Lenovo announces laptops using new mobile Xeon processors

http://arstechnica.com/information-technology/2015/08/lenovo-announces-powerhouse-laptops-powered-by-new-mobile-xeon-processors/

by ChuckMcM • 11 years ago

107 101 11 years ago

arstechnica.com

ChuckMcM• 11 years ago

Ok, call me skeptical but I did not think Intel would get these out for Q4 of 2015. That 15" laptop is probably way over kill but it has some really nice specs. I think what I really want though is one of these bad boys in the NUC form factor.

jcr• 11 years ago

I love seriously over-powered "luggables" and these machines might have impressive specs, but there's a big problem; a lot of open source folks won't buy NVIDIA gear due to the need for non-free binary-blob drivers. NVIDIA makes some impressive products, but they seldom play well with others, and they seem to have a real vendetta against supporting open source efforts by simply providing the necessary documentation. With luck, other vendors will also implement the mobile Xeon chips, but make a more friendly and compatible decision about graphics hardware.

SamReidHughes4• 11 years ago

That's not a big problem, because most people aren't "open source" people. The "open source" people won't even get wifi working. The real problem for Linux users is that the Linux drivers aren't good, or don't support Optimus (do they now?), and you get poor battery life or poor performance or you have to manually do configuration just to get a basic working system.

gambiting2• 11 years ago

If you love over-powered mobile solutions, have you by chance heard of Eurocom? They make a portable server called Panther, and you can configure it with 12-core/24-thread Xeon, 32GB of ram, 4x1TB SSD in RAID 5 config and dual Quattro cards. In that config you have to use two(!!!) 300W power supplies though.

http://www.eurocom.com/ec/configure(1,234,0)ec

zx2c42• 11 years ago

In NUC factor with 4 gigabit ethernet ports.

zantana• 11 years ago

Oh Chipzilla, unleash the NUC!

I bought the i3 version which has almost all of the Virtualization extensions and that thing is great for a home lab. I can easily run 6-8 small vms no problem.

It's a fine line with these products, because the memory can really add to the price tag, but its more favorable than cluster of Raspberry Pis to me.

DanielBMarkham• 11 years ago

Being a bit of a bit-head, I love reading those specs.

Something caught my eye, though: "Screen options are 1920×1080 with optional touch screen or a 3840×2160 non-touch screen"

Is there a reason for this? Is anybody doing quad-HD touch screens? I never see them.

morsch• 11 years ago

Yes. The excellent Dell XPS 13 (2015) is available with a quad-HD touch screen. (In fact, it's either QHD touch, or FHD non-touch.)

efdee• 11 years ago

Asus Zenbook Pro UX501 has an QHD touch screen. Looks nice.

stefantalpalaru2• 11 years ago

Is there a reason for this?

People caring about DPI are less likely to want to smudge the screen by touching it.

zx2c42• 11 years ago

Finally, ECC memory on a laptop!

chuckup9• 11 years ago

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd...

I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo service was installed and running! Delete the file and it reappears on reboot. I've never seen anything like this before.

Something to think about before buying Lenovo. I searched and found almost nothing about this, so it may be something they started doing in the last few months...

justThis1Post• 11 years ago

RMS is sounding less and less crazy with discoveries like this. To think a manufacturer would essentially rootkit their own machines is testament to how bad things have become.

Would running TrueCrypt full disk encryption protect you from your own hardware? If the BIOS can't read the disk on boot, I don't think it would inject the binary into the file system.

chuckup9• 11 years ago

No - see my reply to the Ars thread. Windows 8 introduced an "official" way to do this called "Windows Platform Binary Table". Every time Windows boots, it checks your ACPI table for an entry called "WPBT", writes that to disk as "wpbbin.exe", and executes it. There does not seem to be any way to disable this behavior in Windows. Truecrypt would not help in this case because it happens after boot.

RexRollman• 11 years ago

That's incredible and should be more widely reported.

chuckup9• 11 years ago

I just replied to the Ars thread - it's even stranger. Windows 8 and up have an officially Microsoft sanctioned way of letting manufacturers load software through Firmware, called "Windows Platform Binary Table". It means it is impossible to do a clean install of Windows now. I've seen zero mention of it anywhere - maybe Lenovo was the first to pull the trigger and make use of it recently.

creshal4• 11 years ago

CompuTrace has been doing it for years for their "Theft Protection". Opt-out, too, and included on about every Windows laptop.

chuckup9• 11 years ago

There is no setting I can see to opt-out of what the Lenovo is doing. It's not an anti-theft software, it's software that makes popups appear, asking you to install their software.

yuhong2• 11 years ago

Yea, the arms race against laptop thieves is ridiculous.

ilurk• 11 years ago

This is getting increasingly disturbing with each new generation of hardware.

You no longer have the right to own the hardware you buy. Now it has become a service subject to their terms.

That Windows Platform Binary Table sounds disturbing and is ripe for being exploited.

Interesting info found [1]:

Lenovo Service Engine (LSE) is a utility in the BIOS for certain Lenovo desktop systems. It automatically sends non-personally identifiable system data to a Lenovo server one time when the system is first connected to the internet and then does not send any additional data.
The system data that LSE collected includes machine type and model, system UUID, region and date. No personally identifiable information is collected.
Once this data is sent, the service is disabled automatically.
LSE uses the Microsoft Windows Platform Binary Table (WPBT) capability. Microsoft has recently released updated security guidelines on how to best implement this feature. Lenovo’s use of LSE is not consistent with these guidelines and so Lenovo has stopped shipping desktop models with this utility and recommends customers with this utility enabled run a “clean up” utility that removes the LSE files from the desktop. Instructions on how to download and run this program are below.
The LSE functionality has been removed from newly manufactured systems.

When some people insist on having a Libreboot/Coreboot supported laptop, they call them crazy and idealistic. Now this is what happens.

It's just a shame that with Intel ME the Libreboot/Coreboot devs have given up on Intel machines. I'm very interested in the Purism Librem laptop but I have low hopes. Maybe the future will be ARM.

[1] https://support.lenovo.com/nz/en/product_security/lse_bios_d...

chuckup9• 11 years ago

Very interesting, thanks for that link.

"If LSE is not enabled, it will not be shown under the “Security” tab in the system BIOS and the user is not affected"

FYI, This was not true for me - there was no option in the BIOS regarding this. So I'd say, the lack of this in your BIOS setup screen does NOT mean it is not there!

yellowapple• 11 years ago

It's just a shame that with Intel ME the Libreboot/Coreboot devs have given up on Intel machines.

The new ones, perhaps. Older ThinkPads (like the X201 and T530) are still relatively-well supported by Coreboot (though apparently ACPI isn't quite green yet).

Personally, I'd like a return to the old days of Open Firmware on some RISC-running machine (I'm partial to POWER or MIPS, but ARM would be okay, too).

yuhong2• 11 years ago

Not Intel ME, Intel Boot Guard.

cbd32• 11 years ago

It's just a shame that with Intel ME the Libreboot/Coreboot devs have given up on Intel machines. I'm very interested in the Purism Librem laptop but I have low hopes. Maybe the future will be ARM.

This isn't true. Libreboot is the fork that only works with completely free platforms, which the newer Intel chipsets make impossible. Coreboot is still very much committed to supporting new Intel chipsets, although the mainboard availability of course depends on what developers have time and interest for.

Google Chromebooks all ship with Coreboot, so they're fully supported and a great choice if you're trying to make the most free usable computer you can get. They can all run Linux, and some of them even Windows with a little more effort. They also have ARM-based ones, some of which are completely blob-free.

Also, if you're putting your hopes on Pursim this may be of interested to you: http://blogs.coreboot.org/blog/2015/08/09/the-truth-about-pu...

arm• 11 years ago

Wow… first Superfish and now this? My next computer certainly won’t be a Lenovo. Thanks for the heads-up.

riquito2• 11 years ago

About thinking before buying Lenovo...

I've bought a Lenovo notebook, wanted to download a copy of Windows from them (it's OEM), and searched on their forums for clues, since I didn't find anything on the site. This is what a moderator wrote

If what you wish to achieve is an OEM imaged system, the only way is to obtain official recovery media through official channels. There are no legal downloads available, therefore discussion of it is not allowed. You may contact Service (info and hours below) to discuss your options.

https://forums.lenovo.com/t5/Lenovo-B-and-G-Series-Notebooks...

You must buy DVDs from them. You can't even _talk_ about alternatives.

chias• 11 years ago

Better response than I got. This was just a couple months ago, the laptop shipped with Superfish installed on it in spite of assurances that it wouldn't, so I called them to ask where I could get driver installers for after I wipe / reinstall windows. I was told that I could under no circumstances reinstall Windows (even if I went and bought a brand new Windows license), that it would void my warranty and break everything and there were no drivers because: "it's not Microsoft Windows on these machines, it's Lenovo Windows".

I am never buying from them again, and at this point there is literally nothing they can do to regain my trust as a consumer.

cfreeman• 11 years ago

I've worked in computer repair shops, and what you've described about OEM Windows is how it's worked for years. You have to either use the recovery partition that comes with the machine or order new recovery media from the manufacturer. This isn't unique to Lenovo.

RaitoBezarius2• 11 years ago

Does anyone know if Lenovo try to put some rootkit on Linux / BSD based OSes? I mean, if it does attempt to do it on Windows, it may as well do it on Linux / BSD based OSes.

I was wondering about buying a ThinkPad soon to improve my hardware... And I'm pretty scared about this.

Teknoman117• 11 years ago

You'd be safe. First thing is that they are probably uninterested in we Linux & BSD users to begin with, but, entertaining the notion, I have a few thoughts.

The two methods of how this works could be blocked. For systems without support for WPBT, where the firmware attempts to overwrite system files, one could use whole drive encryption (like LUKS) on Linux to prevent the firmware from being able to write directly onto your drive. If they are more sneaky and have this tied directly to the firmware methods for writing to disk, you can always compile the Linux kernel to not require the bios after loading the kernel. This may be the default mode of operation now, i'm not entirely certain.

For the systems using WPBT, its even easier. There is no way in hell they could get a patch into the mainline or any real community kernels that would load contents of the system firmware and immediately execute them. No self respecting distribution would enable this either without the user explicitly authorizing it in the first place either.

If they are super evil and actually attempt to inject code directly into the system memory, this would depend on a explicit kernel version because the in memory model & organization aren't guaranteed to be the same between kernel versions. The last thing someone wanting to take over your computer wants to do is render it unstable. It just makes what they are doing more apparent.

The fact that Microsoft actually provided a way of having binaries executed without the user's permission (or ability to turn it off) is absolutely unacceptable. It's like they want to be able to run what they want on our systems...

jonorossi• 11 years ago

As others have said there seems to only be a single Word document Microsoft have published on the "Windows Platform Binary Table". I then found the following MSDN Forums question (with posts between 2013-07-16 and 2013-07-18) about how to implement WPBT by someone with the username "kevinwu1980". A Google search for "kevinwu1980 lenovo" gave me this (the page is now a redirect). If that MSDN Forums post is by the same guy then Lenovo was likely working on this in mid-2013:

Kernel Service Protection for Client Security
doi.ieeecomputersociety.org/10.1109/MSP.2010.112
by HJK Wu - ‎2010
... for Client Security. Hui Jun (Kevin) Wu , Lenovo Global Desktop Development Laboratory ..... Contact him at kevinwu1980@gmail.com or wuhj@lenovo.com.

https://social.msdn.microsoft.com/Forums/windowsdesktop/en-U...

chuckup9• 11 years ago

Wow, nice find!

Also, I see Microsoft has updated that document in the last two weeks, apparently due to Lenovo's use of it.

http://news.lenovo.com/article_display.cfm?article_id=2013

"a security vulnerability that was discovered ..by an independent security researcher, Roel Schouwenberg... As a result of these findings, Microsoft recently released updated security guidelines...on how to best implement this Windows BIOS feature."

naner• 11 years ago

Edit: I was wrong on all counts, see chuckup comment below. This happens after boot in cooperation with the OS. Encryption and secure boot are irrelevant.

I presume this type of firmware enabled OS modification will not be able to work with drive encryption enabled, but does secure boot help at all in this situation? Presumably Lenovo includes their own signing key in their firmware so their signed executables would also be trusted. Or is this not something secure boot would verify?

owenwil• 11 years ago

Does anyone have a laptop on the affected list, that's seeing this right now? If so, get in touch? owen@thenextweb.com

chuckup9• 11 years ago

Your story on thenextweb was excellent - it's a complex story and you managed to explain it all very well.

http://thenextweb.com/insider/2015/08/12/lenovo-used-a-hidde...

chuckup9• 11 years ago

tl;dr version (since this blew up on Reddit and there's lots of stuff to digest)

* in Windows 8+ any PC vendor can include an .EXE in Firmware/BIOS, and Windows will look for this on each boot, and run it right before you log in. This is called "Windows Platform Binary Table". This is something Windows does, and there is no way to turn this off. To me, this is the bigger story, because vendors may now start to use this method to install anything, making a clean windows install impossible.

* Lenovo uses this method if you try to install Windows 8, but if you install Windows 7, it does the sketchy "overwrite your system file (autochk.exe)" method instead.

* Either way, Lenovo installs a service on your PC. It was found to have security bugs. I can't find the link, but they said this was placed on some laptops/PC's from late 2014 to Summer 2015. They've released a new firmware 2 weeks ago that turns this off.

I would like to know if any non-Lenovo pc's have used this "Windows Platform Binary" method to run software from the firmware, because when I searched for it, I saw people with Dell's and HP's who thought they might have a virus, posting scan logs that contained the text "wpbbin.exe" (which would only be there if Windows found it in the BIOS and put it there) For example see https://www.google.com/search?q="wpbbin.exe"+site%3Aforums.m...

Check your PC:

Windows 8 and up: Check your event log for "Microsoft-Windows-Subsys-SMSS" and if you see "A platform binary was successfully executed." your PC vendor is doing this. Or, look for a file called wpbbin.exe in windows\system32. (This file would ONLY exist if Windows found it in your firmware and ran it.)

Windows 7: Verify your autochk.exe is legit. I think you could simply do: "sfc /VERIFYONLY" in cmd.exe (as Admin) but I did not test it. My autochk.exe was signed by Lenovo in 2014 (which tipped me off it didn't come from the Windows 7 DVD I got in 2010!).

intrasight• 11 years ago

Q: If I use linux as a host OS for VMWare, and install a Windows guest, will I avoid these types of issues?

4ad4• 11 years ago

Finally ECC memory in a laptop, I've wanted this for years!

However, I am seriously unimpressed by the maximum memory specifications. 64GB?! I had 32GB in my ThinkPad W510, which was released over five years ago.

I've also had 16GB in my seven year old T400. 16GB was enough for me back then, 64GB now is barely enough for me, it will certainly not be enough in a few years, although by then maybe we'd get larger memory modules, which might work just fine.

Since this is such a huge machine, they should have put more memory slots inside.

I also hope they release a 13''-14'' machine with quad-core Xeon CPUs (or some other CPUs that support ECC, some i7 chips do as well).

kev0092• 11 years ago

It would probably need 4 SO-DIMM slots to accommodate more the 64GB with current density.

4ad4• 11 years ago

W510 had 4 slots in a machine with smaller footprint.

creshal4• 11 years ago

Mind you, this is up to Intel to dictate, Lenovo has zero input. If Intel doesn't allow more than 64 GiB RAM, tough luck.

jmnicolas• 11 years ago

What do you do on a laptop that requires more than 64 GB of RAM ?

digitalzombie• 11 years ago

OP probably run lots of virtualization instances or is running a huge set of big data that uses RAM as a cache.

I have 16 GB and I ran a cluster of 3-4 of Cassandra that are virtualized via Vagrant and it was pretty solid. Wouldn't mind 32 GB though.

As for the big data comment, an example is the programming language R runs in memory... And yeah running big data in memory require lots of memory.

gambiting2• 11 years ago

I work for a games development studio and for our demo booth at recent E3 we ran all servers off a super powerful laptop - in fact, the servers very barely fit in 32GB of ram. I have 64GB ram in my desktop PC and I do hit swap occasionally.

dagw3• 11 years ago

I use more than 32 GB of RAM all the time for ad hoc data processing, analysis and transformation and personally I'd like to be able to do the same work on my laptop that I do on my workstation. Especially since I often divide my time between a couple of different offices.

mikhailt• 11 years ago

Doesn't this have to do with the DDR3 standard which mostly maxed out at 8GB per slot and Intel mobile CPUs with 4 RAM slots max?

DDR4 bumps it up to 32GB per slot IIRC, so DDR4 maxes out at 128GB, assuming 4 max slot is still intact for Intel mobile CPUs.

I haven't seen any reports that the Intel mobile Xeon would go further than 4 slots.

mtgx• 11 years ago

AKA "lap-warmers".

Qwertious• 11 years ago

Isn't that a cat?

bitL3• 11 years ago

If only they had a non-chiclet keyboard... I guess I have to wait till retro ThinkPad :-(

creshal4• 11 years ago

That's very likely still going to have a chiclet keyboard – they didn't ask for user preferences on it –, but it will at least have a proper seven-row layout.

Personally, I don't mind the chiclets – the mechanic is the same as in the old keyboards – as long as the layout gets fixed…

bitL3• 11 years ago

I guess I'll have to 3D print custom keys then...

kawsper• 11 years ago

Do you know if they are going to change the touchpad? I tried all the touchpads on the current Thinkpad generation in a store, and I was so disappointed that we chose to buy something else.

odiroot2• 11 years ago

Why? For me and any others chiclet keyboard (especially ThinkPad style) is a lot nicer than older "touching" sloped keys.

bitL3• 11 years ago

Yes, for you. For me, definitely not. I am getting close to RSI when using any chiclet keyboard besides MBP that somehow made it fairly acceptable but still inferior to original ThinkPad. The rest, like newer ThinkPads, ASUS, Dell, Toshiba etc. are just plain awful, I feel pain in my wrists after ~20 minutes of using them. And a lot of touch typists complain about chiclet keyboards as well. Flatness everywhere is getting absurd recently. Yes, chiclet keyboards look often better (well, it's the opposite with ThinkPad actually, they IMO look much worse than their original keyboard) but I prefer ergonomy to aesthetics when creating algorithms - the last thing I want is to feel pain in my wrists during a creative phase of coding when I need to write, delete, rewrite and refactor a lot of code, seriously.

Also, as a pianist I can notice subtle differences in the quality of keyboards. There is also one rule when playing on a piano - once you feel pain, you stop, you do something wrong or the instrument is not suitable for you and you'll injure yourself unless something is changed.

kev0092• 11 years ago

The entire premise of modern computing is built around deterministic memory. ECC in laptops very long overdue.

vardump3• 11 years ago

I'm very excited about ECC in laptops, and want to buy one as soon as possible, but...

Shame it's released by a company which cannot be trusted anymore. I know the bigger blunder (SuperFish) happened in consumer laptop, but all things considered, I can't trust Lenovo any more. That means I won't buy anything they make. I miss old Thinkpads.

Is there any serious laptop manufacturer left at all? A company that builds good hardware, allows user replaceable battery / memory / disk, and doesn't include any crapware, or things you can't disable (like secure boot, Lenovo style hard disk file replacement, etc.).

Shengbo2• 11 years ago

Not really, I think we can say goodbye to user-replaceable hardware with the rise of the Ultrabook form-factor. A couple of months ago I was looking for a laptop to buy and I wasn't in a hurry so I checked out literally every manufacturer I could find. In the end I defaulted to Macbook Pros. The hardware is great and OS X doesn't really get in my way. If you want customization and prefer matte screens, System76 is pretty neat but they weren't available with the keyboard layout of my choice.

merb• 11 years ago

They should provide Linux support on these..

pwnna• 11 years ago

They do! The product spec PDF show RHEL and Ubuntu as officially supported.

adulau• 11 years ago

Could someone share the binary downloaded from http://download.lenovo.com/ideapad/windows/lsebios/win8_en-u... ? I'm curious the files are properly signed and if the LSE tool is properly checking signature and so on.

jokoon• 11 years ago

I just ordered yesterday and did a wire transfer for a thinkpad L450. Hope thinkpads are not concerned by this.

Lenovo announces laptops using new mobile Xeon processors

Related Stories