UEFI Firmware Code Bricks Linux. Another Reason 'Security Threatre' Placebo of Microsoft and Intel Must be Avoided.
Reprinted with permission from Ryan Farmer.
Bad Lenovo UEFI Firmware Causes Nine Models to Freeze on Resume from Suspend. Delays Linux 6.6.
I don’t even want to write about Lenovo again in my life, since they are such a nasty company, but Roy asked me to say something.
Ever since 2016 when they admitted to me that there was a deal with Microsoft to lock Linux out of the Yoga 900 ISK2, but then proceeded to defame me after the media reported on a Reddit post I made on the subject that went viral, and then quietly fixed it after I took legal action against them, I’ve been telling people what a super shitty company they are.
Lenovo is a Chinese company, so it probably shouldn’t come as any shock that they banned everyone in the State that I live in from commenting on their forum until the scandal died down.
In China, when someone is talking, you typically figure out abhorrent ways to stop them from talking, which don’t work in a Free country. For Lenovo, really all they could do was try to silence people on their own support forum, but by then it was too late.
They also indiscriminately banned anyone who talked about “hacking” the board with an external flasher to unhide the “ACPI” option (to allow other operating systems to see the storage device), which was always present, but hidden as per their illegal contract with Microsoft, which they quickly got scrapped after the State of Illinois started investigating them.
The late 2020 Tiger Lake-based ThinkBook 15 I have is a little better.
Lenovo’s advice was to disable “Secure Boot”, as all it has ever done for Linux is cause problems due to extra complexity and bugs, as it is a Microsoft requirement to license Windows to OEMs, which is the default state of the laptop. “Secure Boot” actually does nothing to secure the computer from most any actual security threat that anyone really faces.
In at least one case, on my Yoga 900 ISK2, Ubuntu updated the “Secure Boot” dbx due to “Boothole”, and the revocation update (dbx) caused Fedora to fail to boot with a “Security policy violation.”
To unjam it I had to reset “Secure Boot” to the factory settings and that apparently wiped the dbx update. At that point I turned “Secure Boot” off and have never turned it on after removing Windows from a PC since then.
Lenovo’s other advice for this laptop, even though the “fake RAID” support was added to Linux after the 2016 incident by Intel (after they refused to document it for over a year!), is to turn that off and set the disk controller to “AHCI”.
Matthew Garrett claimed that this had something to do with power management, but he was either wrong or lying, because when I run powertop as a system service (to set all power management tunables to on), I always get better battery life than Windows does.
He’s very obtuse, and it’s probably because his job at various points in time involved implementing Microsoft nonsense like “Secure Boot” in Linux.
They need to get rid of the “Free Software Award” because they have such a bad habit of giving it to the wrong people.
(It’s like watching Donald Trump putting the Presidential Medal of Freedom on people at this point.)
Other than a bunch of “FIRMWARE BUG” crap on my 2020 Lenovo laptop that prints to the screen (which Windows and IBM Fedora hides, but Debian doesn’t), the laptop works fine with Linux.
But Lenovo released, apparently, more than nine models of AMD-based laptops with UEFI bugs that prevent the user from resuming from suspend due to fatal ACPI errors, which includes the AMD option for the laptop model I’m writing this on.
Although, mine’s an Intel, so in your face to all those “AMD is better” people. π
The Linux kernel’s 6.6 release was delayed while workarounds that added 78 more lines of firmware bug workarounds was added.
Linus Torvalds was obviously furious, but criminals and idiots put him in therapy for yelling at them with incompetent code in the past, and he put Linux under the control of a now Microsoft-controlled “Linux Foundation” and so to keep his job, he can’t say much anymore.
According to Roy Schestowitz, the culprit was something that a Chinese man exhaling some sort of smoke (to look macho I guess?) on his Microsoft GitHub page did in the ACPI code in the Linux kernel.
Apparently, his name is Huacai Chen and he works at Loongson.
Linus Torvalds very obviously wanted to scream at him (backscroll and read down) for moving ACPI code around to fix something and then breaking other things, then hiding that they were broken until users started writing in saying they upgraded their kernel, some stuff happened, and kersplat.
I don’t even plan to stay on the PC after this laptop unless I decide to buy a model with open source firmware from System76 instead of this Lenovo garbage which is barely even code.
UEFI is garbage, Microsoft is garbage, Lenovo is fucking garbaaaage. The entire PC situation is cat shit wrapped in dog shit. And the people working on things like “Secure Boot in Linux” just make it so much worse from there.
This is the worst time to own a x86 PC, EVER.
Lenovo has never supported updating your UEFI firmware on most of their products using anything available to Linux users, even LVFS, which is a backdoor, and I wouldn’t trust them not to brick my computer or make it worse if they did.
I uninstalled LVFS because it started spitting an error message into Debian. It’s in charge of updating the dbx, but fuck dbx, fuck “Secure Boot” (which makes it harder to plug actual security holes), fuck Microsoft, and fuck the people Microsoft gets to make this my problem.
As a user, I just think these things are deplorable, but large corporations have turned Linux into some shitty colony where they can put DRM malware, universal backdoors, and absolutely broken shit with no repercussions. None. Not even that Linus Torvalds might yell at them.
So the last time the UEFI in my ThinkBook 15 was updated was August 2021, when I switched it over to Linux.
By that point, they had fixed most of the really nasty bugs they shipped the laptop with, which were even causing problems in Windows, but as firmware upgrades are dangerous and I have no warranty now, and they require Windows, I don’t plan to touch the firmware on this laptop ever again.
It’s just not worth it. One of the bigger problems with UEFI is that it’s just such a monster that you can keep fixing bugs forever, and that’s why “Secure Boot” will never work even if they wanted it to.
If you could get past the issues like “This is barely even code. It’s just a pile of garbage.”, the x86 PC might be worth plodding along with.
Now that they make the Raspberry Pi 5, and it’s several times faster than its predecessor, I wonder why we’re even talking about sticking around for more abuse.
When the UEFI firmware Lenovo ships is so fragile that a guy working for a hardware company making totally unrelated MIPS processors in China bumps something and an x86 Lenovo laptop that people bought THREE GODDAMN YEARS AGO starts malfunctioning if anyone installs that kernel, it’s time to look for greener fields.
UEFI is such a catastrophe, that it’s not even just a Freedom issue.
It’s such a massive fucking colossal failure on a code level that Google, which certainly doesn’t care about your Freedom, based the Chromebook firmware on a variation of Coreboot.
My next system will probably just be Linux running off some cheap flash memory on a ~$80 ARM computer. The fact that the Pi 5 finally has a SKU with 8 GB RAM really REALLY helps. With the help of ZStandard compressed ZRam, you can make KDE work with this.
No more of these $1,000 Lenovo PC laptops full of LULZ for firmware and Chinesium keyboards where buttons randomly break and need to be remapped to another key because they’re three years old, and playing “How do I brutally murder Windows 11 this time? Hmm…. DIE DIE DIE!!!!!” β