![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
mjg59Update: Patches to fix this have been posted
There's a story going round that Lenovo have signed an agreement with Microsoft that prevents installing free operating systems. This is sensationalist, untrue and distracts from a genuine problem.
The background is straightforward. Intel platforms allow the storage to be configured in two different ways - "standard" (normal AHCI on SATA systems, normal NVMe on NVMe systems) or "RAID". "RAID" mode is typically just changing the PCI IDs so that the normal drivers won't bind, ensuring that drivers that support the software RAID mode are used. Intel have not submitted any patches to Linux to support the "RAID" mode.
In this specific case, Lenovo's firmware defaults to "RAID" mode and doesn't allow you to change that. Since Linux has no support for the hardware when configured this way, you can't install Linux (distribution installers will boot, but won't find any storage device to install the OS to).
Why would Lenovo do this? I don't know for sure, but it's potentially related to something I've written about before - recent Intel hardware needs special setup for good power management. The storage driver that Microsoft ship doesn't do that setup. The Intel-provided driver does. "RAID" mode prevents the Microsoft driver from binding and forces the user to use the Intel driver, which means they get the correct power management configuration, battery life is better and the machine doesn't melt.
(Why not offer the option to disable it? A user who does would end up with a machine that doesn't boot, and if they managed to figure that out they'd have worse power management. That increases support costs. For a consumer device, why would you want to? The number of people buying these laptops to run anything other than Windows is miniscule)
Things are somewhat obfuscated due to a statement from a Lenovo rep:
The real problem here is that Intel do very little to ensure that free operating systems work well on their consumer hardware - we still have no information from Intel on how to configure systems to ensure good power management, we have no support for storage devices in "RAID" mode and we have no indication that this is going to get better in future. If Intel had provided that support, this issue would never have occurred. Rather than be angry at Lenovo, let's put pressure on Intel to provide support for their hardware.
There's a story going round that Lenovo have signed an agreement with Microsoft that prevents installing free operating systems. This is sensationalist, untrue and distracts from a genuine problem.
The background is straightforward. Intel platforms allow the storage to be configured in two different ways - "standard" (normal AHCI on SATA systems, normal NVMe on NVMe systems) or "RAID". "RAID" mode is typically just changing the PCI IDs so that the normal drivers won't bind, ensuring that drivers that support the software RAID mode are used. Intel have not submitted any patches to Linux to support the "RAID" mode.
In this specific case, Lenovo's firmware defaults to "RAID" mode and doesn't allow you to change that. Since Linux has no support for the hardware when configured this way, you can't install Linux (distribution installers will boot, but won't find any storage device to install the OS to).
Why would Lenovo do this? I don't know for sure, but it's potentially related to something I've written about before - recent Intel hardware needs special setup for good power management. The storage driver that Microsoft ship doesn't do that setup. The Intel-provided driver does. "RAID" mode prevents the Microsoft driver from binding and forces the user to use the Intel driver, which means they get the correct power management configuration, battery life is better and the machine doesn't melt.
(Why not offer the option to disable it? A user who does would end up with a machine that doesn't boot, and if they managed to figure that out they'd have worse power management. That increases support costs. For a consumer device, why would you want to? The number of people buying these laptops to run anything other than Windows is miniscule)
Things are somewhat obfuscated due to a statement from a Lenovo rep:
This system has a Signature Edition of Windows 10 Home installed. It is locked per our agreement with Microsoft.It's unclear what this is meant to mean. Microsoft could be insisting that Signature Edition systems ship in "RAID" mode in order to ensure that users get a good power management experience. Or it could be a misunderstanding regarding UEFI Secure Boot - Microsoft do require that Secure Boot be enabled on all Windows 10 systems, but (a) the user must be able to manage the key database and (b) there are several free operating systems that support UEFI Secure Boot and have appropriate signatures. Neither interpretation indicates that there's a deliberate attempt to prevent users from installing their choice of operating system.
The real problem here is that Intel do very little to ensure that free operating systems work well on their consumer hardware - we still have no information from Intel on how to configure systems to ensure good power management, we have no support for storage devices in "RAID" mode and we have no indication that this is going to get better in future. If Intel had provided that support, this issue would never have occurred. Rather than be angry at Lenovo, let's put pressure on Intel to provide support for their hardware.
no subject
Date: 2016-09-21 07:46 pm (UTC)DIY support
Date: 2016-09-21 10:56 pm (UTC)Currently, one user had successfully installed Linux on their device by manually flashing their BIOS by soldering a chip programmer onto the actual chip.
They flashed a version they manually modified the BIOS by reverse engineering and hacking the code to get around Lenovo's goto stmt, restoring uesr access to the Advanced settings page.
So, is this your idea of supporting it ourselves?
Re: DIY support
Date: 2016-09-21 11:42 pm (UTC)Cryptographically signed firmwares are an Intel requirement and have been since Sandy/Ivy Bridge. Go look at Dell or HP and you'll find the exact same requirements for UEFI updates.
> Currently, one user had successfully installed Linux on their device by manually flashing their BIOS by soldering a chip programmer onto the actual chip.
Yes, this is the only way to bypass the firmware update signature check. Because by flashing the actual SPI EEPROM the check is not executed.
> So, is this your idea of supporting it ourselves?
Where on earth did the author ever imply or state that?
Flashing a modified firmware via SPI is the only known method for newer Intel platforms due to the signature checks performed during a normal firmware update.
Sometimes vendors are careless/lazy and people find other ways to flash modified firmwares. In cases where vendors don't screw up the reference firmware enough to nullify the security checks, you need to flash it manually.
Go read about this yourself (free eBook on Intel platform security): www.apress.com/9781430265719
Re: DIY support
Date: 2016-09-22 03:31 am (UTC)I wasn't faulting (or singling out) Lenovo for using a cryptographically-signed firmware at all, nor am I suggesting they break this mold as a potential resolution (and believe it or not, I'm well aware that this practice of crypto-signing firmware is pretty ubiquitous, regardless of how "required" or not it actually is).
However, I am faulting Lenovo for locking us out of AHCI mode in their BIOS.
I'm also using the cryptography as strong evidence that users cannot be reasonably expected to "support themselves" in this scenario -- them large semiprimes man, you guys should just factor them yourselves!
> Flashing a modified firmware via SPI is the only known method for newer Intel platforms due to the signature checks performed during a normal firmware update.
So you somehow think it's perfectly reasonable to expect users that want to set their RAID controllers to AHCI mode in order to install the operating system of their choice on the hardware that they paid for to have to flash a modified firmware via SPI?!
Some of the most highly skilled software engineers that I know don't even know how to solder...
You also mentioned that "flashing a modified firmware via SPI is the only known method for newer Intel platforms due to the signature checks performed during a normal firmware updates." That may be true, but it's not true for the affected Lenovo consumer ultrabooks in question -- Lenovo has already released BIOS updates that can be flashed by end users completely in software.
> Sometimes vendors are careless/lazy and people find other ways to flash modified firmwares.
So now it comes down to the "hail mary" of hoping there is some security hole or backdoor instead and that somebody puts in the time and effort to find it, so that we don't have to resort to chip programming? Ridiculous.
> "Go read about this yourself (free eBook on Intel platform security): www.apress.com/9781430265719"
I appreciate the reference, but it seems a little unrelated to the argument at hand, no? Just curious, did you read all 272 pages yourself?
Re: DIY support
Date: 2016-09-22 06:32 am (UTC)no subject
Date: 2016-09-22 03:54 am (UTC)In a way, having to listen to "It's our fault for not supporting RAID mode on a system that shouldn't be in RAID mode." or some version of it every time a PC OEM does something bonehead stupid or evil is like listening to a battered woman explain to the police why it's not her abusive boyfriend's fault that he got drunk and bashed her head into the wall.
no subject
Date: 2016-09-22 05:20 am (UTC)Second of all the compatible hardware is supported and included with the laptop.
It's just stupid for lenovo to configure it weirdly, disable the bios and efi setting that would fix it. Potential motivation for this is to prevent users from installing microsoft windows, which would remove whatever malware/crapware they are including to track users and sell the resulting information. Not like malware hasn't been found in lenovo laptops more than once in the past.
no subject
Date: 2016-09-22 07:58 am (UTC)no subject
Date: 2016-11-12 09:19 am (UTC)Stop getting hung up on 'RAID mode'
Date: 2016-09-22 02:52 pm (UTC)