UEFI on that Lenovo ThinkServer
As mentioned in my previous post, I have set the new computer to prefer UEFI booting. In this post, I want to say what I am seeing in terms of the UEFI implementation.
The ThinkServer seems to handle UEFI best, if I disable CSM (compatibility support module). That disables legacy booting. UEFI still works with CSM enabled, but is a bit more messy. At the moment, CSM is enabled, but I will probably leave it disabled most of the time, enabling only when I need to boot a legacy system.
The F12 key on boot
If I hit the F12 key on boot (while the logo is showing), I am given a menu to use to select the current boot source. That is similar to what I have seen on my Dell. This is useful for one-time selections, such as when trying to boot from a DVD or USB. The normal boot default gives USB flash drives highest preference (after the non-existent floppy), hard drives next, then DVD/CD. Hitting F12 allows changing that.
If CSM is disabled, then the boot menu from F12 lists the UEFI boot possibilities. If CSM is enabled, then the F12 list gives only devices and no way of selecting UEFI or Legacy boot from those devices. Since I have given preference to UEFI, it does seem to choose the UEFI boot from the device if there is a possibility.
By contrast my Dell, with CSM enabled, gives a list of available UEFI boots followed by a list of available Legacy boots. That’s more flexible.
With my Dell system, the BIOS deletes NVRAM entries, keeping only one per EFI partition. That’s awkward, because if I boot Windows, then the linux NVRAM entry is deleted and I have no easy way of getting back to linux. If I reinstall the linux entry, the Windows entry is deleted. I can still boot Windows from the grub2-efi menu. But, if I boot Windows, then it puts back its NVRAM entry, and on the next boot the linux entry is deleted. I described how to work around that problem in an earlier post.
With the ThinkServer, this does not happen. The NVRAM entries are retained. At the worst, I might need to use F12 during boot to select the particular boot that I want.
Any system that retains wanted NVRAM entries, and allows you to select during boot, is reasonably usable in my book. So I’ll give credit to Lenovo for this implementation, in spite of some other problems.
We are supposed to be able to set the boot order. In linux, the command
# efibootmgr -o 3,5,1
would set the order as to first try NVRAM entry 3, then 5, then 1. As I have discovered, from helping people on opensuse forums, some computers do not honor the boot order. My Dell does honor the boot order, but will later delete NVRAM entries other than the first in boot order for a disk.
The ThinkServer is a bit odd. If I set the boot order, that seems to take. If I then inquire about the boot order, it shows the new order. But, after reboot, it has changed the boot order to something else.
On further looking, there is a place in the BIOS setting where boot order can be specified. And it seems that the BIOS is keeping a separate list for that, and is later forcing the order from that BIOS list onto the UEFI boot order list. This is not in accordance with the UEFI specifications, but is reasonably workable. I can set the boot order, but I have to do that in BIOS settings. While not perfect, this is reasonably usable.
The worst case that I have seen are computers that always boot Windows first, regardless of configured boot order. That causes headaches. To be honest, I have not checked that because I do not have Windows installed on the ThinkServer.
I could not get secure boot to work on the Think Server. Or, perhaps it works, but opensuse is broken. If I turn on secure-boot, then I cannot boot opensuse.
My suspicion is that this is an opensuse problem. As best I understand it, secure boot in opensuse depends on “shim.efi” being signed with the Microsoft key. Since Windows is not installed on this computer, it does not have a copy of the Windows key to verify that signature. So it just rejects.
I have reported this as bug 869786. But perhaps the best solution is to just leave secure-boot disabled. The alternative would be for opensuse to install its own key, but that might lock out future installs of Windows. Or perhaps opensuse could install the Windows key as a defacto standard.
I’ve only seen one other problem. I have a CD for Acronis True Image (2013 edition) recovery boot. On my Dell, I can boot that in either UEFI mode or Legacy mode. On the ThinkServer, it does not boot in UEFI mode. I am unsure what is causing the problem.
The Lenovo ThinkServer TS140 has a reasonably good, if slightly imperfect, implementation of UEFI.