RE: intel_ish_ipc: LOADER_CMD_START rejected (status 10) for every available firmware image on Lenovo ThinkBook 14 2-in-1 G6 IPL (Panther Lake), Zorin OS

Hi Florian,

There are two kinds of ISH main firmware images:
- Intel-signed images, such as `intel/ish/ish_ptl.bin`.
  These are released by Intel and carry an Intel signature.
- Vendor-signed images, such as `LENOVO/ish/ish_ptl_lenovo_X1_2026_5.8.1.7782.bin` and `dell/ish/ish_ptl_39ceeaf8_581.7783.0.bin`.
  These are customized by the vendor based on Intel's release, then signed and released by the vendor.

On Windows, the same two categories exist.
- The Intel-signed image is shipped inside IshHeci.
- The vendor-signed image is shipped inside IshHeciExtension(not sure).

> Q1. What does loader status 10 mean exactly?
It means the firmware image is incorrect. In most cases this is a signature verification failure.

> Q2. Does the ISH bootloader version matter?
No. There is currently only one loader protocol version, so the bootloader version is not relevant here. What matters is the signing key the bootloader expects.

> Q3. Does the Windows IshHeci driver transform, wrap or re-sign the image before loading?
No. The firmware image and the way it is loaded are the same between Windows and Linux.

> Q4. Is the fragment ACK purely transport-level, or does it validate content?
It is purely transport-level.

> Q5. What is the path to get one for the ThinkBook line (product_family CRC32 324d1fb6)?
If the vendor has not developed a customized ISH firmware for a specific model, they will typically use the Intel-signed image instead.
You will need to confirm with vendor which image they use for this machine.

Thanks,
Lixu


From: Florian Gnan <[email protected]> 
Sent: Sunday, August 2, 2026 8:16 PM
To: [email protected]
Cc: [email protected]; Zhang, Lixu <[email protected]>; [email protected]
Subject: intel_ish_ipc: LOADER_CMD_START rejected (status 10) for every available firmware image on Lenovo ThinkBook 14 2-in-1 G6 IPL (Panther Lake), Zorin OS

  Hi,

  the Intel ISH does not start on a Lenovo ThinkBook 14 2-in-1 G6 IPL
  (Panther Lake). LOADER_CMD_START is rejected with status 10 for every
  firmware image I can obtain - four images from three independent sources,
  including the OEM image from Lenovo's own Windows driver package for this
  exact machine. As a result there are no IIO devices, no ISHTP bus
  devices, and the convertible's tablet-mode switch (lenovo_ymc) never
  reports anything.

  Windows 11 Pro was installed on this exact machine immediately before
  Linux, and there the ISH worked completely - tablet mode switching and
  display auto-rotation both functional. So the hardware is fine, the ISH
  is not disabled by the platform, and the same bootloader (5.8.1.7768)
  does accept a firmware load under Windows.

  This looks related to the earlier report "intel_ish_ipc: loader failure
  on Lunar Lake" [1], where Lixu Zhang explained that status 10 means the
  firmware file is detected as incorrect, and vendors were asked to
  upstream their firmware. Here the vendor firmware is available and is
  still rejected, and so is everything else - which suggests the problem is
  not "the wrong image" but that this ISH accepts no host-loaded image at
  all under the current loader.

  System
  ------
  Model             : Lenovo ThinkBook 14 2-in-1 G6 IPL (MT 22AR)
  DMI sys_vendor    : LENOVO                      (CRC32 53c4ffad)
  DMI product_family: ThinkBook 14 2-in-1 G6 IPL  (CRC32 324d1fb6)
  DMI product_name  : 22AR                        (CRC32 308e9054)
  BIOS              : U1CN07WW, 02/26/2026 (latest; nothing newer on LVFS)
  EC firmware       : 1.7
  ISH PCI device    : 8086:e445 rev 01, subsystem 17aa:3843, driver intel_ish_ipc
  OS                : Zorin OS 18.1 (Ubuntu 24.04 base)
  Kernel            : 7.0.0-28-generic (Ubuntu HWE 7.0)
  linux-firmware    : 20240318.git3b128b60-0ubuntu2.27

  Log (booted with intel_ishtp.dyndbg=+p)
  ---------------------------------------
  intel_ish_ipc 0000:00:12.0: Going to wait for ishtp start. hbm_state=00000000
  intel_ish_ipc 0000:00:12.0: ISH loader: Try to load firmware: intel/ish/ish_ptl_53c4ffad_324d1fb6_308e9054_dd59d3b3.bin
  intel_ish_ipc 0000:00:12.0: Woke up from waiting for ishtp start. hbm_state=00000003
  intel_ish_ipc 0000:00:12.0: ISH loader: Try to load firmware: intel/ish/ish_ptl_53c4ffad_324d1fb6_dd59d3b3.bin
  intel_ish_ipc 0000:00:12.0: ISH loader: Try to load firmware: intel/ish/ish_ptl_53c4ffad_324d1fb6_308e9054.bin
  intel_ish_ipc 0000:00:12.0: ISH loader: Try to load firmware: intel/ish/ish_ptl_53c4ffad_324d1fb6.bin
  intel_ish_ipc 0000:00:12.0: ISH loader: load firmware: intel/ish/ish_ptl_53c4ffad_324d1fb6.bin
  intel_ish_ipc 0000:00:12.0: ISH loader: ISH Bootloader Version 5.8.1.7768
  intel_ish_ipc 0000:00:12.0: ISH loader: cmd 2 failed 10
  (bootloader version + failure repeat three times, once per retry)

  LOADER_CMD_XFER_QUERY and LOADER_CMD_XFER_FRAGMENT both succeed; only
  LOADER_CMD_START is rejected. "firmware loaded" and the FW base/project
  version lines are therefore never reached.

  Firmware images tried (all: cmd 2 failed 10)
  --------------------------------------------
  1. intel/ish/ish_ptl.bin from linux-firmware
     5.8.1.7778, 920064 bytes, manifest vendor 8086

  2. OEM image for this exact machine, 5.8.1.7779, 920064 bytes,
     md5 98b8ade6fe26d777f639a5db96eae6d7, manifest vendor 8086.
     Extracted from Lenovo's "Intel ISH Software" driver package for the
     ThinkBook 14 2-in-1 G6 IPL (package version 5.8.56.0), file
     IshHeci/x64/FWImage/0004/ishS_SI_5.8.1.7779.bin. Valid $CPD/ISHM
     header; contains the sensor descriptors "Tablet Mode", "Hinge Angle",
     "Simple Orientation", "Physical Accelerometer", "Physical Gyrometer"
     and the chip names BMA422, BMI260, BMI263, BMI323, KX9xx.

  3. LENOVO/ish/ish_ptl_lenovo_X1_2026_5.8.1.7782.bin from current
     linux-firmware, 858624 bytes - same vendor, newer, and from a
     convertible (ThinkPad X1 2-in-1 Gen 11).

  4. dell/ish/ish_ptl_39ceeaf8_581.7783.0.bin from current linux-firmware,
     776704 bytes, 5.8.1.7783 - the newest PTL image available anywhere.

  Manifest comparison of the four images: all carry SVN 1 and VCN 21, so an
  anti-rollback / security-version floor would have to reject all of them
  equally - including the one that demonstrably works under Windows.

  Ruled out
  ---------
  - Firmware naming. The cascade behaves exactly as documented; installing
    an image under the vendor+product_family name makes the loader pick
    that one and stop. Both the generic and the specific name were tried.
  - initramfs. The image is present in the initramfs and the log confirms
    the intended file is the one actually loaded.
  - Image origin or signing. Four images, three sources; three carry an
    Intel (8086) manifest vendor, so OEM-specific signing keys are not the
    discriminator.
  - DMA address translation. ishtp_loader_work() hardcodes
    LOADER_XFER_MODE_DMA, and the ISH device sits in an IOMMU group, so I
    suspected the ISH was reading untranslated addresses and assembling a
    corrupt image. Booting with intel_iommu=off changes nothing.
  - BIOS. No ISH or sensor-hub related setting exists; all 31 attributes
    exposed through think_lmi were checked. Secure Boot is disabled. The
    BIOS is the latest available.
  - Kernel age. The most recent loader change (043251b2d, "Add
    PRODUCT_FAMILY-based firmware matching", 2025-12-22) is present in this
    kernel - the family-CRC names in the log above prove it.
  - Stale state. Every test was done from a cold boot; reloading
    intel_ish_ipc leaves the ISH unresponsive ("cmd 0 failed 6"), so warm
    retries were never used for any of the results above.

  Questions
  ---------
  1. What does loader status 10 mean exactly? The values are produced by
     the ISH bootloader and are not documented in loader.h. Is there a list?
  2. Does the ISH bootloader version matter? Here it is 5.8.1.7768, older
     than every image available (7778...7783), on a BIOS from 02/2026.
     Is a bootloader/image version pairing expected, and if so, where would
     a matching image come from?
  3. Since the ISH demonstrably works under Windows on this machine: does
     the Windows IshHeci driver transform, wrap or re-sign the image before
     loading, or perform any step in the load sequence that the kernel
     loader does not?
  4. LOADER_CMD_XFER_FRAGMENT is acknowledged even though START then
     rejects the image. Is the fragment ACK purely transport-level, or does
     it validate content? In other words, can I distinguish "the image
     arrived corrupt" from "the image arrived intact but was refused"?
  5. If per-model OEM firmware is required after all: linux-firmware has
     LENOVO/ish entries only for ThinkPad X1/X9. What is the path to get
     one for the ThinkBook line (product_family CRC32 324d1fb6)?

  Happy to run any diagnostic patch, enable additional tracing, or dump
  further data.

  Thanks,
  Florian Gnan