[personal profile] mjg59
Update: Patches to fix this have been posted

There's a story going round that Lenovo have signed an agreement with Microsoft that prevents installing free operating systems. This is sensationalist, untrue and distracts from a genuine problem.

The background is straightforward. Intel platforms allow the storage to be configured in two different ways - "standard" (normal AHCI on SATA systems, normal NVMe on NVMe systems) or "RAID". "RAID" mode is typically just changing the PCI IDs so that the normal drivers won't bind, ensuring that drivers that support the software RAID mode are used. Intel have not submitted any patches to Linux to support the "RAID" mode.

In this specific case, Lenovo's firmware defaults to "RAID" mode and doesn't allow you to change that. Since Linux has no support for the hardware when configured this way, you can't install Linux (distribution installers will boot, but won't find any storage device to install the OS to).

Why would Lenovo do this? I don't know for sure, but it's potentially related to something I've written about before - recent Intel hardware needs special setup for good power management. The storage driver that Microsoft ship doesn't do that setup. The Intel-provided driver does. "RAID" mode prevents the Microsoft driver from binding and forces the user to use the Intel driver, which means they get the correct power management configuration, battery life is better and the machine doesn't melt.

(Why not offer the option to disable it? A user who does would end up with a machine that doesn't boot, and if they managed to figure that out they'd have worse power management. That increases support costs. For a consumer device, why would you want to? The number of people buying these laptops to run anything other than Windows is miniscule)

Things are somewhat obfuscated due to a statement from a Lenovo rep:This system has a Signature Edition of Windows 10 Home installed. It is locked per our agreement with Microsoft. It's unclear what this is meant to mean. Microsoft could be insisting that Signature Edition systems ship in "RAID" mode in order to ensure that users get a good power management experience. Or it could be a misunderstanding regarding UEFI Secure Boot - Microsoft do require that Secure Boot be enabled on all Windows 10 systems, but (a) the user must be able to manage the key database and (b) there are several free operating systems that support UEFI Secure Boot and have appropriate signatures. Neither interpretation indicates that there's a deliberate attempt to prevent users from installing their choice of operating system.

The real problem here is that Intel do very little to ensure that free operating systems work well on their consumer hardware - we still have no information from Intel on how to configure systems to ensure good power management, we have no support for storage devices in "RAID" mode and we have no indication that this is going to get better in future. If Intel had provided that support, this issue would never have occurred. Rather than be angry at Lenovo, let's put pressure on Intel to provide support for their hardware.

Re: DIY support

Date: 2016-09-22 03:31 am (UTC)
From: (Anonymous)
> Cryptographically signed firmwares are an Intel requirement and have been since Sandy/Ivy Bridge. Go look at Dell or HP and you'll find the exact same requirements for UEFI updates.

I wasn't faulting (or singling out) Lenovo for using a cryptographically-signed firmware at all, nor am I suggesting they break this mold as a potential resolution (and believe it or not, I'm well aware that this practice of crypto-signing firmware is pretty ubiquitous, regardless of how "required" or not it actually is).

However, I am faulting Lenovo for locking us out of AHCI mode in their BIOS.

I'm also using the cryptography as strong evidence that users cannot be reasonably expected to "support themselves" in this scenario -- them large semiprimes man, you guys should just factor them yourselves!

> Flashing a modified firmware via SPI is the only known method for newer Intel platforms due to the signature checks performed during a normal firmware update.

So you somehow think it's perfectly reasonable to expect users that want to set their RAID controllers to AHCI mode in order to install the operating system of their choice on the hardware that they paid for to have to flash a modified firmware via SPI?!

Some of the most highly skilled software engineers that I know don't even know how to solder...

You also mentioned that "flashing a modified firmware via SPI is the only known method for newer Intel platforms due to the signature checks performed during a normal firmware updates." That may be true, but it's not true for the affected Lenovo consumer ultrabooks in question -- Lenovo has already released BIOS updates that can be flashed by end users completely in software.

> Sometimes vendors are careless/lazy and people find other ways to flash modified firmwares.

So now it comes down to the "hail mary" of hoping there is some security hole or backdoor instead and that somebody puts in the time and effort to find it, so that we don't have to resort to chip programming? Ridiculous.

> "Go read about this yourself (free eBook on Intel platform security): www.apress.com/9781430265719"

I appreciate the reference, but it seems a little unrelated to the argument at hand, no? Just curious, did you read all 272 pages yourself?

Re: DIY support

Date: 2016-09-22 06:32 am (UTC)
From: (Anonymous)
Note that on many Lenovo Ultrabooks you cannot flash the SPI yourself as the flash signature verification is burned into the CPU.


Matthew Garrett

About Matthew

Power management, mobile and firmware developer on Linux. Security developer at Google. Ex-biologist. @mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer.

Page Summary

Expand Cut Tags

No cut tags