Lenovo BIOS issues

Canonical has replaced the 17.10 ISO download button with a notice stating 'The download of Ubuntu 17.10 is currently discouraged due to an issue on certain Lenovo laptops. Once fixed this download will be enabled again'.

It looks like Ubuntu kernels since 4.13.0-19.22 and mainline kernel builds since v4.14-rc2 are affected as they are compiled with 'CONFIG_SPI_INTEL_SPI_PCI=m' which enables the Intel SPI serial flash controller and which comes with the ominous warning 'Say N here unless you know what you are doing. Overwriting the SPI flash may render the system unbootable.'

It looks like development Ubuntu kernels since 4.11.0-0.5 and Canonical mainline kernel builds since v4.11-rc4 are affected as they are compiled with 'CONFIG_SPI_INTEL_SPI=m' and 'CONFIG_SPI_INTEL_SPI_PLATFORM=m' which enables the Intel PCH/PCU SPI flash platform driver and which comes with the ominous warning 'Say N here unless you know what you are doing. Overwriting the SPI flash may render the system unbootable.'

The bug report has been updated to state "Bug may effect machines from any manufacturer that uses BIOS based on Insyde Software".

Currently Canonical are respinning the affected Ubuntu kernels with a patch to disable this setting and will no doubt respin the 17.10 ISOs that include the 4.13.0.19.22 Ubuntu-4.13.0-16.19 kernel with likely the replacement (fixed) kernel of Ubuntu-4.13.0-21.24. They are also respinning the affected Ubuntu HWE kernels so that they work with 16.04 etc. At this stage it is unclear whether they will respin the mainline kernel builds and it is most probable they won't.

The latest Canonical mainline build of v4.15-rc5 has been compiled without the Intel SPI drivers and is safe to use.

As a result I am removing all ISOs with the affected kernels. Note that the ISOs are provided as examples of using my 'isorespin.sh' so if a particular ISO is still required it can be easily recreated by following the documentation on the page where it was made available.

So if you are a Lenovo user have a device with a BIOS from Insyde Software 
I recommend you check the bug report and if you are about to try or install Linux using 'isorespin.sh' I would recommend you only respin a new Ubuntu/Ubuntu flavoured 17.10 ISO once available from Canonical and that if you are upgrading the kernel regardless of distro you only use a newly respun Ubuntu kernel of 4.13.0-21.24 or greater as they become available which is downloaded and installed as a package from  Canonical sources or a Canonical mainline build starting from v4.15-rc5.

Whilst the issue has been reported as affecting Lenovo users there is a are now similar reports from a Dell user others using Acer, Toshiba and Dell devices. It may affect machines from any manufacturer that uses a BIOS from Insyde Software. If in doubt the best advice at this stage would be to avoid any kernel compiled with  'CONFIG_SPI_INTEL_SPI_PCI'  'CONFIG_SPI_INTEL_SPI' or  'CONFIG_SPI_INTEL_SPI_PLATFORM set.

The bug report has now been updated with:

Fix: The issue was fixed in Kernel Version 4.13.0-21. But previous affected machines still suffered from a broken BIOS.
Repair: Boot Linux and Install Kernel Version 4.14.9. Reboot into Linux and BIOS should be restored to a working state.

My analysis shows that any mainline kernel build after (and including) 4.14.3 should work as a repair kernel as they include the patch 'spi-nor: intel-spi: Fix broken software sequencing codes' (commit 9d63f17661e25fd28714dac94bdebc4ff5b75f09 upstream). Equally Ubuntu-4.14.0-11.13 and later should also repair the BIOS as they include the same patch.

The repair & fix process is not particularly obvious however I would:

1. Install both the 'fix' and 'repair' kernels whilst booted from the currently running kernel
2. Purge all kernels except the currently running kernel, 'fix' and 'repair' kernels
3. Reboot the device to the 'repair' kernel
4. Purge the previously run kernel (termed 'currently running kernel' above)
5. Reboot the device to the 'fix' kernel 
6. Purge the 'repair' kernel

This should just leave the 'fix' kernel as the new currently running kernel.

If the 'repair' kernel doesn't then Canonical have now created another kernel package which includes a new patch and can be installed from:

http://people.canonical.com/~ypwong/lp1734147/linux-image-4.15.0-041500rc6-generic_4.15.0-041500rc6.201712312330+20170103+1_amd64.deb

Whilst the v4.14.9 included the commit '9d63f17661e2' ('spi-nor: intel-spi:
Fix broken software sequencing codes') and recovered many systems it doesn't repair all, specifically where WREN was not in effect. Mika Westerberg has created this new patch 'spi-nor: intel-spi: Prefer WREN over other write enables' (commit 9c50107a6560bb4997a34007f23fbe754009a86d) which prefers WREN over other write enable preopcodes.

Most recent update: 

An update to linux kernel on Ubuntu 17.10 that enabled the Intel SPI drivers results in a serial flash that is read only in Intel Broadwell and Haswell machines with serial flashes with SPI_NOR_HAS_LOCK set.

Symptoms:

 * BIOS settings cannot be saved
 * USB Boot impossible
 * EFI entries read-only

Fix:

The issue was fixed in kernel version 4.13.0-21 by configuring the kernel so it is not compiled with Intel SPI support. But previous affected machines still suffered from a broken BIOS.

Repair:

 If you still can boot into Ubuntu, you can recover your BIOS with the following steps:

1. Boot into Ubuntu
2. Download http://people.canonical.com/~ypwong/lp1734147/linux-image-4.15.0-041500rc6-generic_4.15.0-041500rc6.201712312330+20170103+1_amd64.deb
3. Install the downloaded package:
  $ sudo dpkg -i linux-image-4.15.0-041500rc6-generic_4.15.0-041500rc6.201712312330+20170103+1_amd64.deb
4. Make sure the kernel is installed without any error. Once installed, reboot.
5. At grub, choose the newly installed kernel. You can choose the "recovery" mode.
6. Reboot and go to BIOS settings to confirm your BIOS has been recovered.
7. In case your BIOS is not recovered, reboot to the new kernel, then reboot *once again* to the new kernel, do not enter BIOS settings before the reboot. After the second reboot, check BIOS.
8. If your BIOS issue remains, download another kernel from http://people.canonical.com/~ypwong/lp1734147/linux-image-4.15.0-041500rc6-generic_4.15.0-041500rc6.201712312330+clear+debug_amd64.deb, and use dpkg to install it, then repeat steps 4 to 6.

After your BIOS is fixed, the kernel packages you just installed are no longer needed, you can remove it by running 'sudo dpkg -r linux-image-4.15.0-041500rc6-generic'.

Affected Machines:

Lenovo B40-70
Lenovo B50-70
Lenovo B50-80
Lenovo Flex-3
Lenovo Flex-10
Lenovo G40-30
Lenovo G50-30
Lenovo G50-70
Lenovo G50-80
Lenovo S20-30
Lenovo U31-70
Lenovo Y50-70
Lenovo Y70-70
Lenovo Yoga Thinkpad (20C0)
Lenovo Yoga 2 11" - 20332
Lenovo Z50-70
Lenovo Z51-70
Lenovo ideapad 100-15IBY
Acer Aspire E5-771G
Acer Aspire ES1-111M-C1LE (fixed following your new instruction (thank you))
Acer TravelMate B113
Acer Swift SF314-52 (Fixed by 4.14.9)
Toshiba Satellite S55T-B5233
Toshiba Satellite L50-B-1R7
Toshiba Satellite S50-B-13G
Dell Inspiron 15-3531
Mediacom Smartbook 14 Ultra M-SB14UC
Acer Aspire E3-111-C0UM
HP 14-r012la

/Most recent update 

If you want to respin the previously released Ubuntu 17.10 ISO (or similar) and replace the Ubuntu-4.13.0-16.19 kernel with the newly 'corrected' Ubuntu-4.13.0-21.24 kernel then use the following command:

isorespin.sh -i ubuntu-17.10-desktop-amd64.iso \
-e "linux-image-4.13.0-16-generic linux-headers-4.13.0-16" \
-p "linux-generic linux-signed-generic"

This will create an ISO 'linuxium-ubuntu-17.10-desktop-amd64.iso'. You can then use this as the ISO for further respinning or add additional options to the above command (e.g. '--atom' to make the ISO suitable for booting on Intel Atom (Bay Ttail and Cherry Trail) devices.

The respinning will update (as taken from the file system manifest):

linux-generic   4.13.0.16.17
linux-headers-4.13.0-16 4.13.0-16.19
linux-headers-4.13.0-16-generic 4.13.0-16.19
linux-headers-generic   4.13.0.16.17
linux-image-4.13.0-16-generic   4.13.0-16.19
linux-image-extra-4.13.0-16-generic     4.13.0-16.19
linux-image-generic     4.13.0.16.17
linux-signed-generic    4.13.0.16.17
linux-signed-image-4.13.0-16-generic    4.13.0-16.19
linux-signed-image-generic      4.13.0.16.17

to

linux-generic 4.13.0.21.22
linux-headers-4.13.0-21 4.13.0-21.24
linux-headers-4.13.0-21-generic 4.13.0-21.24
linux-headers-generic 4.13.0.21.22
linux-image-4.13.0-21-generic 4.13.0-21.24
linux-image-extra-4.13.0-21-generic 4.13.0-21.24
linux-image-generic 4.13.0.21.22
linux-signed-generic 4.13.0.21.22
linux-signed-image-4.13.0-21-generic 4.13.0-21.24
linux-signed-image-generic 4.13.0.21.22

Please donate if you find my work useful using the following link http://goo.gl/nXWSGf.