Can I run fwupdmgr update with disk encryption?

[RazorEdge]

Hey guys,

I'm running Debian 11 on a Lenovo ThinkPad (4th Gen) and I'm getting a notification from Software that my firmware is out of date.

During install I set up my hard-drive with full disk encryption and LVM.

For some reason, I'm unable to update the firmware through the Software programme (or download any other software, it doesn't seem to work at all). I'm not too worried about this as from my knowledge I can run the following command to update the firmware instead:

sudo fwupdmgr update

My question is, am I going to run into any issues updating the firmware when the hard-drive is fully encrypted with LVM? Are my BIOS / boot sections encrypted and does this matter?

Checking here as I don't want to break anything!

Thanks

 

[Lord Boltar]

your disk encryption should not matter, once you have logged in, it is decrypted - also you do not have to run fwupdmgr - just click the update button in Software

 

[RazorEdge]

Thanks for the help

As mentioned, the update button in Software doesn't seem to work - I've clicked it before and nothing has happened, even after a restart. I tried to run fwupdmgr but was met with this, any suggestions for how to proceed?

 

[Lord Boltar]

Most likely the cache files are corrupted usually located in /home/.cache/gnome-software - delete the contents - it is a hidden folder so you need to be root or from the terminal

killall gnome-software
rm -rf ~/.cache/gnome-software

reboot and try from the terminal

sudo apt update

then

sudo apt upgrade -y

if there are updates - then run the Software app again

 

[RazorEdge]

Thank you Boltar. While that did fix Gnome Software (it now works normally), I've got a new error:

How would I proceed from here?

 

[Lord Boltar]

If you look at the 11.8.93.4323.cab you will notice that is a Windowz file not a Linux one with the .cab extension - so you have to make sure cabextract is installed - HTTP Authentication is the ability to tell the server your username and password so that it can verify that you're allowed to do the request you're doing. It looks like the site might require a different authentication method (check the headers returned by the server), The Authorization request header includes credentials to authenticate the client on the server. HTTP provides a built-in framework for user authentication and controlling access to protected resources.

I am not familiar with requesting this type of authorization

 

[RazorEdge]

Thanks again Boltar! I appreciate your help.

I've installed cabextract and I even tried turning off my VPN but still no luck. Interestingly after a reboot I was able to get an update message in the terminal:

However I ran this command and restarted my machine (both twice) and it's still displaying as not updated.

Are you able to provide me with more detail as for how to troubleshoot this authentication problem further? I'm not sure how to check the headers returned by the server - are there commands or third-party programmes that would do this?

Thanks!

 

[Lord Boltar]

Are you able to provide me with more detail as for how to troubleshoot this authentication problem further?

No I cannot - that is beyond me on how to do that - hopefully someone else will come in and help you further

 

[KGIII]

Lemme take a stab in the dark... I was going to toss this into the mix earlier, but I got distracted.

Are you using legacy mode instead of UEFI?

This command requires UEFI and can't be done in legacy mode, even though it looks like it is being updated.

 

[RazorEdge]

Hey KGIII, I think I'm using UEFI. I was able to confirm that the /sys/firmware/efi directory exists, which I believe means I'm using UEFI?

 

[KGIII]

Hey KGIII, I think I'm using UEFI. I was able to confirm that the /sys/firmware/efi directory exists, which I believe means I'm using UEFI?

View attachment 15637

Yup. You are using UEFI.

Sadly, that was the only thing I could think of that'd resolve this issue, or at least explain it.

 

[RazorEdge]

I appreciate the help guys.

I thought I could manually grab the BIOS upgrade from Lenovo and install it that way. I went to their website and found my laptop model and the latest firmware update package for Linux - https://pcsupport.lenovo.com/de/en/...ownloads/driver-list/component?name=BIOS/UEFI

The only thing that concerns me is that in the ReadMe, it mentions that Debian 9.3.0 is supported - I'm running Debian 11. Do you think this is likely to be an issue?

I've downloaded the file and extracted it, I'm left with two .cab files. I have cabextract installed.

These are the installation instructions provided in the ReadMe:

Manual Update Using fwupdmgr

1. Make sure the AC adapter is firmly connected to the target computer.
2. Launch Terminal.
3. Move to the directory where the cabinet file was placed.
4. Run fwupdmgr to schedule firmware update.

# fwupdmgr install xxx.cab

5. Restart the system.
You may be able to use "reboot" command.
If it is not available, select "Reboot" from Power icon on the desktop.
6. The computer will be restarted and the EFI BIOS will be updated.

Can someone explain why there are two files? Should I follow these using one of the .cab files or both? Or is it too risky with the incorrect OS version?

Let me know what you think, thanks!

 

[f33dm3bits]

Can someone explain why there are two files? Should I follow these using one of the .cab files or both? Or is it too risky with the incorrect OS version?

Looks like you need them both according to the versioning at the bottom of the readme file.

VERSION INFORMATION

The following versions of UEFI BIOS and ECP (Embedded Controller Program) have
been released to date.

Package (ID) UEFI BIOS (BIOS ID) ECP (ECP ID) Rev. Issue Date
-------------------- ------------------- --------------- ---- ----------
1.56 (N1FUL49W) 1.56 (N1FET82W) 1.19 (N1FHT36W) 01 2022/12/22

One is for the BIOS and the other for the ECP whatever that is, since first time hearing of it whatever ecp is.

Extended Capabilities Port

This definition explains the meaning of Extended Capabilities Port and why it matters.

www.techopedia.com

 

[Lord Boltar]

This BIOS feature is usually found under the Parallel Port Mode feature. It is slaved to the ECP (Extended Capabilities Port) option. Therefore, if you do not enable either ECP or ECP+EPP, this feature will disappear from the screen or appear grayed out.
This BIOS feature determines which DMA channel the parallel port should use when it is in ECP mode.
The ECP mode uses the DMA protocol to achieve data transfer rates of up to 2.5 Mbits/s and provides symmetric bidirectional communications. As per what @f33dm3bits has said you will need both

 

[RazorEdge]

Thank you for the information everyone.

I'll try using this method to update both the BIOS and ECP:

Manual Update Using fwupdmgr

1. Make sure the AC adapter is firmly connected to the target computer.
2. Launch Terminal.
3. Move to the directory where the cabinet file was placed.
4. Run fwupdmgr to schedule firmware update.

# fwupdmgr install xxx.cab

5. Restart the system.
You may be able to use "reboot" command.
If it is not available, select "Reboot" from Power icon on the desktop.
6. The computer will be restarted and the EFI BIOS will be updated.

Does have any recommendations regarding the install order (i.e. which one should I install first)?

 

[Lord Boltar]

My vote would be BIOS first

 

[RazorEdge]

Okay now I'm confused. I checked my BIOS and ECP version directly and it displayed this:

Those are the most up to date versions according to the Readme I downloaded from Lenovo's website:

Does this mean the issue is actually with my Software programme? It's still showing the below message:

Any idea where to go from here?

 

[RazorEdge]

Anyone?

 

[f33dm3bits]

Maybe it's a bug or maybe it's an update for another device in your laptop because the version number(176.0.1202 -> 184.93.4323) for the update is different than your actual firmware versions(1.56 and 1.19) which are official listed. It can't hurt to report a bug since you will then either be reporting a bug or get an answer from someone who knows more about fwupd.

Issues · fwupd/firmware-lenovo

Missing firmware for Lenovo Thinkpad hardware. Contribute to fwupd/firmware-lenovo development by creating an account on GitHub.

github.com