Arch Linux

ednana

Member

Registered: 2026-07-17

Posts: 8

unwanted firmware update?!

In the past week, when I booted up the (dynabook X30L) laptop, before any kernel starts,
I see beneath the OEM logo a message:   "The system update is being installed. please wait"
it's during boot so no screenshot, just a phone-shot, obviously
img URL: https://ibb.co/bRMDZGBh 

from AI i understand it should be firmware update.
But I'm SURE I haven't updated the bios in the past year. 

I'm using PCs for 30 years, I have updated BIOSs and firmware on other devices & components in the past, and I understand the danger in such step.

I certainly don't have Windows anywhere (deleted all its partitions).
I'm worried this might be some high-level hacking, AUR breach (Last I used AUR was 2 months ago).
Or it's a high level conspiracy paranoia.  Any theory is a valid theory.

What I did find, so far:

$ fwupdmgr get-history
No history

$ fwupdmgr security 

✔ CET OS Support:                Supported
✔ fwupd plugins:                 Untainted
✔ Linux swap:                    Disabled
✔ UEFI db:                       Not found
✘ Linux kernel lockdown:         Disabled
✘ Linux kernel:                  Tainted
✘ UEFI secure boot:              Disabled

$ ls   /sys/firmware/efi/esrt/entries/
total 0
drwxr-xr-x 2 root root 0 2026-07-17 08:04 entry0
drwxr-xr-x 2 root root 0 2026-07-17 08:04 entry2
drwxr-xr-x 2 root root 0 2026-07-17 08:04 entry1
drwxr-xr-x 2 root root 0 2026-07-17 08:04 entry3

$ journalctl -t fwupd --since "1 month ago"
Jul 17 07:50:44 ednan fwupd[8634]: 05:50:44.523 FuMain               fwupd 2.1.6 ready for requests

$ cat /sys/class/dmi/id/bios_version
Version 7.50
$ cat /sys/class/dmi/id/bios_date 
10/19/2023

last BIOS update offered on the manufacturer's site:
no version number, just date: 2026-03-11,    filename: P0119v860.EXE   (which I never used/opened/executed)

So what was that, who initiated it, who gave a permission, and how to block these things in the future?

Last edited by ednana (2026-07-18 21:54:19)

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 710

Re: unwanted firmware update?!

# journalctl -t fwupd --since "1 month ago"

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

(thanks!. I'm updating these outputs in the post itself)
Jul 17 07:50:44 ednan fwupd[8634]: 05:50:44.523 FuMain               fwupd 2.1.6 ready for requests

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 710

Re: unwanted firmware update?!

Doesn't look like fwupd updated something.
Was there BIOS update released recently for your laptop at all? Usually history of released updates available on manufacturer web site. Does version on your laptor match the latest released version?

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

Doesn't look like fwupd updated something.
Was there BIOS update released recently for your laptop at all? Usually history of released updates available on manufacturer web site. Does version on your laptor match the latest released version?

manufacturer website says last  BIOS firmware leased 4 months:   2026-03-11
But I saw these messages this week only (I have it 2 years).
I just ran

sudo dmidecode

, and i couldn't get clear BIOS version.
I entered the BIOS but couldn't find anything about a version of itself.

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 710

Re: unwanted firmware update?!

manufacturer website says last  BIOS firmware leased 4 months:   2026-03-11
But I saw these messages this week only.

Pretty enough time for update to get into LVFS database. However, fwupdmgr get-history shows nothing. That's strange, indeed.

Maybe it wasn't related to BIOS firmware but some key revocation etc.

I just ran sudo dmidecode, and i couldn't get clear BIOS version.

Maybe

$ cat /sys/class/dmi/id/bios_version

?

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

manufacturer website says last  BIOS firmware leased 4 months:   2026-03-11
But I saw these messages this week only.

Maybe

$ cat /sys/class/dmi/id/bios_version

?

$ cat /sys/class/dmi/id/bios_version
Version 7.50
$ cat /sys/class/dmi/id/bios_date 
10/19/2023

I'm confused,
1) the progress indicator (shown in the photo) reaches 100% on every time, so it's theoretically finished.  So why it repeats on next reboot?
And I reboot often this week since I'm solving multiple issues: audio jack (solved), USB-C PD stopped charging this week (not solved; 1 out of 2), DE + software bugs (solved).

2) what are the entries in /sys/firmware/efi/esrt/entries/ ?
3)  why I can't see verbose information?
4) Maybe this is not the only hardware that needs firmware updating in the computer?
after all, most sophisticated devices has firmware, and sometimes firmware update.
5) when the computer starts - there are some errors that scroll too fast, i'll try to reboot and record a video this time
6) is this "update" part of the BIOS? or comes from the OS?
7) what part of my computer can initiate such update without my will or consent ?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 76,896

Re: unwanted firmware update?!

what are the entries in /sys/firmware/efi/esrt/entries/

How are we to know?
Filesize, https://man.archlinux.org/man/file.1 and some hex viewer / https://man.archlinux.org/man/strings.1 might help to figure what that is.
The timestamps and the only fwupd log entry look a bit too co-incidental, though. Did you only install fwupd yesterday?

why I can't see verbose information?

Verbose information about what specifically?

7) what part of my computer can initiate such update without my will or consent ?

Does the UEFI have network access (unlikely if there's no wired connedction)?
You can https://wiki.archlinux.org/title/Audit_ … ies_access to see whether anything on the OS access that path and when and how.

If you move those files away (don't delete them because then you can't analyze them any more), are they being regenerated?
(If so, does the audit log that?)

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,228

Re: unwanted firmware update?!

Some systems have a uefi backup firmware that will be used when a firmware update goes wrong .

dynamod doesn't appear to produce laptops but there is a dynabook portege .
What is the exact model of your laptop ?

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 710

Re: unwanted firmware update?!

1) the progress indicator (shown in the photo) reaches 100% on every time, so it's theoretically finished.  So why it repeats on next reboot?

How long does the update process takes?

Maybe flash is locked r/o but updater code doesn't check for write errors.
Maybe flash is degraded and UEFI recovers image from backup area.
Maybe some recent changes in bootloader / EFI stub / systemd makes UEFI to think mistakenly that there is an update.

2) what are the entries in /sys/firmware/efi/esrt/entries/ ?

https://raw.githubusercontent.com/archl … e-efi-esrt

# grep -H '' -r /sys/firmware/efi/esrt/entries

Also

# find /boot/EFI/ -printf "%TF %.8TT  %P\n"

Change /boot/EFI to actual ESP partition location.

5) when the computer starts - there are some errors that scroll too fast, i'll try to reboot and record a video this time

It would be helpful.
Does your BIOS Setup UI has any administration / diagnostics / logging options?

6) is this "update" part of the BIOS? or comes from the OS?

We don't know yet.

7) what part of my computer can initiate such update without my will or consent ?

Technically anything with sufficient permissions can. If you don't want automated BIOS update, why do you have fwupd installed ifp? However, the issue may be caused not by fwupd.

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,683

Re: unwanted firmware update?!

Maybe flash is degraded and UEFI recovers image from backup area.

That is an interesting thought.   The make and model had not been made in years, any chance it has a coin cell Lithium battery that might be dead?

As to the musing about a low level hack; Is secure boot enabled?

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
The shortest way to ruin a country is to give power to demagogues.— Dionysius of Halicarnassus
---
How to Ask Questions the Smart Way

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

what are the entries in /sys/firmware/efi/esrt/entries/

How are we to know?
Filesize, https://man.archlinux.org/man/file.1 and some hex viewer / https://man.archlinux.org/man/strings.1 might help to figure what that is.
The timestamps and the only fwupd log entry look a bit too co-incidental, though. Did you only install fwupd yesterday?

/d/temp/sys-firmware-efi-esrt-entries/entry0 $ ls
-r-------- 1 root root    2 2026-07-18 23:57 last_attempt_status
-r-------- 1 root root   11 2026-07-18 23:57 last_attempt_version
-r-------- 1 root root    4 2026-07-18 23:57 capsule_flags
-r-------- 1 root root   11 2026-07-18 23:57 lowest_supported_fw_version
-r-------- 1 root root   11 2026-07-18 23:57 fw_version
-r-------- 1 root root    2 2026-07-18 23:57 fw_type
-r-------- 1 root root   37 2026-07-18 23:57 fw_class

/d/temp/sys-firmware-efi-esrt-entries/entry0 $ file fw_class 
fw_class: regular file, no read permission

 /d/temp/sys-firmware-efi-esrt-entries $ ls
total 24K
drwxr-xr-x  2 root root 4.0K 2026-07-18 23:57 entry3
drwxr-xr-x  2 root root 4.0K 2026-07-18 23:57 entry2
drwxr-xr-x  2 root root 4.0K 2026-07-18 23:56 entry1
drwxr-xr-x  2 root root 4.0K 2026-07-18 23:56 entry0

/d/temp/sys-firmware-efi-esrt-entries $ du -skh *
32K     entry0
32K     entry1
32K     entry2
32K     entry3

7) what part of my computer can initiate such update without my will or consent ?

Does the UEFI have network access (unlikely if there's no wired connedction)?
You can https://wiki.archlinux.org/title/Audit_ … ies_access to see whether anything on the OS access that path and when and how.

I can hook it via an ethernet cable,
but I don't have another machine to put in the middle (and my laptop's kernel isn't running yet at this stage)
and I don't know if it's wise to open this whatever-this-is to the internet.
But it's a good point. i'll see what I can do.

If you move those files away (don't delete them because then you can't analyze them any more), are they being regenerated?
(If so, does the audit log that?)

I can't.  it looks like a special file:                                                                                                                                                           

$ sudo mv /sys/firmware/efi/esrt/entries/entry1 /d/temp/sys-firmware-efi-esrt-entries/
mv: cannot remove '/sys/firmware/efi/esrt/entries/entry1/fw_class': Operation not permitted

ok. they're practically empty:

Last edited by ednana (2026-07-18 22:16:59)

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

Some systems have a uefi backup firmware that will be used when a firmware update goes wrong.

my question is "what triggeres the update in the first place".

dynamod doesn't appear to produce laptops but there is a dynabook portege .
What is the exact model of your laptop ?

updated the description,
it's a dynabook portege x30L
(until few years ago it was called Toshiba)

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

7) what part of my computer can initiate such update without my will or consent ?

Technically anything with sufficient permissions can. If you don't want automated BIOS update, why do you have fwupd installed ifp? However, the issue may be caused not by fwupd.

this is super weird:
I don't remember installing it myself.
my shell's history don't have a memory of that, neither root

$ history |g hw
$ sudo su
# history |g hw

Crickets.
And we can clearly see that it was installed recently.
Does the install-date given by pacman is the first install date, or the latest update?  Because I ran a complete upgraded few days ago.

$ pacman -Qi fwupd
Name            : fwupd
Version         : 2.1.6-1
Description     : Simple daemon to allow session software to update firmware
Architecture    : x86_64
Provides        : libfwupd.so=3-64
Required By     : None
Optional For    : kinfocenter
Conflicts With  : None
Replaces        : None
Installed Size  : 18.93 MiB
Build Date      : Wed 01 Jul 2026 06:00:15 PM CEST
Install Date    : Tue 14 Jul 2026 07:53:26 PM CEST
Install Reason  : Explicitly installed
Install Script  : No
Validated By    : Signature

I'm either afraid it's a strange hacking attempt,
or i lost my brain. 
But I didn't want to update any firmware lately.
There's a VERY slight chance that I installed it in order to understad what's going on.  But I don't think so...

ednana

Member

Registered: 2026-07-17

Posts: 8

Re: unwanted firmware update?!

Maybe flash is degraded and UEFI recovers image from backup area.

That is an interesting thought.   The make and model had not been made in years, any chance it has a coin cell Lithium battery that might be dead?

As to the musing about a low level hack; Is secure boot enabled?

Yes, secure boot is disabled. By myself, 1-2 years ago, when I transitioned to linux from the OEM Windows.

The computer is pretty new, it was bought only 2.5 years ago (X30L-k).
I believe this is not a battery issue,
but if there's a chance, i'll try to locate the battery (it's a laptop)

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 76,896

Re: unwanted firmware update?!

There's a VERY slight chance that I installed it in order to understad what's going on.  But I don't think so...

Don't think, check
=> /var/log/pacman.log

fw_class: regular file, no read permission

The files are read only for the root, so you'll have to sudo file etc.
The ones you listed are also just few bytes, likely some single lines.

I can hook it via an ethernet cable,

That's not what I meant - if you're not using a wired connection right how it is extremely unlikely that the firmware itself downloaded any kind of update.
This also has nothing to do w/ the auditing which will just make the kernel log what processes are accessing those paths.
Pretty sure it's fwupd, though.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 710

Re: unwanted firmware update?!

/d/temp/sys-firmware-efi-esrt-entries $ ls

Check the content of entries as root:

# grep -H '' -r /sys/firmware/efi/esrt/entries 

This may answer to

4) Maybe this is not the only hardware that needs firmware updating in the computer?

What is on your EFI partition?

# find /boot/EFI/ -printf "%TF %.8TT  %P\n"

Doesn't fwupdx64.efi run at boot?

coin cell Lithium battery that might be dead?

Flash memory doesn't require external power to retain content. Afaik, only RTC and some user's settings do.