypto.mod │   ├── cs5536.mod │   ├── ctz_test.mod │   ├── datehook.mod │   ├── date.mod │   ├── datetime.mod │   ├── diskfilter.mod │   ├── disk.mod │   ├── div.mod │   ├── div_test.mod │   ├── dm_nv.mod │   ├── echo.mod │   ├── efifwsetup.mod │   ├── efi_gop.mod │   ├── efinet.mod │   ├── efitextmode.mod │   ├── efi_uga.mod │   ├── ehci.mod │   ├── elf.mod │   ├── eval.mod │   ├── exfat.mod │   ├── exfctest.mod │   ├── ext2.mod │   ├── extcmd.mod │   ├── f2fs.mod │   ├── fat.mod │   ├── file.mod │   ├── fixvideo.mod │   ├── font.mod │   ├── fshelp.mod │   ├── fs.lst │   ├── functional_test.mod │   ├── gcry_arcfour.mod │   ├── gcry_blowfish.mod │   ├── gcry_camellia.mod │   ├── gcry_cast5.mod │   ├── gcry_crc.mod │   ├── gcry_des.mod │   ├── gcry_dsa.mod │   ├── gcry_idea.mod │   ├── gcry_md4.mod │   ├── gcry_md5.mod │   ├── gcry_rfc2268.mod │   ├── gcry_rijndael.mod │   ├── gcry_rmd160.mod │   ├── gcry_rsa.mod │   ├── gcry_seed.mod │   ├── gcry_serpent.mod │   ├── gcry_sha1.mod │   ├── gcry_sha256.mod │   ├── gcry_sha512.mod │   ├── gcry_tiger.mod │   ├── gcry_twofish.mod │   ├── gcry_whirlpool.mod │   ├── geli.mod │   ├── gettext.mod │   ├── gfxmenu.mod │   ├── gfxterm_background.mod │   ├── gfxterm_menu.mod │   ├── gfxterm.mod │   ├── gptsync.mod │   ├── grub.efi │   ├── gzio.mod │   ├── halt.mod │   ├── hashsum.mod │   ├── hdparm.mod │   ├── hello.mod │   ├── help.mod │   ├── hexdump.mod │   ├── hfs.mod │   ├── hfspluscomp.mod │   ├── hfsplus.mod │   ├── http.mod │   ├── iorw.mod │   ├── iso9660.mod │   ├── jfs.mod │   ├── jpeg.mod │   ├── json.mod │   ├── keylayouts.mod │   ├── keystatus.mod │   ├── ldm.mod │   ├── legacycfg.mod │   ├── legacy_password_test.mod │   ├── linux16.mod │   ├── linux.mod │   ├── loadbios.mod │   ├── load.cfg │   ├── loadenv.mod │   ├── loopback.mod │   ├── lsacpi.mod │   ├── lsefimmap.mod │   ├── lsefi.mod │   ├── lsefisystab.mod │   ├── lsmmap.mod │   ├── ls.mod │   ├── lspci.mod │   ├── lssal.mod │   ├── luks2.mod │   ├── luks.mod │   ├── lvm.mod │   ├── lzopio.mod │   ├── macbless.mod │   ├── macho.mod │   ├── mdraid09_be.mod │   ├── mdraid09.mod │   ├── mdraid1x.mod │   ├── memdisk.mod │   ├── memrw.mod │   ├── minicmd.mod │   ├── minix2_be.mod │   ├── minix2.mod │   ├── minix3_be.mod │   ├── minix3.mod │   ├── minix_be.mod │   ├── minix.mod │   ├── mmap.mod │   ├── moddep.lst │   ├── modinfo.sh │   ├── morse.mod │   ├── mpi.mod │   ├── msdospart.mod │   ├── mul_test.mod │   ├── multiboot2.mod │   ├── multiboot.mod │   ├── nativedisk.mod │   ├── net.mod │   ├── newc.mod │   ├── nilfs2.mod │   ├── normal.mod │   ├── ntfscomp.mod │   ├── ntfs.mod │   ├── odc.mod │   ├── offsetio.mod │   ├── ohci.mod │   ├── part_acorn.mod │   ├── part_amiga.mod │   ├── part_apple.mod │   ├── part_bsd.mod │   ├── part_dfly.mod │   ├── part_dvh.mod │   ├── part_gpt.mod │   ├── partmap.lst │   ├── part_msdos.mod │   ├── part_plan.mod │   ├── part_sun.mod │   ├── part_sunpc.mod │   ├── parttool.lst │   ├── parttool.mod │   ├── password.mod │   ├── password_pbkdf2.mod │   ├── pata.mod │   ├── pbkdf2.mod │   ├── pbkdf2_test.mod │   ├── pcidump.mod │   ├── pgp.mod │   ├── plainmount.mod │   ├── play.mod │   ├── png.mod │   ├── priority_queue.mod │   ├── probe.mod │   ├── procfs.mod │   ├── progress.mod │   ├── raid5rec.mod │   ├── raid6rec.mod │   ├── random.mod │   ├── rdmsr.mod │   ├── read.mod │   ├── reboot.mod │   ├── regexp.mod │   ├── reiserfs.mod │   ├── relocator.mod │   ├── romfs.mod │   ├── scsi.mod │   ├── search_fs_file.mod │   ├── search_fs_uuid.mod │   ├── search_label.mod │   ├── search.mod │   ├── serial.mod │   ├── setjmp.mod │   ├── setjmp_test.mod │   ├── setpci.mod │   ├── sfs.mod │   ├── shift_test.mod │   ├── signature_test.mod │   ├── sleep.mod │   ├── sleep_test.mod │   ├── smbios.mod │   ├── spkmodem.mod │   ├── squash4.mod │   ├── strtoull_test.mod │   ├── syslinuxcfg.mod │   ├── tar.mod │   ├── terminal.lst │   ├── terminal.mod │   ├── terminfo.mod │   ├── test_blockarg.mod │   ├── testload.mod │   ├── test.mod │   ├── testspeed.mod │   ├── tftp.mod │   ├── tga.mod │   ├── time.mod │   ├── tpm.mod │   ├── trig.mod │   ├── tr.mod │   ├── true.mod │   ├── udf.mod │   ├── ufs1_be.mod │   ├── ufs1.mod │   ├── ufs2.mod │   ├── uhci.mod │   ├── usb_keyboard.mod │   ├── usb.mod │   ├── usbms.mod │   ├── usbserial_common.mod │   ├── usbserial_ftdi.mod │   ├── usbserial_pl2303.mod │   ├── usbserial_usbdebug.mod │   ├── usbtest.mod │   ├── video_bochs.mod │   ├── video_cirrus.mod │   ├── video_colors.mod │   ├── video_fb.mod │   ├── videoinfo.mod │   ├── video.lst │   ├── video.mod │   ├── videotest_checksum.mod │   ├── videotest.mod │   ├── wrmsr.mod │   ├── xfs.mod │   ├── xnu.mod │   ├── xnu_uuid.mod │   ├── xnu_uuid_test.mod │   ├── xzio.mod │   ├── zfscrypt.mod │   ├── zfsinfo.mod │   ├── zfs.mod │   └── zstd.mod ├── grubx64.efi ├── initramfs-linux-fallback.img ├── initramfs-linux-hardened-fallback.img ├── initramfs-linux-hardened.img ├── initramfs-linux.img ├── intel-ucode.img ├── vmlinuz-linux └── vmlinuz-linux-hardened

7 directories, 369 files

Additional questions

• Operating system and version: Arch, Gnome/Wayland, linux-hardened
• Please note how you installed it (apt, dnf, pacman, source, etc): pacman
• Have you tried rebooting? Yes
• Is this a regression?
• Are you using an NVMe disk? Yes
• Is secure boot enabled? Yes
• Is this a Lenovo system with 'Boot Order Lock' turned on in the BIOS? No

[hughsie]

@mrhpearson the EC ESRT version seems to be zero!

[mrhpearson]

Yeah - that's weird. But an authentication error as well.

Raised internal ticket LO-2330 for the FW team. Some questions

• Can you confirm what FW version is shown in the BIOS setup screen (F1 during early boot)
• The self-signed is curious. I know it should work (and does for the distro's) so that is making me wonder if there's any issues there. Are you running the latest shim which requires a sbat section added to your signed UEFI executable?
• I've asked on recommendations for getting this back to normal.

Mark

[personaingrata]

• the bios reports v 0.1.14
• i can't think of any issues there, i've updated the EC one time and the UEFI System Firmware several times following the same process, with no issues. secure boot works as expected.
• the system is up-to-date, shim -signed 15.6+fedora+2 with --sbat /usr/share/grub/sbat.csv

• thanks

[DaleBCooper]

Same problem here with Lenovo X13 Gen 2i after upgrading system + embedded controller firmware, also got the "Update Error: failed to update to 0: authentication signing error"

20WL003SGE │ ├─Embedded Controller: │ Device ID: e35bc9f8a97b4d6a436962aaa2047da2d2186374 │ Current version: 0 │ Vendor: DMI:LENOVO │ GUIDs: e6c0d74d-98a2-489b-920d-f8e8c9418cb3 │ 32b2ee96-472f-527d-9486-35075869ff73 ← UEFI\RES_{E6C0D74D-98A2-489B-920D-F8E8C9418CB3}

BIOS setup screen (F1) shows correct Version:

Product Name:ThinkPad X13 Gen 2i Manufacturer:LENOVO Bios Version:N35ET51W (1.51 ) Bios Date:2022-12-07 ME Firmware Version:15.0.41.2142 Embedded Controller Version:N35HT41W (1.41 ) Machine Type:20WL003SGE

Trying to manual install the firmware fails:

sudo fwupdmgr install N35HT42W.cab Decompressing… [***] Not compatible with firmware version 0, requires >= 0.1.0

Are there any news regarding the recommendations for getting this back to normal?

[mrhpearson]

Added to notes to the FW team - no updates as yet.

Just to check - are you using your own secure boot keys as well? Is decure boot enabled?

[DaleBCooper]

Secure boot works, but is disabled since I need hibernate working (both are mutually exclusive). I do not use own keys, it is just a plain Debian 12 default installation.

[sch1ag]

Very similar problem on my ThinkPad T14 gen3 after fwupdmgr update:

# fwupdmgr get-history 
21AHA001CD
│
├─Embedded Controller:
│ │   Device ID:          ae1abd099407b1d95698d69b7273f7fed5c6f35c
│ │   Previous version:   0.1.4
│ │   Update State:       Failed
│ │   Update Error:       failed to run update on reboot
│ │   Last modified:      2023-03-18 23:01
│ │   GUID:               c6fdd612-fdf3-4bff-bc77-347bcdb0219f
│ │   Device Flags:       • Internal device
│ │                       • Updatable
│ │                       • System requires external power source
│ │                       • Supported on remote server
│ │                       • Needs a reboot after installation
│ │                       • Reported to remote server
│ │                       • Device is usable for the duration of the update
│ │ 
│ └─  New version:      0.1.08
│       Remote ID:        lvfs
│       License:          Unknown
│       Description:      
│       The vendor did not supply any release notes.
│     
└─System Firmware:
  │   Device ID:          632acf4927c0b5fb53519d6beed3b60adb73f1d5
  │   Previous version:   0.1.3
  │   Update State:       Failed
  │   Update Error:       failed to run update on reboot
  │   Last modified:      2023-03-18 23:02
  │   GUID:               30fbf24a-e1da-4840-84f6-6d7deb630e1d
  │   Device Flags:       • Internal device
  │                       • Updatable
  │                       • System requires external power source
  │                       • Supported on remote server
  │                       • Needs a reboot after installation
  │                       • Reported to remote server
  │                       • Cryptographic hash verification is available
  │                       • Device is usable for the duration of the update
  │ 
  └─  New version:      0.1.11
        Remote ID:        lvfs
        License:          Unknown
        Description:      
        The vendor did not supply any release notes.
 # 

BIOS shows:

Product Name:ThinkPad T14 Gen 3
Manufacturer:LENOVO
Bios Version:N3MET12W (1.11 )
Bios Date:2023-02-09
ME Firmware Version:16.0.15.1810
Embedded Controller Version:N3MHT07W (1.04 )
Machine Type:21AHA001CD
<snip>
Asset Tag:No Asset Tag
Cpu Type:12th Gen Intel(R) Core(TM) i5-1240P
Cpu Speed:1.700GHz

fwupdmgr get-devices shows Current version: 0 for Embedded Controller:

<snip>
├─Embedded Controller:
│     Device ID:          97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e
│     Summary:            UEFI ESRT device
│     Current version:    0
│     Vendor:             Lenovo (DMI:LENOVO)
│     Update State:       Failed
│     GUID:               c6fdd612-fdf3-4bff-bc77-347bcdb0219f
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
<snip>
├─System Firmware:
│ │   Device ID:          5bfc5b91c18ef8b751d3d052af77b69ebf738038
│ │   Summary:            UEFI ESRT device
│ │   Current version:    0.1.11
│ │   Vendor:             Lenovo (DMI:LENOVO)
│ │   Update State:       Success
│ │   GUIDs:              30fbf24a-e1da-4840-84f6-6d7deb630e1d
│ │                       230c8b18-8d9b-53ec-838b-6cfc0383493a ← main-system-firmware
│ │   Device Flags:       • Internal device
│ │                       • Updatable
│ │                       • System requires external power source
│ │                       • Supported on remote server
│ │                       • Needs a reboot after installation
│ │                       • Cryptographic hash verification is available
│ │                       • Device is usable for the duration of the update

[ChiWei-Chen]

Hi @personaingrata @DaleBCooper @sch1ag , I work with @mrhpearson and got some feedback from FW team. The FW team suspects upgrading EC FW when the battery level lower than 25% may cause an unexpected error which clears ESRT table. Do you remember the battery level when the upgrade EC failed on the first try? thanks.

[DaleBCooper]

Hi @ChiWei-Chen,

Do you remember the battery level when the upgrade EC failed on the first try? thanks.

My X13 was connected to the power supply and the battery level was 100%.

[personaingrata]

Hi @ChiWei-Chen, thanks for getting back to us. my battery charge start stop thresholds is between 50%-55% and i'm always connected to AC. so while updating, my battery level must be something inbetween there.

today fwupd offered me again to update to 0.1.15 "Lenovo-ThinkPad-T14Gen3-P14sGen3-T16-P16s-SystemFirmware-1.15-3.cab" but the update fails immediately with the following error "Message recipient disconnected from message bus without replying"

[ChiWei-Chen]

@DaleBCooper thanks for sharing the information.

@personaingrata , I haven't seen this issue when doing FW update. Not sure if this is fwupd related. Could you try firmware with fwupdmgr update and fwupdmgr grade terminal commands?

Please also provide log if it still failed. Thanks!

[personaingrata]

it still fails with the same error:

fwupdmgr refresh --force && fwupdmgr get-updates
Wird aktualisiert lvfs-testing Herunterladen … [ - ] Wird aktualisiert lvfs Herunterladen … [***] Neue Metadaten wurden erfolgreich heruntergeladen: 3 lokale Geräte unterstützt Geräte mit keinen verfügbaren Firmware-Aktualisierungen: • Fingerprint Sensor • Integrated Camera • Intel Management Engine • SSD 980 PRO 2TB • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI dbx Geräte mit der neuesten verfügbaren Firmware-Version: • System Firmware • Unifying Receiver LENOVO 21AKCTO1WW │ └─Embedded Controller: │ Gerätekennung: 97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e │ Zusammenfassung: UEFI ESRT device │ Aktuelle Version: 0 │ Anbieter: Lenovo (DMI:LENOVO) │ Aktualisierungsstatus:Fehlgeschlagen │ Aktualisierungsfehler:failed to update to 0: authentication signing error │ GUID: 7ddc47a5-a390-4571-a943-2636de3504d2 │ Device Flags: • Internes Gerät │ • Aktualisierbar │ • System benötigt externe Stromquelle │ • Unterstützt auf dem entfernten Server │ • Benötigt einen Neustart nach der Installation │ • Das Gerät ist während der Dauer der Aktualisierung nutzbar │ └─ThinkPad T14 Gen 3 / P14s Gen 3 / T16 / P16s: Neue Version: 0.1.15 Remote ID: lvfs Release ID: 27928 Zusammenfassung: Lenovo ThinkPad T14 Gen 3 / P14s Gen 3 / T16 / P16s Embedded controller Firmware Lizenz: Proprietär Größe: 1,2 MB Erstellt: 2023-02-09 Dringlichkeit: Mittel Anbieter: Lenovo Release Flags: • Vertrauenswürdige Metadaten • Ist Höherstufung Beschreibung:
Embedded controller version 1.15. Optional update by battery request.

sudo fwupdmgr update
Geräte mit keinen verfügbaren Firmware-Aktualisierungen: • Fingerprint Sensor • Integrated Camera • Intel Management Engine • SSD 980 PRO 2TB • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI dbx ╔══════════════════════════════════════════════════════════════════════════════╗ ║ Embedded Controller von 0 auf 0.1.15 aktualisieren? ║ ╠══════════════════════════════════════════════════════════════════════════════╣ ║ Embedded controller version 1.15. Optional update by battery request. ║ ║ ║ ║ 21AKCTO1WW muss während der gesamten Dauer der Aktualisierung an eine ║ ║ Stromquelle angeschlossen bleiben, um Schäden zu vermeiden. ║ ╚══════════════════════════════════════════════════════════════════════════════╝ Operation durchführen? [Y|n]: y Authentifizierung … [***] Message recipient disconnected from message bus without replying

sudo fwupdmgr upgrade [1] Geräte mit keinen verfügbaren Firmware-Aktualisierungen: • Fingerprint Sensor • Integrated Camera • Intel Management Engine • SSD 980 PRO 2TB • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI Device Firmware • UEFI dbx ╔══════════════════════════════════════════════════════════════════════════════╗ ║ Embedded Controller von 0 auf 0.1.15 aktualisieren? ║ ╠══════════════════════════════════════════════════════════════════════════════╣ ║ Embedded controller version 1.15. Optional update by battery request. ║ ║ ║ ║ 21AKCTO1WW muss während der gesamten Dauer der Aktualisierung an eine ║ ║ Stromquelle angeschlossen bleiben, um Schäden zu vermeiden. ║ ╚══════════════════════════════════════════════════════════════════════════════╝ Operation durchführen? [Y|n]: y Authentifizierung … [***] Message recipient disconnected from message bus without replying

sudo fwupdmgr install 8dd439c15818f7cf06a3619969d3c22cb6846a6e53012683dabf25f9b0e12e44-Lenovo-ThinkPad-T14Gen3-P14sGen3-T16-P16s-SystemFirmware-1.15-3.cab Authentifizierung … [ - ] Message recipient disconnected from message bus without replying

[ChiWei-Chen]

Authentifizierung … [ - ] Message recipient disconnected from message bus without replying

hi @hughsie could we have your input how FW team can debug this issue? It looks there is an issue with message bus (such D-Bus). thanks.

[hughsie]

@ChiWei-Chen that's my issue -- don't worry about it. I suspect it's https://github.com/fwupd/fwupd/pull/5662

[sch1ag]

Hi @personaingrata @DaleBCooper @sch1ag , I work with @mrhpearson and got some feedback from FW team. The FW team suspects upgrading EC FW when the battery level lower than 25% may cause an unexpected error which clears ESRT table. Do you remember the battery level when the upgrade EC failed on the first try? thanks.

Hello!

My T14 G3 was connected to AC power. I don’t remember exactly the battery level, but the probability of a level below 25% is extremely small.

Thank you!

[ChiWei-Chen]

Richard, thanks.

Hi, The firmware team suspected there is an issue in the previous EC firmware on LVFS, they re-upload the EC firmware, and it seems could get pass now. Could you give it a try? I can see some users can upgrade from zero version to this 1.15. https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN3BHT.firmware

Thanks!

[personaingrata]

todays fwupd update 1.8.14-1 from the Arch repos fixed the issue for me. i successfully updated the EC firmware to Version 0.1.15 fwupdmgr get-devices LENOVO 21AKCTO1WW ... │
├─Embedded Controller: │ Gerätekennung: 97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e │ Zusammenfassung: UEFI ESRT device │ Aktuelle Version: 0.1.15 │ Minimale Version: 0.1.15 │ Anbieter: Lenovo (DMI:LENOVO) │ Aktualisierungsstatus:Erfolg │ GUID: 7ddc47a5-a390-4571-a943-2636de3504d2 │ Device Flags: • Internes Gerät │ • Aktualisierbar │ • System benötigt externe Stromquelle │ • Unterstützt auf dem entfernten Server │ • Benötigt einen Neustart nach der Installation │ • Das Gerät ist während der Dauer der Aktualisierung nutzbar │
...

thank you all and the Lenovo FW Team

[sch1ag]

Hello!

No changes for my T14 G3 yet.

It looks a little strange that the latest versions of System Firmware and Embedded controller on LVFS do not correspond to one "package" from Lenovo.

LVFS:

1. Embedded controller Firmware N3MHT10W, version 1.07 https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN3MHT.firmware
2. System Firmware N3MET12W, version 1.11 https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN3MET.firmware

Lenovo: https://download.lenovo.com/pccbbs/mobiles/n3bul09w.txt

  <snip>
  Nuvoton EC chip version
  -----------------------------------
  Package ID     UEFI BIOS (BIOS ID)     ECP    (ECP ID)        Rev.   Issue Date
  -------------  ---------------------   --------------------   ----   ------------
  N3BUL09W       1.11 (N3MET12W)         1.08 (N3MHT11W)        01     2023/02/22
  N3BUL08W       1.10 (N3MET11W)         1.07 (N3MHT10W)        01     2022/12/21
  <snip>

Thanks!

[ChiWei-Chen]

Hi @sch1ag N3M is a different model T14 gen3, the FW team re-upload the EC firmware with the same instruction, could you give it a try? Thanks! https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN3MHT.firmware

[sch1ag]

Hello @ChiWei-Chen !

Yes, It solved the problem for me!

Versions after fwupdmgr refresh, fwupdmgr update and system reboot:

<snip>
├─Embedded Controller:
│     Device ID:          97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e
│     Summary:            UEFI ESRT device
│     Current version:    0.1.8
│     Minimum Version:    0.1.8
│     Vendor:             Lenovo (DMI:LENOVO)
│     Update State:       Success
│     GUID:               c6fdd612-fdf3-4bff-bc77-347bcdb0219f
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Supported on remote server
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
<snip>
├─System Firmware:
│ │   Device ID:          5bfc5b91c18ef8b751d3d052af77b69ebf738038
│ │   Summary:            UEFI ESRT device
│ │   Current version:    0.1.11
│ │   Vendor:             Lenovo (DMI:LENOVO)
│ │   Update State:       Success
│ │   GUIDs:              30fbf24a-e1da-4840-84f6-6d7deb630e1d
│ │                       230c8b18-8d9b-53ec-838b-6cfc0383493a ← main-system-firmware
│ │   Device Flags:       • Internal device
│ │                       • Updatable
│ │                       • System requires external power source
│ │                       • Supported on remote server
│ │                       • Needs a reboot after installation
│ │                       • Cryptographic hash verification is available
│ │                       • Device is usable for the duration of the update
<snip>

Thanks a lot!

[ChiWei-Chen]

@sch1ag , @personaingrata , thanks for the feedback. Can we close this task?

[sch1ag]

@ChiWei-Chen ,

in my opinion yes.

Thank you very much again!

[Lucas-Florin]

I have a similar problem on my ThinkPad L14 Gen4 AMD fwupdmgr get-devices:

LENOVO 21H5CTO1WW
[...]
│   
├─UEFI Device Firmware:
│     Device ID:          632acf4927c0b5fb53519d6beed3b60adb73f1d5
│     Summary:            UEFI ESRT device
│     Current version:    0
│     Vendor:             DMI:LENOVO
│     Update State:       Success
│     GUID:               d6fb7af8-7862-42a3-b442-8f990f194941
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
│   
├─UEFI Device Firmware:
│     Device ID:          97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e
│     Summary:            UEFI ESRT device
│     Current version:    0
│     Vendor:             Lenovo (DMI:LENOVO)
│     Update State:       Failed
│     Update Error:       failed to update to 0: authentication signing error
│     GUID:               f601b368-963d-43a6-ae78-c4dfff74231d
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Supported on remote server
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
│   
├─UEFI Device Firmware:
│     Device ID:          2292ae5236790b47884e37cf162dcf23bfcd1c60
│     Summary:            UEFI ESRT device
│     Current version:    532
│     Vendor:             DMI:LENOVO
│     Update State:       Success
│     GUID:               88523ddf-3aac-41f6-b15f-dc7bea434b39
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
│   
├─UEFI Device Firmware:
│     Device ID:          f95c9218acd12697af946874bfe4239587209232
│     Summary:            UEFI ESRT device
│     Current version:    0
│     Minimum Version:    15
│     Vendor:             DMI:LENOVO
│     Update State:       Success
│     GUID:               f8637dbe-5762-0000-873a-910aa71c49e4
│     Device Flags:       • Internal device
│                         • Updatable
│                         • System requires external power source
│                         • Needs a reboot after installation
│                         • Device is usable for the duration of the update
│   
[...]
Devices that were not updated correctly:
 • UEFI Device Firmware (0 → 0.1.17)
Devices that have been updated successfully:
 • Prometheus (10.01.3478575 → 10.01.3478575)

fwupdmgr get-history:

LENOVO 21H5CTO1WW
│
├─Prometheus:
│ │   Device ID:          23ec719b6aabc2d2dac5176c232f0da7a21881b0
│ │   Previous version:   10.01.3478575
│ │   Update State:       Success
│ │   Last modified:      2023-08-25 15:42
│ │   GUID:               659f7e45-8d45-528d-b3c7-0695eed055f6
│ │   Device Flags:       • Updatable
│ │                       • Supported on remote server
│ │                       • Cryptographic hash verification is available
│ │                       • Signed Payload
│ │ 
│ └─Prometheus:
│       New version:      10.01.3478575
│       Remote ID:        lvfs
│       Release ID:       10696
│       Summary:          Firmware for the Synaptics Prometheus Fingerprint Reader device
│       License:          Proprietary
│       Size:             425,5 kB
│       Created:          2021-06-09
│       Urgency:          Medium
│       Vendor:           Synaptics
│       Duration:         2 seconds
│       Description:      
│       New features and enhancements:
│       
│       • Fix an authentication issue on FOP project.
│     
└─UEFI Device Firmware:
  │   Device ID:          97b6fe9b220c7b9e1a3a1d9f404c00d4fe77ae7e
  │   Previous version:   0
  │   Update State:       Failed
  │   Update Error:       failed to update to 0: authentication signing error
  │   Last modified:      2023-08-25 15:44
  │   GUID:               f601b368-963d-43a6-ae78-c4dfff74231d
  │   Device Flags:       • Internal device
  │                       • Updatable
  │                       • System requires external power source
  │                       • Supported on remote server
  │                       • Needs a reboot after installation
  │                       • Device is usable for the duration of the update
  │ 
  └─ThinkPad L14 L15 Gen3 AMD:
        New version:      0.1.17
        Remote ID:        lvfs
        Release ID:       27500
        Summary:          Lenovo ThinkPad L14 L15 Gen3 AMD Embedded controller Firmware
        License:          Proprietary
        Size:             1,1 MB
        Created:          2023-03-17
        Urgency:          Critical
        Vendor:           Lenovo
        Release Flags:    • Is upgrade
        Description:      
        Lenovo ThinkPad L14 L15 Gen3 AMD Embedded controller Firmware

        • Fix "=", "(", ") "3 keys, actually output error characters on Numpad Keyboard for CR (hrvatski)
        • Add ECRAM[0x7F] bit5 GPIO control for TP4 FW update

Which LVFS package would I need to install? Here 0.1.17 is the newest stable version: https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadR1YHT.firmware should I just wait until 0.1.18 becomes stable?

[Lucas-Florin]

I tried installing the following: https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadR25HT.firmware https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadR25ET.BIOS.firmware But I get the following messages:

Decompressing…           [ -                                     ]
Specified firmware is older than installed '0.1.03 < 65539'

and

Decompressing…           [             /                         ]
Specified firmware is older than installed '0.1.08 < 65544'

respectively.

[ChiWei-Chen]

@Lucas-Florin , thanks for reporting the issue, this needs to be addressed by separate FW team (L14 Gen4 AMD). Could you create a separate ticket? I'll ask L14 Gen4 AMD team to look at this. (LO-2615 for my tracking internally)