Fwupd on Kenno's Open Note

BIOS Firmware for ThinkPad P1 Gen1 1.33

Sat, 09 Jan 2021 00:26:45 +1100

Lenovo released the firmeware v1.33 for ThinkPad P1 Gen1 recently which addressed many CVEs.

CHANGES IN THIS RELEASE
  Version 1.33

[Important updates]
- Update includes a security fix.
- Addresses CVE-2020-0587, CVE-2020-0588, CVE-2020-0590,
  CVE-2020-0591, CVE-2020-0592, and CVE-2020-0593.
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0587)
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0588)
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0590)
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0591)
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0592)
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0593)

[New functions or enhancements]
- Updated the Diagnostics module to version 04.15.000.

[Problem fixes]
- Nothing

It’s worth noting that this 1.33 version is not yet available via fwupdmgr. So to update it, just download the firmeware zip file from Lenovo website. Then, manually install it. There are 2 files in the zip, and I only need to install 1 of them.

Dell Latitude 7400 System BIOS 1.11.1

Sat, 28 Nov 2020 20:59:08 +1100

Dell just released a new BIOS firmware of the Latitude 7400 series. This firmware was released on 23 Nov 2020.

Fixes:

Modified the default settings of the Intel Rapid Storage Technology driver.
Firmware updates to address the Intel Technical Advisory INTEL-TA-00391 (CVE-2020-8753, CVE-2020-8745, CVE-2020-8705, CVE-2020-8757, CVE-2020-8756, CVE-2020-8760, CVE-2020-8751, CVE-2020-8754, CVE-2020-8747, CVE-2020-8746, CVE-2020-8749 CVE-2020-8752, CVE-2020-12303, CVE-2020-12355, and CVE-2020-12356).
Firmware updates to address the Intel Security Advisory INTEL-SA-00358 (CVE-2020-0587, CVE-2020-0591, CVE-2020-0592, and CVE-2020-0593).
Firmware updates to address the Intel Security Advisory INTEL-SA-00381 (CVE-2020-8696 and CVE-2020-8698).
Firmware updates to address the Intel Security Advisory INTEL-SA-00389 (CVE-2020-8694 and CVE-2020-8695).
Firmware update to address CVE-2020-26189.

Enhancements:

BIOS Firmware for ThinkPad X1 Carbon Gen 6 1.50

Sun, 08 Nov 2020 10:57:52 +1100

Are you still rocking your X1 Carbon Gen 6 in 2020? Well, Lenovo just released a new BIOS firmware 1.50.

Here are changes in this release:

[Important updates]
 - Update includes a security fix.
 - Addresses CVE-2020-8696 and CVE-2020-8698.
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8696)
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8698)
 - Addresses CVE-2020-0587, CVE-2020-0588, CVE-2020-0590, CVE-2020-0591,
   CVE-2020-0592, and CVE-2020-0593.
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0587)
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0588)
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0590)
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0591)
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0592)
   (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0593)

[New functions or enhancements]
 - Updated the CPU microcode.
 - Updated the Diagnostics module to version 04.15.000.

[Problem fixes]
 Nothing.

It’s worth to note that this new firmware is available on Fedora (33) via fwupdmgr.

BIOS Firmware for ThinkPad P1 Gen1 1.32

Sun, 25 Oct 2020 14:08:20 +1100

Lenovo just released a new BIOS firmware for its ThinkPad P1 Gen 1, v1.32. This version fixes a few issues, as well as update the CPU microcode.

Here is the changes from Lenovo’s website.

CHANGES IN THIS RELEASE
  Version 1.32

[Important updates]
- Addresses CVE-2020-8696, CVE-2020-8698
- Addresses CVE-2020-8694, CVE-2020-8695

[New functions or enhancements]
- Updated the CPU microcode.

[Problem fixes]
- Fixed an issue where system might hang up at POST when some KVM device
  was connected.
- Fixed an issue where the screen might not be displayed on Thinkpad LCD when 
  opened lid just before startup Windows.
- Fixed an issue where system might not boot from network which is connected to
  ethernet of Thunderbolt3 WS Dock when boot mode is Legacy mode.
- Fixed an issue where system might hang at POST when Thunderbolt3 WS Dock
  is attached.
- Fixed an issue where BIOS might generate 0288 beep error.

I haven’t had time to update this 1.32 on my machine yet, though I think the update would be just as smooth as previous release on Fedora 32 system.

Dell Latitude 7400 System BIOS 1.10.1

Thu, 01 Oct 2020 17:40:11 +1000

Just found out that Dell just released the a new firmware, 1.10.1, for the Latitude 7400 series. This firmeware was released since 10 Sep 2020.

Fixes:

Firmware updates to address the Intel Technical Advisory INTEL-TA-00404 (CVE-2020-8758).
Fixed the issue where an error message stating Key Mapping for Console Redirection BIOS is displayed before the Dell logo screen,

Enhancements:

Updated the Embedded Controller Engine firmware.

I’m running Fedora 32 on this laptop. To update the firmeware, just execute fwupdmgr update.

Thunderbolt Firmware for ThinkPad X1 Carbon 6 1.20

Thu, 13 Aug 2020 18:23:20 +1000

A quick note to remind ThinkPad X1 Carbon 6 users that Lenovo just released a new firmware for the Thunderbolt on this laptop. And, it’s available via fwupd if you run Fedora (possibly also available on Ubuntu).

[root@benji ~]# fwupdmgr update
• Thunderbolt Controller has the latest available firmware version
Upgrade available for Embedded Controller from 0.1.20 to 0.1.21
20KHCTO1WW must remain plugged into a power source for the duration of the update to avoid damage. Continue with update? [Y|n]: 
Downloading…             [***************************************]
Decompressing…           [***************************************]
Authenticating…          [***************************************]
Updating Embedded Controller…************************************]
Scheduling…              [***************************************]
Successfully installed firmware
• Intel Management Engine has the latest available firmware version
• SAMSUNG MZVLW256HEHP-000L7 has no available firmware updates
• System Firmware has the latest available firmware version

An update requires a reboot to complete. Restart now? [y|N]:

All you need to do is rebooting the machine.

BIOS Firmware for ThinkPad P1 Gen1 1.31

Mon, 27 Jul 2020 00:21:18 +1000

It seems like Lenovo releases a new BIOS firmeware every month for its ThinkPad, at least for the ThinkPad P1 Gen1. On July 21, the BIOS firmware version 1.31 was released.

CHANGES IN THIS RELEASE
  Version 1.31

[Important updates]
- Address CVE-2020-0548, 
 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0548)
- Address CVE-2020-0549, 
 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0549)
- Address CVE-2020-0543, 
 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0543)

[New functions or enhancements]
- Updated the CPU microcode.

[Problem fixes]
- Fixed an issue where Force PXE boot by Intel AMT did not work.

This firmware supports both ThinkPad P1 Gen1 and ThinkPad X1 Extreme 1:

Dell Latitude 7400 System BIOS 1.9.1

Thu, 02 Jul 2020 20:19:32 +1000

Update BIOS firmware version 1.9.1 is available for Dell Latitude 7400. This firmware was released on 30 June 2020. It is marked Urgent and contains the following fixes and enhancements:

Fixes:

Fixed the issue where the system cannot detect the Intel Software Guard Extensions (SGX) device when SGX is enabled.
Firmware updates to address security advisory INTEL-SA-00295 (CVE-2020-0531, CVE-2020-0532, CVE-2020-0533, CVE-2020-0535, CVE-2020-0536, CVE-2020-0537, CVE-2020-0538, CVE-2020-0539, CVE-2020-0540, CVE-2020-0545, CVE-2020-0594, CVE-2020-0595, CVE-2020-0596, and CVE-2020-8674).
Firmware updates to address the Intel Security Advisory INTEL-SA-00320 (CVE-2020-0543).
Firmware updates to address the Intel Security Advisory INTEL-SA-00329 (CVE-2020-0548 and CVE-2020-0549).
Firmware updates to address the Intel Security Advisory INTEL-SA-00322 (CVE-2020-0528 and CVE-2020-0529).

Enhancements:

Dell Latitude 7400 System BIOS 1.7.4

Mon, 08 Jun 2020 15:19:11 +1000

Dell released a new BIOS firmware version 1.7.4 for the Latitude 7300 and 7400 on May 22, 2020. This release is again marked Urgent and contains the following fixes and enhancements:

Fixes:

Firmware updated to address CVE-2020-5363

Enhancements:

Updated the Embedded Controller Engine Firmware

This version 1.7.4 is already available on Fedora 32 via fwupdmgr tool.

[root@matht436 ~]# fwupdmgr refresh
Fetching signature https://cdn.fwupd.org/downloads/firmware.xml.gz.jcat
Downloading…             [***************************************]
Fetching metadata https://cdn.fwupd.org/downloads/firmware-00558-stable.xml.gz
Downloading…             [***************************************]
Successfully downloaded new metadata: 1 local device supported
[root@matht436 ~]# fwupdmgr update
• Thunderbolt Controller has no available firmware updates
• SSDPEKKF512G8 NVMe INTEL 512GB has no available firmware updates
Upgrade available for System Firmware from 1.7.3 to 1.7.4
Latitude 7400 must remain plugged into a power source for the duration of the update to avoid damage. Continue with update? [Y|n]:
Downloading 1.7.4 for System Firmware...
Fetching firmware https://fwupd.org/downloads/a397a5b5fb47d0411ce59e5a4550940681c741ebf8b601f9c90934e4a7ce4e29-Latitude_7X00_1.7.4.cab
Downloading…             [***************************************] Less than one minute remaining…
Decompressing…           [***************************************]
Authenticating…          [***************************************]
Updating System Firmware…[             /                         ]
Scheduling…              [***************************************]
Successfully installed firmware
• Touchpad has no available firmware updates
• Unifying Receiver has no available firmware updates

An update requires a reboot to complete. Restart now? [y|N]:

There was no problem after rebooting.

BIOS Firmware for ThinkPad P1 Gen1 1.30

Mon, 08 Jun 2020 12:08:44 +1000

Lenovo just released an updated BIOS firmware version 1.30 for ThinkPad P1 Gen1 on June 3rd.

The changes in this v1.30 release are:

CHANGES IN THIS RELEASE
  Version 1.30

[Important updates]
- Update includes a security fix.
- Address CVE-2020-0529, 
  (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0529)
- Address CVE-2020-0528, 
  (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0528)

[New functions or enhancements]
- Updated the Diagnostics module to version 04.12.001.

[Problem fixes]
- Fixed an issue where USB keyboard connected via Thunderbolt WS Dock might not be used at BIOS POST.

This firmware supports both ThinkPad P1 Gen1 and ThinkPad X1 Extreme 1:

BIOS Firmware for ThinkPad X1 Carbon Gen 6 1.48

Sat, 16 May 2020 19:10:33 +1000

On May 15, Lenovo released a new BIOS firmware for ThinkPad X1 Carbon Gen 6. The latest of the version of the firmware is 1.48. (There previous version 1.47 was withdrawn for some unknown reason.)

Changes in this releases:

CHANGES IN THIS RELEASE
  Version 1.48

[Important updates]
- Update includes a security fix.

[New functions or enhancements]
- Updated the Diagnostics module to version 04.12.001.

[Problem fixes]
- Fixed an issue where Force PXE boot by Intel AMT does not work.

As of today, this new firmware is not yet available via LVFS on Fedora 32. So for those who are impatient like me, we can install this firmware ourselves. Warning: In no way will I be liable if your brick your own machine when you follow this guide!

BIOS Firmware for Thinkpad P1 Gen1 1.29

Sat, 16 May 2020 14:52:11 +1000

It’s almost exactly one month from the last time Lenovo released (v1.28 of ) the BIOS firmware for ThinkPad P1 Gen 1. Apparently, v1.28 firmware has been marked “Withdrawn” according to this n2eul21w.txt.

The changes in this release v1.29 is:

CHANGES IN THIS RELEASE
  Version 1.29

[Important updates]
- Addresses CVE-2019-0154
  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0154)
  Refer to Lenovo's Security Advisory page for additional information about
  LEN-27714 "Multi-vendor BIOS Security Vulnerabilities".
  (https://support.lenovo.com/us/en/product_security/LEN-27714)

[New functions or enhancements]
- Updated the CPU microcode.

[Problem fixes]
- Nothing

This firmware supports both ThinkPad P1 Gen1 and ThinkPad X1 Extreme 1 listed below:

New System BIOS for Dell Latitude 7400 1.7.3

Sun, 12 Apr 2020 00:14:37 +1000

Dell just released a new system BIOS version 1.7.3 on April 8 for Dell Latitude 7400. This release is marked as Urgent, and comes with the following fixes and enhancements:

Fixes:

Fixed the issue where the Type-C port works from BIOS Boot Menu with external USB port disabled.
Fixed the issue that there is no user interface for wireless connection in BIOS Connect cloud SOS interface.
Fixed the issue where the system stops responding on Dell logo when SMM Security mitigation and Secure Boot is enabled.
Fixed the issue where the system is not able to update the BIOS from BIOS Boot Menu with SMM Security Mitigation enabled.

Enhancements:

New BIOS Firmware for ThinkPad P1 G1 1.28

Sat, 11 Apr 2020 15:40:30 +1000

So another new post, another new firmware update? You bet it is!

Early this month, Lenovo just released another BIOS firmware for ThinkPad P1 Gen 1. It looks like Lenovo has fixed a few bugs comparing to the the previous firmware release in March.

CHANGES IN THIS RELEASE
  Version 1.28

[Important updates]
- Addresses CVE-2019-0154 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2019-0154)
  Refer to Lenovo's Security Advisory page for additional information about 
  LEN-27714 "Multi-vendor BIOS Security Vulnerabilities"
  (https://support.lenovo.com/us/en/product_security/LEN-27714)
- Addresses CVE-2020-0548 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0548)
- Addresses CVE-2020-0549 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0549)
- Addresses CVE-2020-0543 (https://cve.mitre.org//cgi-bin//cvename.cgi?name=CVE-2020-0543)

[New functions or enhancements]
- Updated the CPU microcode.

[Problem fixes]
- Fixed an issue where system might hang after Intel AMT Control is set
  to Disabled by ThinkPad Setup.

Let’s update the firmware, shall we?

New BIOS Firmware for ThinkPad X1 Carbon G6 1.46

Tue, 31 Mar 2020 21:52:12 +1100

Lenovo has “quietely” released another firmware (1.46) for ThinkPad X1 Carbon Gen 6.

Changes in this release:

CHANGES IN THIS RELEASE
  Version 1.46

[Important updates]
- Update includes a security fix.

[New functions or enhancements]
  Nothing.

[Problem fixes]
  Nothing.

I am not able to find out what the “important security fix” is. However, I’m happy to report that the firmware update went well on X1 Carbon Gen 6 running Fedora 31.

New BIOS Firmware for ThinkPad P1 G1 1.27

Fri, 27 Mar 2020 21:31:55 +1100

If you’re still running ThinkPad P1 Gen 1 (Type 20MD, 20ME) like me, there is an exciting news, at least to me. Lenovo just released a new BIOS/UEFI firmware updated at version 1.27 on Mar 20, 2020.

Changes in this releases:

CHANGES IN THIS RELEASE
  Version 1.27

[Important updates]
- Addresses CVE-2019-0185 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0185)
   Refer to Lenovo's Security Advisory page for additionalinformation about
   LEN-27714 "Multi-vendor BIOS Security Vulnerabilities".
   (https://support.lenovo.com/us/en/product_security/LEN-27714)
- Security fix addresses LEN-29406 "ST Microelectronics TPM Firmware ECDSA
   Signature Generation Vulnerability". 
   Refer to Lenovo's Security Advisory page for additionalinformation.
   (https://support.lenovo.com/us/en/solutions/LEN-29406)
- Addresses CVE-2019-14607 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14607)

[New functions or enhancements]
- Updated the CPU microcode.
- Supported BIOS password authentication before entering into MEBx.

[Problem fixes]
- Nothing.

On a Fedora (31/32) laptop, to update the firmware is very easy nowaday. Here are the 2 commands to run:

New BIOS UEFI Firmware for ThinkPad X1 Carbon G6 1.45

Sun, 16 Feb 2020 23:40:55 +1100

Though a new firmware was release for ThinkPad X1 Carbon G6 since last month, 2020/01/23, I only found about this today. Unlike the firmware for Dell’s laptop, once can easily update it with fwupmgr if your Linux system supports it.

Here’s what’s changed in this release.

CHANGES IN THIS RELEASE
  Version 1.45
<1.45>
 UEFI: 1.45 / ECP: 1.20
- (Fix) Fixed an issue where a system hardware controller device might disappear
        at 2nd boot.

To update it on Fedora 31, run:

New System BIOS for Dell XPS 13 7390 1.1.13

Sun, 09 Feb 2020 22:42:21 +1100

Dell released a new System BIOS firmware for Dell XPS 13 2-in-1 version 1.1.3 at the end of last year. This release marked as Urgent, and it fixed the following issues (as taken from Dell’s site):

Fixed the incorrect panel size information in the BIOS setup menu.
Fixed the issue where the MAC Address Override fails during the Preboot eXecution Environment (PXE) boot process.
Change default setting of “Enable Thunderbolt (and PCIe behind TBT) pre-boot modules” to disabled by default

If your laptop runs Windows 10 and has Dell Update utilities installed, this System BIOS firmware update process is very simple. You just need to run this utility and click on Update button.

New BIOS Firmware for ThinkPad P1 1.25

Sun, 08 Dec 2019 01:02:27 +1100

It looks like Lenovo just released a new firmware for ThinkPad P1 Gen1 again.

Here is the changes in this 1.25 release:

CHANGES IN THIS RELEASE Version 1.25

[Important updates]
- Update includes security fixes.
- Addresses CVE-2019-0151 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0151)
- Addresses CVE-2019-0152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0152)
- Addresses CVE-2019-0123 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0123)
- Addresses CVE-2019-0124 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0124)
- Addresses CVE-2019-0117 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0117)
- Addresses CVE-2019-0184 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0184)

[New functions or enhancements]
- Updated the CPU microcode.
- Updated Regulatory Information.

[Problem fixes]
- Nothing.

Unlike previous BIOS version 1.24 update, I wanted to try to just use the fwupdmgr command utility to do it. It turned it out it was quite simple and straight forward.

New BIOS Firmware for ThinkPad P1 1.24

Mon, 07 Oct 2019 01:17:14 +1100

I’ve been relying on Gnome Software Center to let me know when new ThinkPad P1 firmware is available. Up until today, there is no new firmware available since the last update back in August 2019.

However, I stumbled on a post on reddit r/thinkpad, someone mentioned the BIOS 1.26 had been released for X1 Extreme/P1 Gen 2. This made me wonder if there was also new version of BIOS for the P1 Gen 1 that I have. Of course, there is a new BIOS firmware available: 1.24.

New Device Firmware Available for ThinkPad P1

Sun, 04 Aug 2019 22:29:42 +1000

It looks like there are more device firmware available for Lenovo ThinkPad P1 (and X1 Extreme).

Based on the list from Gnome Software Center, the available firmware are:

Thunderbolt Firmware N2ETF12W
System Firmware (Embedded Controller) 0.1.11
System Firmware (?) 0.1.23

It’s time to update all of them on my P1.

New Firmware 1.21 Available for ThinkPad P1

Sat, 08 Jun 2019 11:48:18 +1000

I run Fedora 30 on my ThinkPad P1 with i3 as a windows manager. Today, I switched to Plasma to test something out. While running plasma, I launched (Gnome) Software centre to check if there was any firmware update for this P1. To my surprise, there was one available: 1.21 released on April 29, 2019.

Feel free to find out what’s new in this firmware at the following link: P1 (Type 20MD, 20ME) Laptop (ThinkPad).

Update ThinkPad X1 Carbon G6 BIOS Update on Fedora

Thu, 13 Sep 2018 23:04:42 +0000

As a ThinkPad fan, I really like X1 Carbon (G6). I run Fedora 28 on it, and almost everything runs flawlessly. One issue that bothers me a lot is problem with suspend. The X1 Carbon G6 supports S0i3 instead of the S3. Without the S3, when the laptop is put to suspended, the battery continue to drain and sometimes the cpu fan keeps running.

Fortunately, this issue has been recently addressed by Lenovo through firmware update. According to the wiki.archlinux.org, S3 can be enabled in BIOS from BIOS version 1.30 or newer.