Strange Microsoft UEFI CA firmware update message

Issues & Assistance
1

MS_UEFI_CA_20250628
MS_UEFI_CA_20250628963×305 50.1 KB

That’s a strange message about invalidating hardware secrets. Should I be installing this? I’m guessing it’s updated firmware signatures for UEFI. It’s not likely to break anything right?

inxi:

System:
Kernel: 6.15.4-zen2-1-zen arch: x86_64 bits: 64 compiler: gcc v: 15.1.1
clocksource: hpet avail: acpi_pm
parameters: BOOT_IMAGE=/@/boot/vmlinuz-linux-zen
root=UUID=b71c31f1-55e9-4354-a076-2d2364f5e63d rw rootflags=subvol=@
nvidia-drm.modeset=1 nouveau.modeset=0 nvidia.NVreg_EnableGpuFirmware=0
drm.edid_firmware=DP-1:edid/AOC_edid.bin mt7921e.disable_aspm=Y
pcie_aspm=off quiet loglevel=3 sysrq_always_enabled=1 ibt=off
Desktop: KDE Plasma v: 6.4.1 tk: Qt v: N/A info: frameworks v: 6.15.0
wm: kwin_wayland vt: 2 dm: SDDM Distro: Garuda base: Arch Linux
Machine:
Type: Laptop System: ASUSTeK product: ASUS TUF Gaming A15 FA506QM_TUF506QM
v: 1.0 serial: <superuser required>
Mobo: ASUSTeK model: FA506QM v: 1.0 serial: <superuser required>
uuid: <superuser required> UEFI: American Megatrends LLC. v: FA506QM.314
date: 01/07/2023
Battery:
ID-1: BAT1 charge: 42.5 Wh (61.2%) condition: 69.4/90.2 Wh (76.9%)
volts: 15.5 min: 15.9 model: ASUS A32-K55 type: Li-ion serial: N/A
status: not charging
CPU:
Info: model: AMD Ryzen 7 5800H with Radeon Graphics bits: 64 type: MT MCP
arch: Zen 3 gen: 3 level: v3 note: check built: 2021-22
process: TSMC n7 (7nm) family: 0x19 (25) model-id: 0x50 (80) stepping: 0
microcode: 0xA500011
Topology: cpus: 1x dies: 1 clusters: 1 cores: 8 threads: 16 tpc: 2
smt: enabled cache: L1: 512 KiB desc: d-8x32 KiB; i-8x32 KiB L2: 4 MiB
desc: 8x512 KiB L3: 16 MiB desc: 1x16 MiB
Speed (MHz): avg: 1103 min/max: 403/4465 boost: enabled scaling:
driver: amd-pstate-epp governor: powersave cores: 1: 1103 2: 1103 3: 1103
4: 1103 5: 1103 6: 1103 7: 1103 8: 1103 9: 1103 10: 1103 11: 1103 12: 1103
13: 1103 14: 1103 15: 1103 16: 1103 bogomips: 102204
Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
Vulnerabilities: <filter>
Graphics:
Device-1: NVIDIA GA106M [GeForce RTX 3060 Mobile / Max-Q] vendor: ASUSTeK
driver: nvidia v: 575.64 alternate: nouveau,nvidia_drm non-free: 550-570.xx+
status: current (as of 2025-04; EOL~2026-12-xx) arch: Ampere code: GAxxx
process: TSMC n7 (7nm) built: 2020-2023 pcie: gen: 1 speed: 2.5 GT/s
lanes: 8 link-max: gen: 4 speed: 16 GT/s lanes: 16 ports: active: none
off: DP-1 empty: none bus-ID: 01:00.0 chip-ID: 10de:2520 class-ID: 0300
Device-2: Advanced Micro Devices [AMD/ATI] Cezanne [Radeon Vega Series /
Radeon Mobile Series] vendor: ASUSTeK driver: amdgpu v: kernel arch: GCN-5
code: Vega process: GF 14nm built: 2017-20 pcie: gen: 3 speed: 8 GT/s
lanes: 16 ports: active: HDMI-A-1 off: eDP-1 empty: none bus-ID: 06:00.0
chip-ID: 1002:1638 class-ID: 0300 temp: 51.0 C
Device-3: Sonix USB2.0 HD UVC WebCam driver: uvcvideo type: USB rev: 2.0
speed: 480 Mb/s lanes: 1 mode: 2.0 bus-ID: 1-4:3 chip-ID: 322e:202c
class-ID: 0e02
Display: wayland server: X.org v: 1.21.1.18 with: Xwayland v: 24.1.8
compositor: kwin_wayland driver: X: loaded: amdgpu,nvidia
unloaded: modesetting,nouveau,radeon alternate: fbdev,nv,vesa
dri: radeonsi gpu: amdgpu,nvidia,nvidia-nvswitch display-ID: 0
Monitor-1: DP-1 model: AOC CQ27G4 serial: <filter> built: 2024 res:
mode: 2560x1440 hz: 144 scale: 100% (1) dpi: 109 gamma: 1.2
size: 597x336mm (23.5x13.23") diag: 685mm (27") ratio: 16:9 modes:
max: 2560x1440 min: 640x480
Monitor-2: HDMI-A-1 model: Sony TV serial: <filter> built: 2010 res:
mode: 1920x1080 hz: 60 scale: 100% (1) dpi: 30 gamma: 1.2
size: 1600x900mm (62.99x35.43") diag: 1836mm (72.3") ratio: 16:9 modes:
max: 1920x1080 min: 640x480
Monitor-3: eDP-1 model: Najing CEC Panda 0x004d built: 2019 res: 1920x1080
dpi: 142 gamma: 1.2 size: 344x194mm (13.54x7.64") diag: 395mm (15.5")
ratio: 16:9 modes: max: 1920x1080 min: 640x480
API: EGL v: 1.5 hw: drv: nvidia drv: amd radeonsi platforms: device: 0
drv: nvidia device: 1 drv: radeonsi device: 3 drv: swrast gbm:
drv: kms_swrast surfaceless: drv: nvidia wayland: drv: radeonsi x11:
drv: radeonsi inactive: device-2
API: OpenGL v: 4.6.0 compat-v: 4.5 vendor: amd mesa v: 25.1.4-arch1.1
glx-v: 1.4 direct-render: yes renderer: AMD Radeon Graphics (radeonsi
renoir ACO DRM 3.63 6.15.4-zen2-1-zen) device-ID: 1002:1638
memory: 500 MiB unified: no display-ID: :0.0
API: Vulkan v: 1.4.313 layers: 14 device: 0 type: integrated-gpu name: AMD
Radeon Graphics (RADV RENOIR) driver: mesa radv v: 25.1.4-arch1.1
device-ID: 1002:1638 surfaces: N/A device: 1 type: discrete-gpu
name: NVIDIA GeForce RTX 3060 Laptop GPU driver: nvidia v: 575.64
device-ID: 10de:2520 surfaces: N/A device: 2 type: cpu name: llvmpipe
(LLVM 20.1.6 256 bits) driver: mesa llvmpipe v: 25.1.4-arch1.1 (LLVM
20.1.6) device-ID: 10005:0000 surfaces: N/A
Info: Tools: api: clinfo, eglinfo, glxinfo, vulkaninfo
de: kscreen-console,kscreen-doctor gpu: lact, nvidia-settings, nvidia-smi
wl: wayland-info x11: xdpyinfo, xprop, xrandr
Audio:
Device-1: NVIDIA GA106 High Definition Audio vendor: ASUSTeK
driver: snd_hda_intel v: kernel pcie: gen: 3 speed: 8 GT/s lanes: 8
link-max: gen: 4 speed: 16 GT/s lanes: 16 bus-ID: 01:00.1
chip-ID: 10de:228e class-ID: 0403
Device-2: Advanced Micro Devices [AMD/ATI] Renoir Radeon High Definition
Audio vendor: ASUSTeK driver: snd_hda_intel v: kernel pcie: gen: 3
speed: 8 GT/s lanes: 16 bus-ID: 06:00.1 chip-ID: 1002:1637 class-ID: 0403
Device-3: Advanced Micro Devices [AMD] Audio Coprocessor driver: N/A
alternate: snd_pci_acp3x, snd_rn_pci_acp3x, snd_pci_acp5x, snd_pci_acp6x,
snd_acp_pci, snd_rpl_pci_acp6x, snd_pci_ps, snd_sof_amd_renoir,
snd_sof_amd_rembrandt, snd_sof_amd_vangogh, snd_sof_amd_acp63,
snd_sof_amd_acp70 pcie: gen: 3 speed: 8 GT/s lanes: 16 bus-ID: 06:00.5
chip-ID: 1022:15e2 class-ID: 0480
Device-4: Advanced Micro Devices [AMD] Family 17h/19h/1ah HD Audio
vendor: ASUSTeK driver: snd_hda_intel v: kernel pcie: gen: 3 speed: 8 GT/s
lanes: 16 bus-ID: 06:00.6 chip-ID: 1022:15e3 class-ID: 0403
API: ALSA v: k6.15.4-zen2-1-zen status: kernel-api tools: N/A
Server-1: PipeWire v: 1.4.6 status: active with: 1: pipewire-pulse
status: active 2: wireplumber status: active 3: pipewire-alsa type: plugin
4: pw-jack type: plugin tools: pactl,pw-cat,pw-cli,wpctl
Network:
Device-1: Realtek RTL8111/8168/8211/8411 PCI Express Gigabit Ethernet
vendor: ASUSTeK driver: r8169 v: kernel pcie: gen: 1 speed: 2.5 GT/s
lanes: 1 port: e000 bus-ID: 02:00.0 chip-ID: 10ec:8168 class-ID: 0200
IF: enp2s0 state: down mac: <filter>
Device-2: MEDIATEK MT7921 802.11ax PCI Express Wireless Network Adapter
vendor: AzureWave driver: mt7921e v: kernel pcie: gen: 2 speed: 5 GT/s
lanes: 1 bus-ID: 03:00.0 chip-ID: 14c3:7961 class-ID: 0280
IF: wlp3s0 state: up mac: <filter>
Info: services: NetworkManager, systemd-timesyncd, wpa_supplicant
Bluetooth:
Device-1: IMC Networks Wireless_Device driver: btusb v: 0.8 type: USB
rev: 2.1 speed: 480 Mb/s lanes: 1 mode: 2.0 bus-ID: 3-3:3 chip-ID: 13d3:3563
class-ID: e001 serial: <filter>
Report: btmgmt ID: hci0 rfk-id: 0 state: up address: N/A
Drives:
Local Storage: total: 3.19 TiB used: 1.32 TiB (41.3%)
SMART Message: Unable to run smartctl. Root privileges required.
ID-1: /dev/nvme0n1 maj-min: 259:4 vendor: Samsung
model: MZVLQ512HBLU-00B00 size: 476.94 GiB block-size: physical: 512 B
logical: 512 B speed: 31.6 Gb/s lanes: 4 tech: SSD serial: <filter>
fw-rev: FXM7201Q temp: 29.9 C scheme: GPT
ID-2: /dev/nvme1n1 maj-min: 259:0 vendor: Samsung
model: SSD 970 EVO Plus 2TB size: 1.82 TiB block-size: physical: 512 B
logical: 512 B speed: 31.6 Gb/s lanes: 4 tech: SSD serial: <filter>
fw-rev: 2B2QEXM7 temp: 41.9 C scheme: GPT
ID-3: /dev/sda maj-min: 8:0 vendor: Western Digital model: WD10EAVS-00D7B1
size: 931.51 GiB block-size: physical: 512 B logical: 512 B type: USB
rev: 2.0 spd: 480 Mb/s lanes: 1 mode: 2.0 tech: N/A serial: <filter>
fw-rev: 1.75 scheme: MBR
Partition:
ID-1: / raw-size: 90 GiB size: 90 GiB (100.00%) used: 66.83 GiB (74.3%)
fs: btrfs dev: /dev/nvme1n1p3 maj-min: 259:2
ID-2: /boot/efi raw-size: 260 MiB size: 256 MiB (98.46%)
used: 23.7 MiB (9.2%) fs: vfat dev: /dev/nvme0n1p1 maj-min: 259:5
ID-3: /home raw-size: 90 GiB size: 90 GiB (100.00%)
used: 66.83 GiB (74.3%) fs: btrfs dev: /dev/nvme1n1p3 maj-min: 259:2
ID-4: /var/log raw-size: 90 GiB size: 90 GiB (100.00%)
used: 66.83 GiB (74.3%) fs: btrfs dev: /dev/nvme1n1p3 maj-min: 259:2
ID-5: /var/tmp raw-size: 90 GiB size: 90 GiB (100.00%)
used: 66.83 GiB (74.3%) fs: btrfs dev: /dev/nvme1n1p3 maj-min: 259:2
Swap:
Kernel: swappiness: 133 (default 60) cache-pressure: 100 (default) zswap: no
ID-1: swap-1 type: zram size: 15.02 GiB used: 0 KiB (0.0%) priority: 100
comp: zstd avail: lzo-rle,lzo,lz4,lz4hc,deflate,842 dev: /dev/zram0
Sensors:
System Temperatures: cpu: 65.5 C mobo: 42.0 C gpu: amdgpu temp: 51.0 C
Fan Speeds (rpm): N/A
Info:
Memory: total: 16 GiB note: est. available: 15.02 GiB used: 5.8 GiB (38.6%)
Processes: 400 Power: uptime: 2h 32m states: freeze,mem,disk
suspend: s2idle wakeups: 0 hibernate: platform avail: shutdown, reboot,
suspend, test_resume image: 5.92 GiB services: org_kde_powerdevil,
power-profiles-daemon, upowerd Init: systemd v: 257 default: graphical
tool: systemctl
Packages: 1777 pm: pacman pkgs: 1742 libs: 499 tools: octopi,pacseek,paru
pm: flatpak pkgs: 35 Compilers: gcc: 15.1.1 Shell: garuda-inxi default: fish
v: 4.0.2 running-in: yakuake inxi: 3.3.38
Garuda (2.7.3-1):
System install date:     2024-08-27
Last full system update: 2025-06-30
Is partially upgraded:   No
Relevant software:       snapper NetworkManager dracut nvidia-dkms
Windows dual boot:       No/Undetected
Failed units:            memory_monitor.service
2

I’m no expert, but this seems to be legitimate. Try running fwupdmgr update in terminal. It usually provides more details.

3 Likes
3

do NOT use discover for updates. please use the official update program garuda-update which can be called from the terminal via garuda-update OR update OR upd

2 Likes
4

This is generally good advice, that said, garuda-update doesn’t handle flatpak updates which Discover does, and I don’t think garuda-update handles fwupdmgr updates either. I think Discover is safe for flatpak updates (or you can run it via terminal too, I guess, via flatpak update). I’ve never had a successful update execute for FW updates via discover, and can only run it via terminal (i.e., fwupdmgr update).

5

Install and use Topgrade. First run Garuda-Update then Topgrade. Discover is only really good for Plasma addons and theme components.

6

OO! Never heard of topgrade before! Thanks for the tip :wink:

1 Like
7

If you are not familiar with fwupd/fwupdmgr you could install and use gnome-firmware. It´s a GUI tool for updating firmware supported by fwupd.

8

Topgrade will update that as well.

9

According to the Arch wiki, Discover is just another front end to fwupd. If gnome-firmware is safe for firmware updates, Discover is probably fine too (not for general Arch repo software installs or updates, though).

1 Like
10

So in the end I tried Topgrade per Locutus’ suggestion. Handy looking tool, doing the 3 kinds of update: general repos, AUR with paru, and firmware. Topgrade seemed to do the update, so I rebooted. After that Discover thought the update still needed doing so I attempted it but got an error:

ERROR
Failed to download metadata for lvfs: network is unreachable: Host unreachable.

However, Topgrade reports

Devices with the latest available firmware version:
• UEFI CA
• UEFI dbx
────────────────────────────────────────────────
Devices that have been updated successfully:
• UEFI CA (2011 → 2023)

So that looks good. Fingers crossed all is well.

That’s my approach generally too. ‘upd’ wasn’t picking up on this firmware update however.

Thanks for checking that. Good to know. I presumed it was safe because Discover only shows Flatpaks and firmware updates on Garuda, at least for me.

11

Please just use garuda-update, topgraded of the majority of updates including firmware, and Discover ONLY for theme components and widgets.

1 Like
12

You can configure topgrade to use garuda-update by editing ~/.config/topgrade.toml under the [linux] section you’ll see arch_package_manager set it so that it reads: arch_package_manager = "garuda_update"

This will ensure that you’re properly using Garuda’s update script which has many handy and garuda-specific update processes that should be followed. Otherwise, it will just use paru which is tantamount to pacman -Syu which circumvents the garuda-specific aspects of the update process.

1 Like
13

Actually there is a version with garuda-Update in it. I only really found out when in reborn I got the message Garuda upto date.

2 Likes
14

Just to confirm: the command is garuda-update of course but in the topgrade.toml file is it supposed to read with an underscore ("garuda_update") rather than a hyphen ("garuda-update")? Or is that a typo?

EDIT: Ahh, nevermind, the line above gives allowed values with it listed with the underscore. Silly me. :face_with_hand_over_mouth: So for anyone reading, it’s an underscore.

2 Likes
15

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.