Slashdot Mirror
Lenovo UEFI Bug Only Likes Windows and RHEL
New submitter Nagilum23 writes "It looks like Lenovo only knows of Windows and RHEL where their Thinkcentre M92p desktop is concerned. While investigating UEFI boot issues, Matthew Garrett found the PC's firmware actually checks the descriptive string for the operating system, and will prevent unlisted operating systems from booting. Garrett writes, 'Every UEFI boot entry has a descriptive string. This is used by the firmware when it's presenting a menu to users - instead of "Hard drive 0" and "USB drive 3", the firmware can list "Windows Boot Manager" and "Fedora Linux". There's no reason at all for the firmware to be parsing these strings. ... there is a function that compares the descriptive string against "Windows Boot Manager" and appears to return an error if it doesn't match. What's stranger is that it also checks for "Red Hat Enterprise Linux" and lets that one work as well. ... This is, obviously, bizarre. A vendor appears to have actually written additional code to check whether an OS claims to be Windows before it'll let it boot. Someone then presumably tested booting RHEL on it and discovered that it didn't work. Rather than take out that check, they then addded another check to let RHEL boot as well."
Note that this isn't a SecureBoot issue. Lenovo is aware of the problem and looking into it.
... my guess would be VERY. No problem here for haxors. For the rest of us, just don't buy this crap.
You keep using that word. I don't think it means what you think it means.
It's not a bug if it's by design, and this is clearly intended behavior.
Never ascribe to malice what can be explained by Microsoft getting desperate.
I don't see how you can consider this a "bug"? You don't just "accidentally test a string for a specific value". This is clearly intentional operation, not a bug.
I work for the Department of Redundancy Department.
That's a great idea. Someone who wrote a virus to boot before the OS would never think to tell UEFI that it was the Windows Boot Manager. /s
The truth is that all men having power ought to be mistrusted. James Madison
I used to like IBM and Lenovo computers. But his offends me.
if it must frob for strings, let's all just agree to put "grub" in there.
Then all Linux distributions, plus EFF, should sue Lenovo, if for no other reason then just to show how much everyone cares. I would contribute to that if necessary.
Contrary to the popular belief, there indeed is no God.
UEFI is pretty much a case of fixing what isn't broken, yet with any software project its bound to have bugs in the first few iterations.
And, oh boy does it. name brand motherboards that brick when flashed, systems that don't power off correctly, systems that take minutes to post, the usual issues with incorrect ACPI table entries, the list goes on.
Basically, its replacing one fairly stable code base, that the motherboard vendors often got wrong, with a completely new untested one that is 10x as complicated. You do the math.
Linus had another rant about it recently called "The abomination called EFI".
BTW: Gigabyte has a number of traditional motherboards that can boot GPT partitions, effectively removing the _ONE_ useful new feature in EFI.
Because I'm lazy, I'll just copy and paste a comment I made in another thread about TPM
Ever since TPM was created, we're always just a few bits and bytes away from having it leveraged against us, by them.
And by "us" I mean "the computer users."
By "them" I mean "the hardware manufacturers and software/media companies."
Example: The newest motherboards don't *need* the ability to disable trusted boot. Heck, it'd have been easier to not include it!
We're more or less at the mercy of a small number of companies and their design decisions.
I recently found out, while looking at new laptops, that Lenovo & HP like to put whitelists of wireless cards into the BIOS.
Someone hacked the BIOS and other cards will work, but for whatever reason, Lenovo/HP doesn't want you to use a storebought card.
[Fuck Beta]
o0t!
How many of them will notice when it refuses the "Windows 9" boot string, or someone in their home country notices that it refuses a string with Chinese characters in it.
As despicable as this is, on the other hand, it sort of implies that RHEL is certified to work with this machine.
let MS kill the PC.
there will always be other new hardware.
After PCs die, what hardware will remain that is 1. sold in U.S. stores with showrooms, and 2. not enforcing a walled garden against a machine owner's will like an iPad or game console?
As a user of ThinkPads for nearly as long I have a TP I cannot install a miniPCI wireless upgrade into without hacking my system because it is not an approved part for my specific ThinkPad. Even a miniPCI from another ThinkPad won't always work.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
They don't advertise miniPCI slots as available on the system.
That doesn't make deliberately crippling the slots in order to sell more proprietary hardware any better. I don't care if they advertise it or not. It is a mini-PCI slot and they are deliberately breaking it. They're assholes.
Give me Classic Slashdot or give me death!
There is a reason for this:
The mini-PCI card is just the radio. The antenna is in the rest of the laptop (usually around the screen). The FCC only certifies them for certain radio+antenna pairings, and so they cannot get certification if they don't put in some mechanism to stop you from using uncertified pairings.
It's stupid yes, but the idea behind the policy is to allow the sale of high-power radios while keeping it within exposure limits. (the reason being is the same power going into an omnidirectional antenna safely can not only exceed but blow-out-of-the-water the exposure limits if put into a directional antenna. think bulb vs laser)
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
As seen here,
http://www.csis.pace.edu/~bergin/patterns/ppoop.html
This whole issue could have been avoided if the developers didn't use the "Hacker Solution", but instead... well, read the paper.
My point was there is some enforced limitation as a means of butt-covering, rather than just being jerks. Lenovo (or Dell or whoever) doesn't want to risk being dragged into anything (since the antenna is theirs) so they just lock you out.
You're right about the directionality, but there's another bit to consider: how much energy can that antenna support? If it can only support 200mw and you try pushing 1w into it, it could very well pose a fire hazard.
Still, really they should just bugger off and leave it to the user to be responsible. They are doing more than they need to by locking you out.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
I am simply not buying what you're selling, ham or not. We're talking 800mW, not 800 Watts here (and at that, 800mW cards are rare. 100 and 50 mW is common). That is 0.8 Watts MAX. I have no doubt that bad things can happen to ham gear at hundreds or thousands of watts if you use the wrong antenna, but this is low powered ISM stuff here. Nothing bad happens if the antenna is disconnected entirely. Nothing bad happens if you connect/dis-connect the antenna while the transmitter is on. Nothing bad happens if you connect a random bit of wire you found in your desk as an antenna. Nothing bad happens if you lick the antenna terminal. Other vendors don't seem to have any of these worries. The power supply connector is far more dangerous.
There comes a point where CYA is indistinguishable from malice. So yes, they really are just being butt-heads.
Note that by bad, I mean other than you may not have connectivity.
Sure, all of the studying I needed to do to get my own license. That's how these sorts of things work. I may be wrong, but I think you need to provide proof of that to me, not the other way around.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
If they tried this by locking Secure Boot, they'd get an angry letter from Microsoft. It's a requirement for Windows 8 certification that the end user can add their own keys to Secure Boot.