I’ve got a couple of new laptops here from Lenovo — a spiffy X1 Extreme (i7-8850H, 32 GB RAM, 1TB + 0.5TB NVMe SSDs, and more) and a very nice X380 Yoga (i7-8650U, 1TB NVMe SSD, 16 GB RAM). Lenovo recently pushed out a firmware update for the MZVLV1THALR NVMe drives through its Lenovo Vantage UWP app, and through its System Update application. I found myself in the interesting situation of being able to install the firmware update on the X380, but not on the X1 Extreme. The process would launch normally, but after the mandatory reboot, it would flash a purple “Access Denied” screen. I tried several attempts, each with the same unsatisfying result. Sigh.
Put Your Thinking Cap On, ET!
Over time, I began to chew over what had happened, to try to figure out how to deal with it. As I pondered what could cause an accessed denied message during initial boot-up, the light bulb went off. “Aha!” I thought to myself “I bet if I check in the BIOS, Secure Boot will be enabled.” I checked, and it was indeed enabled. So I disabled it, rebooted and tried the firmware update again. To my surprise, I learned that one can only update one NVMe drive per boot cycle, so I had to select one (and only one) drive from the pair of NVMe devices on the X1 Extreme to proceed. That’s what I did next, and after a suprisingly long (more than a minute) black screen interlude between the first Lenovo logo BIOS screen and a second appearance of the same (with the spinning balls telling me that Windows 10 was booting), I was presented with the Win10 lock screen and allowed to log in. Here’s what I saw on the desktop, to my great delight and relief:
When the machine rebooted and got to the desktop, I found a clear indication of firmware update success!
Because It Worked, Do It Again!
That took care of the first drive in the NVMe list. I ran the System Update utility again, and it cheerfully downloaded the same 86.7 MB fileset it had downloaded for previous attempts. This time only the second device was accessible through the pick list (the other device was showing in greyed-out text, and couldn’t be clicked). So I picked it for update, repeated the same process as before, and achieved the same result. And indeed, the same success box was once again waiting for me on the desktop after that final reboot.
Now, I need to reboot once again and get into the BIOS. That way, I can re-renable Secure Boot (until the next time something needs access to the disk drive during initial boot-up: turns out there’s a special exemption in Secure Boot on these Lenovos to allow user-initiated BIOS updates).
Author: Ed Tittel
Ed Tittel is a 30-plus-year computer industry veteran. He’s a Princeton and multiple University of Texas graduate who’s worked in IT since 1981 when he started his first programming job. Over the past three decades he’s also worked as a manager, technical evangelist, consultant, trainer, and an expert witness. See his professional bio for all the details.