Lenovo ThinkLMI BIOS Setup using Linux WMI User Guide

Lenovo ThinkLMI BIOS Setup using Linux WMI User Guide

First Edition (January 2023)

© Copyright Lenovo

LIMITED AND RESTRICTED RIGHTS NOTICE: If data or software is delivered pursuant a General Services Administration
“GSA” contract, use, reproduction, or disclosure is subject to restrictions set forth in Contract No. GS-35F-05925

Preface

The purpose of this guide is to explain how to modify BIOS settings, and boot order using Linux Management Instrumentation (LMI) through the Lenovo user space interface (ThinkLMI). This guide is intended for skilled IT administrators who are familiar with configuring BIOS settings on computers in their organizations.

If you have suggestions, comments, or questions, please talk to us on our forum! A team of deployment engineers (including the author of this document) is standing by, ready to help with any deployment
challenges you are facing: https://forums.lenovo.com/t5/Enterprise-Client- Management/bd-p/sa01_egorganizations.

Overview

IT administrators are always looking for easier ways to manage client computer BIOS settings, which include passwords, hardware settings, and the boot order. The Lenovo BIOS LMI interface provides a simplified way to change these settings. Lenovo has developed a BIOS interface that can be manipulated through Linux WMI. The Lenovo BIOS management interface ThinkLMI enables IT administrators to make queries on current BIOS settings, change single settings, change supervisor password and modify the boot order either at client computers or remotely.

Using ThinkLMI

ThinkLMI provides a powerful set of functions, such as query-based information retrieval and event notification, which enables users to manage computers. The Lenovo ThinkLMI interface extends the capabilities of Linux WMI to allow management of BIOS settings. The following illustration shows how ThinkLMI can be used to access Lenovo BIOS Settings

Key Benefits

The Lenovo BIOS Linux WMI interface provides the following benefits:

• Flexible BIOS configuration, including the ability to change a single BIOS setting or all BIOS settings
• BIOS password management, including updating supervisor passwords and power-on passwords

Supported computers

BIOS setup through ThinkLMI is supported on all Lenovo Linux certified platforms from 2020 onwards. Whilst we expect it to work on older platforms it is unsupported there.

Typical Usage

Using ThinkLMI, the BIOS settings can be configured in the following ways:

• List BIOS settings
• Change BIOS settings
• Change the boot order (sometimes referred to as the startup sequence)
• Change BIOS Password(Supervisor password and power-on password)

Listing Available BIOS Settings

For a list of all available BIOS settings that can be changed through Linux WMI on a specific computer, use the following command.

ls /sys/class/firmware-attributes/thinklmi/attributes

The above command retrieves all the settings available from the BIOS. Part of the output from ThinkPad Z16 Gen 1 is shown below:

Changing BIOS settings

To change a BIOS setting, use the following command:

echo [value] > /sys/class/firmware-attributes/thinklmi/attributes/ [BIOS Setting]

/current_value

For example – to change the current value for WakeOnLANDock:

Sample terminal input

Note : BIOS settings and values are case sensitive.

To find the permitted [value] for a [BIOS Setting] use the following command.

cat /sys/class/firmware-attributes/thinklmi/attributes/[BIOS Setting]/possible_values

For example – to find possible values of the WakeOnLANDock setting:

Sample terminal output

Changing the Boot Order

To change the boot order, use the following steps:

1. Determine the current setting for “BootOrder” by using the following command.
   cat /sys/class/firmware-attributes/thinklmi/attributes/BootOrder/current_value

2. Set a new boot order, use the following command echo [Boot Order String] > /sys/class/firmware-attributes/ thinklmi/attributes/BootOrder/current_value

Specify a new boot order by listing the boot devices in order, separated by colons.
Devices that are not specified are excluded from the boot order.
In the following example, the CD drive 0 is the first boot device and hard disk drive 0 is the second startup device:

Sample terminal output

Password Authentication

If a Supervisor password has been set, authentication needs to be performed before a BIOS setting can be changed. The following commands performs password authentication.

echo [Password String] > /sys/class/firmware- attributes/thinklmi/authentication /[Password Type]/current_password
echo [Encoding] > /sys/class/firmware-attributes/thinklmi/authentication /[Password Type]/encoding
echo [Keyboard Language] > /sys/class/firmware- attributes/thinklmi/authentication /[Password Type]/kbdlang

Reference the table below for details on each parameter

If the supervisor password is set as hello, with ascii encoding and the keyboard type is US, the below command example will authenticate the BIOS setting. Once authenticated, it remains valid till the next restart. The default value for Encoding is ascii and the Keyboard Language is US. Set these only if it is different from the default.

Sample terminal output

For the [Password Type], refer the table in the following page.

Changing an existing BIOS password

To update a password, use the following commands

echo [Password String] > /sys/class/firmware- attributes/thinklmi/authentication /[Password Type]/current_password
echo [Encoding] > /sys/class/firmware-attributes/thinklmi/authentication /[Password Type]/encoding
echo [Keyboard Language] > /sys/class/firmware- attributes/thinklmi/authentication /[Password Type]/kbdlang
echo [Password String] > /sys/class/firmware- attributes/thinklmi/authentication /[Password Type]/new_password

Reference the table below for details on each parameter

If the supervisor password is set as “hello”, the new password is “hello123”, password type is supervisor (i.e. “Admin”), with ascii encoding and the keyboard type is US, the below commands will change the supervisor password. Once authenticated, it remains valid till the next restart.

Sample terminal output

Limitations and Notes

1. A password cannot be set using this method when one does not already exist. Passwords can only be updated or cleared.

2. User/Master hard disk password (HDD) type is supported only on ThinkPad Laptops.

3. BIOS settings cannot be changed at the same boot as power-on passwords (POP) and hard disk passwords (HDP). If you want to change BIOS settings, POP and HDP you must reboot the system after changing each one of them.

4. To remove the power-on password when a supervisor password is set, it must be done in three steps:
   a. Change the supervisor password. If you don’t want to change it specify the same password for both the current and the new parameters, but you must do this step.
   b. Change the power-on password by specifying the current password and a NULL string as the new password
   c. Reboot the system (do not reboot between steps a and b).

5. Some security-related settings cannot be disabled by ThinkLMI. For example, the following BIOS settings cannot be changed from Enable to Disable:
   a. SecureBoot
   b. SecureRollbackPrevention
   c. PhysicalPresneceForTpmClear
   d. PhysicalPresenceForTpmProvision

6. It is not possible to change the Security Chip Selection (e.g. Discrete TPM or Intel PTT)

7. Note for Discrete TPM: the following values are supported for SecurityChip:
   a. Active
   b. Inactive
   c. Disable

8. Note for Intel PTT: the following values are supported for SecurityChip:
   a. Enable
   b. Disable

Trademarks

The following terms are trademarks of Lenovo in the United States, other countries, or both:

Lenovo
The Lenovo logo
ThinkPad

Other company, product, or service names may be trademarks or service marks of others.

© Copyright Lenovo

References

• English Community-Lenovo Community

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>