Ubuntu 14.04 on Lenovo ideapad 100-14IBY (Part 2)

Following up on the first part, this post will cover issues I experience after installing Ubuntu 14.04 and the steps I took to investigate them. The following issues immediately caught my attention:

• WiFi connection dropped - no WiFi until reboot
• Returning from flight mode leaves WiFi disabled - or at least unusable
• Suspend/resume does not work - stuck at a black screen
• Reboot and shutdown need the physical power button to be pressed
• Brightness control buttons inverted - "up" will dim the backlight and vice versa

WiFi stability issues

The lspci output from the first part shows that the ideapad is equipped with a RTL8723be WiFi card. Googling revealed others has similar issues which could be dodged or at least significantly improved by disabling hardware encryption.

cat <<EOF | sudo tee /etc/modprobe.d/rtl8723be.conf
options rtl8723be swenc=1
EOF

In order for the changes to take effect, one either has to reboot or remove and then probe the kernel module. With this change applied, WiFi seemed much more stable, entering and returning from flight mode worked just fine, and occasional WiFi issues could be simply resolved disconnecting and reconnecting, although rather infrequently toggling flight mode or removing and probing the module were needed. In addition to this, I disabled IPv6 for our local WiFi connection. The results were good enough so I moved on to the next topic.

Inverted back-light control buttons

Googling revealed other have experienced this issue before me, however, the common suggestions of using acpi_osi=Linux acpi_backlight=vendor boot parameters did not help, nor did any element of the superset of these two parameters. The only side effect was constantly maximum brightness, which cannot be changed with the buttons at all. On the Lenovo support forum I read that people using Windows experienced the same until new Lenovo provided drivers were installed... As I was running out of time, I decided to categorize this as a minor cosmetic issue and removed those boot parameters.

It is worth to note that after installation I had just about an hour to work with the ideapad which then I left the with the owner and had to continue my investigation at home, reading and googling, without access to the hardware. Therefore I quickly skipped to the next topic.

Suspend/resume, reboot and shutdown issues

It was rather obvious from the beginning that all issues around changing the power state have a common root cause. I assumed a faulty or non-standard ACPI implementation might be the root cause. I entered firmware setup and carefully reviewed the settings but did not find any obvious configuration option which might be related. I experimented with disabling virtualization support and thermal management capabilities but did not see any improvement.

Assuming the ACPI implementation of the ideapad wants to be smart and compensate some broken Windows versions, I attempted to fix the issue by experimenting with acpi_osi settings.

The ACPI _OSI call

It is not unheard of that BIOS/firmware bugs cause reboot problems. ACPI offers a way for the firmware to query which operating system [version] is running - and this feature is frequent used by vendors with good intention to work around specific operating system bugs but in long term this practice translated to the proliferation of non-standard OS implementations and wrongly applied ACPI quirks.

It is documented in the ACPI BIOS Guideline for Linux that by default the Linux kernel since version 2.6.23 no longer returns true for _OSI("Linux")ACPI invocations, effectively lying to the firmware in order to discourage vendors from applying Linux specific quirks as opposed to strictly following the standards. At the same time, the Linux kernel also returns true when _OSI is invoked with any known Windows OS string. This behaviour can be controlled via the acpi_osi parameter already mentioned before.

Other sources recommend to use acpi_osi=Linux in combination with acpi_osi='!Windows 2012' for UEFI based laptops. I have experimented with many variations, selectively enabling and disabling OS strings for individual Windows version. Unfortunately, this did not resolve the issue.

Update something

The ideapad came with firmware version CCCN12WW(V1.01) released on 03/23/2015 as confirmed via sudo dmidecode, and the most recent firmware found on the Lenovo support site is CCCN18WW (V2.04) released on 11/27/2015. While it would be a logical next step to update the firmware, Lenovo only provides a Windows executable, no way to flash the update from Linux or to prepare bootable media for flashing. The rules I have set for myself does not allow using windows based tools, so I had to stay with firmware v1.01. I believe it is rather strange that the ideapad is shipped with FreeDOS but no firmware update can be run anything other than Windows 7 or newer releases.

What I could update was the Linux kernel. The default HWE kernel these days is 3.19.0-37-generic #42~14.04.1-Ubuntu, and I installed linux-image-4.2.0-19-generic which is the Ubuntu 15.10 kernel. This update did also did not change the ACPI issue.

Firmware developers and counter-intuitive decisions

Eventually, the ACPI issue could be resolved by experimenting in the firmware settings on pure trial and error basis. The ideapad came with FreeDOS, and was configured to support BIOS/CSM mode as a fallback if UEFI boot failed. This I quickly disabled legacy mode right after installing Ubuntu. Also, UEFI Secure Boot was disabled by default which I found reasonable as I do not fancy Microsoft's practices of trying to hinder the installation of alternative operating systems.

In the "Exit" menu of the firmware setup, right under "Load Defaults" there is an parameter called "OS Optimized Defaults" which was set to "Other OS". The other option is "Windows 8 64-bit". This is only used when someone activates "Load Defaults" and as I would expects, it enables Secure Boot, sets UEFI only boot mode and some other settings found on the setup screens.

Just for the fun of it, I changed the "OS Optimized Defaults" to "Win8 64bit" and loaded defaults. As expected, it activated Secure Boot but did not change any of the other values on the setup screens. I was surprised to see that this completely fixed the ACPI issues. I returned to the firmware setup screen, disabled Secure Boot, changed "OS Optimized Defaults" back to "Other OS" - but did not load defaults. After booting Ubuntu, I confirmed that suspend, resume, reboot and shutdown work well. My conclusion is that loading Windows 8 64-bit optimized defaults also changed firmware settings which are not exposed on the setup screen. This is a very counter-intuitive practice as loading default firmware setup values should not do anything else than loading defaults for the values exposed on the setup screens.

Closing notes

With all major issues addressed, I released the ideapad for production use. I made the owner aware of the inverted backlight controls buttons and told to provide feedback if any WiFi stability issues occur during field use. The remaining glitches will be addressed subsequent posts.

Ubuntu 14.04 on Lenovo ideapad 100-14IBY

The first laptop which I really liked was an IBM t60p ThinkPad manufactured in 2006. It served me well for years but was retired some time ago and my father inherited it - predominantly for light office use. A few days ago, the graphics chip gave up and we needed an urgent, low cost replacement that fits his needs. The goal is simple: get a fully functional notebook for office use with 4G of RAM, the cheapest available disk and without OEM Windows. The stock disk would be replaced by the after market 120GB SSD from the t60p and Ubuntu 14.04 would be installed anyway, since this is the OS my father already got familiar with. The rules are simple as well: buy, install & configure the notebook, the use of windows or any windows based tools is strictly prohibited.

Enter Lenovo 100 80MH003AHV

For around 250 USD excluding VAT, this ultrabook includes 4G of RAM, a strong enough Intel Pentium Quad-Core N3540, 500GB HDD, and is shipped with FreeDOS. I have googled for any information specific to this model and Ubuntu or Linux in general, but did not find anything useful, which is not a good sign of ultrabooks in this price range... so I was prepared for surprises.

The Levono 100 is available in different models / machine-types, and 80MH003AHV relates to 100-14IBY. The hardware maintenance manual can be downloaded from the official support site.

The first surprise came right after unboxing. The plastic case did not feel very robust, but still much force was needed to open it even after all screws have been removed. Once has to be careful to apply enough but not too much force. The next surprise was the sticker seal I found on the screw that attached the HDD to the motherboard. This could possibly mean that the HDD cannot be upgreaded without voiding warranty, which is not a fair practice. I was handy enough to remove the sticker without damaging it.

Unfortunately, I realized that the SSD was password protected and although I knew the password, it could not unlock the disk. This phenomenon I have observed before - my conclusion was that that the t60p and other ThinkPads of the same era transform the HDD password provided on the BIOS Setup screen before sending it to the HDD via ATA Security commands, which, even when the password is known, makes it impossible to access the drive from notebooks of other vendors or even other generations of ThinkPads. The password has to be removed on a ThinkPad that was manufactured in the same era as the one which was used to set the password. The SSD password topic was put on hold over the weekend and on Monday, I used a t60p I borrowed from a colleague to unset the password.

Let us get back to the ideapad - I created an EFI-bootable USB key with Ubuntu 14.04, and inserted it while the computer was still powered off, then I connected the power cord and used a paper clip to push the "Novo button". This button started the computer but enter the BIOS/UEFI menu instead of launching the operating system on the HDD. I took a look at the firmware settings (which many incorrectly still refer to as BIOS setup screen) but did not see any hard reason to change any setting, so I stayed with the defaults for the initial boot.

The first boot: Ubuntu 14.04 from USB

Ubuntu booted without major hiccups, and first commands I ran was lspic and sudo dmidecode to get more information about what the ideapad contains under the hood.

00:00.0 Host bridge: Intel Corporation ValleyView SSA-CUnit (rev 0e)
00:02.0 VGA compatible controller: Intel Corporation ValleyView Gen7 (rev 0e)
00:13.0 SATA controller: Intel Corporation ValleyView 6-Port SATA AHCI Controller (rev 0e)
00:14.0 USB controller: Intel Corporation ValleyView USB xHCI Host Controller (rev 0e)
00:1a.0 Encryption controller: Intel Corporation ValleyView SEC (rev 0e)
00:1b.0 Audio device: Intel Corporation ValleyView High Definition Audio Controller (rev 0e)
00:1c.0 PCI bridge: Intel Corporation ValleyView PCI Express Root Port (rev 0e)
00:1c.1 PCI bridge: Intel Corporation ValleyView PCI Express Root Port (rev 0e)
00:1c.2 PCI bridge: Intel Corporation ValleyView PCI Express Root Port (rev 0e)
00:1c.3 PCI bridge: Intel Corporation ValleyView PCI Express Root Port (rev 0e)
00:1d.0 USB controller: Intel Corporation ValleyView USB Enhanced Host Controller (rev 0e)
00:1f.0 ISA bridge: Intel Corporation ValleyView Power Control Unit (rev 0e)
00:1f.3 SMBus: Intel Corporation ValleyView SMBus Controller (rev 0e)
02:00.0 Unassigned class [ff00]: Realtek Semiconductor Co., Ltd. RTS5229 PCI Express Card Reader (rev 01)
03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8101E/RTL8102E PCI Express Fast Ethernet controller (rev 0a)
04:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8723BE PCIe Wireless Network Adapter

The next step was to verify if the system booted in UEFI mode or legacy BIOS mode. Checking /sys/firmware/efi/ quickly revealed we are in UEFI mode.

I intentionally did not even attempt to boot the HDD even once, as I wanted to take a backup of the factory HDD image the computer came with. I quickly configured WiFi and installed partimage after enabling the "universe" repository component and took a full backup of /dev/sda, a 500GB rotating disk with MBR partition table containing a single FAT partition which was basically empty.

Before downloading partimage I quickly verified internet connectivity, but during the repo update and package download the WiFi connection seemed unreliable. After a few minutes I completely lost connection and had to fall back to wired connection - this issue did not surprise me that much.

I manually configured the disk via gdisk, created a 32MB EFI system partition, swap and separate ext4 partitions for /root and /home. I created the partitions in a way they would only occupy the first 120GB of the disk so I can simply clone it onto the SSD once the HDD password issue is resolved. Once done, I installed Ubuntu which went fine, the only strange issue i experienced that the system did not automatically reboot itself and was stuck at a blank screen so I had to keep the power button pressed for a few seconds to force a reboot.

In the next post on this topic, I will list the issues I experienced, the systematic approach I applied to investigate and overcome those and of course the resolution itself will also be provided shortly...

Lenovo S650 update to VibeUI 2.0 1439

This post is a follow up on my older posts on Lenovo VibeUI KitKat ROM. I settled with version VibeUI 1.5 (1427) for about a year, in spite of hte following issues:

1. Waze always had a dark overlay on the map during navigation with eventual flickering, to the extent that is was completely unusable for navigation as the map was hardly visible. I am not aware of any workaround for this issue, other than using alternative navigation software.
2. Google Maps navigation is always crashing after a few minutes. The issue was narrowed down to affect newer versions, and downgrading to 8.0.0 proved to be a stable temporal workaround.
3. Security - in more particular, the lack of regular security updates and recently disclosed android related vulnerabilities frightened me at this stage.

Lenovo published a firmware update for S650 smartphones on the 25th of September last year, but at I did not see a compelling reason to install it right away, I was rather waiting for subsequent updates but they did not come. I decided to upgrade and yesterday night I found time for it.

The upgrade procedure

I cleaned up both internal and external storage, and made sure the following files are present to the external storage:

• VIBEUI_V2.0_1439_7.3.1_ST_S650_WC52.zip from vibeui.com
• 5-31_GApps_Minimal_4.4.2_signed.zip which I already had from my last download
• superuser.zip - com.koushikdutta.superuser which I also already downloaded earlier.

I took a backup of my call logs and text messages, copied important data to my computer, then booted into recovery and created a full TWRP backup. Read my previous posts for details on this step.

After wiping data, cache and dalvik cache partitions I installed the update from within TWRP recovery, then immediately applied superuser.zip. Before reboot, I opened a terminal from within TWRP, and manually mounted the system partition and deleted Chinese apps that I do not need:

mkdir /tmp/s
mount -t ext4 /dev/block/mmcblk0p5 /tmp/s
# change directory to /tmp/s/vendor/operator/app/ via TWRP menu as the built in terminal 
# does not allow you to do that
mv Len* .. # move LenovoPhonemgr.apk which I decided to keep this time
rm *.apk 
mv ../Len* . # move back the app
# change to /tmp/s/priv-app/ via TWRP
rm GameWorld_Phone.apk Youyue.apk
# change to /
umount /tmp/s

Once this was done, but before installing the google apps package, I rebooted the phone, and chose English language in the setup wizard. This was a bit tricky due to the many pop-ups, but still much easier without the Google setup wizard, which would have been run in Chinese had I installed Google Apps in one shot. After language selection and initial setup, I went back to recovery and installed google apps minimal. After booting the system the google setup wizard was greeting me in English...

Later I restored my call logs and text messages as well as application data of some of my key apps. This I had to do manually via and adb shell as Super Backup failed to restore application data even with root privileges granted. My approach was to do some setup of the critical apps manually, so the data files are were created by the app itself with appropriate permissions and ownership, then I overwrote the content of the necessary files with cat $BACKUP > $DATAFILE.

First impressions

Both Google Maps and Waze works fine with this app. I got used to the previous ROM and found stock theme and UI changes annoying. I quickly tailored the theme and launcher according to my preferences.

The Goolge Apps minimal package was outdated, which gave me some application crashed before and during updated, but once the new version of Google packages were installed, everything worked fine.

Unfortunately, according to Stagefright Detector the new version is even a bit more vulnerable than the previous one.

Stagefright

As mentioned above, this new ROM contains one more Statefright related vulnerability compared to VibeUI 1.5, and Lenovo does offer security patches, but not for this phone.

As a countermeasure, I disabled automatic retrieval of multimedia message, from the mail messaging app as recommended here and revoked MMS permissions from any other application. Of course I would be happier if Lenovo provided security updates regularly and more consistently across reasonably new mobile devices.

Firefox 37 and corporate intranet

After a recent update on Ubuntu 14.04.2 LTS, no connection to the beloved corporate expense reimbursement application could be established any more. Of course I realised this situation at a time when I urgently needed to use that application.

Background

Long time ago I have installed the Firefox extension SSL Version Control which allows me to use stronger encryption by defaults, while enables lowering the security level easily if needed. I quickly realised that requiring TLS 1.2 everywhere was not be a workable practice, so I settled with TLS 1.0 back then to get rid of at least SSLv3. Google for POODLE to learn more about the reasons.

I still needed to occasionally allow SSLv3 from time to time in order to be able to use corporate web applications hosted on improperly configured servers - this is the reality of a huge US based enterprise in 2015, no comment.

In Firefox 34 (released in December 2014), SSLv3 was disabled by default, but could be easily enabled by end user either via the extension referred above or changing property security.tls.version.min in about:config as explained here.

Firefox 37, released right before April Fool's Day 2015, disabled insecure TLS version fallback as a security improvement. This means that nor the extension, nor setting the above mentioned configuration property to 0 would allow me any more connect to sites via SSLv3. It is suggested to set another property, security.tls.version.fallback-limit to 1 and file a bug noting the URL of the site where this is needed.

Obviously, I did not submit a but report to Mozilla with a link to our intranet expense reimbursement application. Apparently, setting fallback limit to 1 or 0 did do the magic. Needless to say at that point I was a bit annoyed and under time pressure.

The solution

To make the long story short, Firefox 37 by default does not even respect user-configurable whitelisting, but uses a hardcoded list of hosts. Disabling the use of the compiled-in whitelist allows the end user to provide a custom list of hosts where insecure TLS version fallback should be allowed.See bugs 1114816 and 1084025 for details.

I ended up with disabling the SSL Version Control extension and manually tweaking TLS fallback related properties as shown below.

security.tls.version.max = 3 # default value
security.tls.version.min = 1
security.tls.insecure_fallback_hosts = w3.***.com
security.tls.insecure_fallback_hosts.use_static_list = false
security.tls.version.fallback-limit = 1

Update: Two days ago, the host running the corporate expense reimbursement application was reconfigured to support TLS 1.0 (but not any newer version). The configuration properties above have been updated to reflect this change.

Generating PGP keys stronger than 4096 bit RSA

I will be transitioning from the pgp key I have been using for four years to a new one. The decision to move to a new one was taken four years ago, and recent news on privacy, applied cryptography and leaked information about practices of various authorities seem to resonate with my plans.

Four years ago I moved to a 4096-bit pgp key, and now, as I am about to generate a new one, the question about the preferred cryptographic algorithms and key sizes arises. Currently, GnuPG seems to support a maximum RSA key size of 4096. This post covers my process of generating a 8192-bit RSA key, and of course using SHA512, a hash function much stronger than SHA-1.

The limitation of GnuPG as shipped with Ubuntu 14.04

Many have written about the limitation of GnuPG to only support generating RSA keys up to 4096. This limitation is not imposed by the algorithm itself, but merely a decision of developers which may or may not be related to export regulations and similar legislation around the use of cryptographic technologies in the United States.

I will not go into any discussion on such legislative restrictions, and I will focus on technology stating that I am not a citizen of the US and any US law do not apply to me at my current location.

As GnuPG is open source free software, anyone can download the source, and alter the constant defining maximum key size to lift the current limitation. As there is no technical limitation why one could not generate 8196-bit, one can just change keygen.c and increase the key size limit, then compile and use the modified version. It is important to note here, than an unmodified GnuPG will works perfectly with a 8192-bit key, the only restriction is it will not offer one to create such keys out-of-the-box.

Avoiding recompilation without hacking binaries

There is a little known feature of GnuPG that allows one to generate 8192-bit keys without any modification. It supports unattended key generation that reads the configuration form an input file, and this esoteric feature is not subject to the limitation mentioned above.

$ cat params.txt
Key-Type: RSA
Key-Length: 8192
Subkey-Type: RSA
Subkey-Length: 8192
Name-Real: Tibor B****
Name-Email: tibor.b*****@gmail.com
Creation-Date: 20150101T000000
Expire-Date: 20191231T000000
Passphrase: !!!change it!!!
Preferences: S10 S9 S13 H10 Z3 Z2 Z1
%commit
%echo done
$ gpg --batch --gen-key params.txt

GnuPG 1.4.16, the version which ships with Ubuntu, gives the following error.

gpg: fatal: out of secure memory while allocating 4228 bytes

Enter GnuPG 2

Fortunately, GnuPG 2, which is the new modular version of GNU Privary Guard, is also packaged, one just has to install gnupg2, currently, version 2.0.22 ships with Ubuntu 14.04. GnuPG 2 does not have memory allocation issues and is able to generate the 8192-bit key.

Entropy

In order to increase the speed of key generation, I have installed the package rng-tools. This smart software allows one to use the hardware based true random number generator available on most modern PC chipsets and feed the kernel entropy pool. I have found this small utility to make an extremely big difference in accelerating key generation by drastically increasing the bandwidth of the random device, without trade-offs in security. I fail to see why this package is not part of the base installation of Ubuntu.

Transitioning to the new key

The process of transitioning to the new key has been described by others in sufficient detail, please see here for a good HOWTO.

Make sure to also update your gpg config, and read up on the current status of the cipher and digest algorithms supported by GnuPG. Pick your preferred ones wisely.

Ubuntu 14.04 - openconnect VPN and network manager

Openconnect VPN

After having reinstalled my thinkpad with Ubuntu 14.04, I noted that I could not connect to one of my client's VPN via GUI. The VPN authentication dialog simply did not pop up after clicking the VPN profile on the network manager indicator/applet. No error displayed, no useful information in syslog. The only line I could correlate with connection attempts looked like the one cited below. Note that this line in itself does not indicate any error, it is present during normal operation as well, the point here is that no other lines related to VPN were displayed at all.

Aug 31 14:43:43 gluon NetworkManager[997]: <info> VPN service 'openconnect' disappeared

The VPN itself is Cisco Anyconnect, and connecting to it via the commandline using openconnect worked fine. I use password based authentication in tandem with a hardware token generator, no client certificate involved in this configuration. All required packages are installed, and if I create another VPN profile in network manager with an invalid gateway URL, then I do get the authentication dialog displaying an error.

As this used to work properly on Ubuntu 12.10, I googled for regressions and found forum threads and this and another bug report but they have not helped to resolve my case.

To make the long story short, I found where network manager persists connection profiles, and when checking the VPN connection profile in question, I found it contained invalid file paths to certificates, which typically seem to be the result of handling the 'None' option in the wrong way.

sudo cat /etc/NetworkManager/system-connections/${VPN_PROFILE_NAME} | grep cert
usercert=/home/tibi/(null)
cacert=/home/tibi/(null)
authtype=cert
# simply delete the lines with invalid path
# and optionally set authtype=password, but actually it does not matter.

The malfunction seems to be the result of using the build-in import/export functionality. The exported connection profile simply contains (null) for the certificates if password based authentication is used, however, during import this value is simply appended to the user's home directory.

[openconnect]
Description=****
Host=vpn.****.hu
CACert=(null)
Proxy=
CSDEnable=0
CSDWrapper=
UserCertificate=(null)
PrivateKey=(null)
FSID=0

Anyway, I would have expected better visual feedback or error logging.

Optimus and Ubuntu 14.04

This post takes the reader through Nvidia Optimus related tweaks I applied on my Lenovo W530 after upgrading it to Ubuntu 14.04. I have dedicated a a series of 5 posts to the same topic on Ubuntu 12.10. Please take those previous posts as prerequisite knowledge, as I do not intend to repeat the detailed descriptions I have already provided. As outlined earlier, my goal is to get a very stable system with extended battery life, and the ability to connect an external projector to the VGA port and cover the following use cases (a verbatim copy of the enumeration from a previous post):

• Extend the desktop to the external monitor.
• Get a cloned output of the primary monitor to the external monitor with panning support - this means, that in the case the external monitor's resolution is smaller, a smaller viewport will follow the mouse and show a cropped clone of the desktop's content. The viewport will follow the mouse to show the area of interest.
• Run LibreOffice presentations with the external monitor showing the current slide and the primary monitor showing the presentation overview, notes and time.
• Never ever get X freezes or kernel lockups on suspend/resume with or without an external monitor connected.
• Switching to virtual terminals should always work in a bulletproof manner. The box is a workhorse, cannot allow hiccups.
• Might sound like a small detail, but a properly displayed usplash/plymouth is also important, not only for cosmetic purposes.

Prime and Optimus support out of the box

As documented in the official wiki of the nouveau driver, Optimus support has improved much in the open source driver, and automatic power management of the discrete graphics chip is also documented to work properly with Linux kernel 3.13. This means, Optimus should work out of the box: the discrete graphics chip should be turned on when needed, and fully powered off automatically when idle for 5 seconds.

The following command listing can be used to quickly review the current state of the two graphics chips. As it can be seen, the discrete chip's status is DynOff meaning that automatic power management is active and the device is currently powered off. Further, xrandr lists all outputs - those wired to the integrated chip as well as those wired to the Nvidia GPU.

uname -a
Linux gluon 3.13.0-35-generic #62-Ubuntu SMP Fri Aug 15 01:58:42 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
sudo cat /sys/kernel/debug/vgaswitcheroo/switch
0:DIS: :DynOff:0000:01:00.0
1:IGD:+:Pwr:0000:00:02.0
xrandr -q | grep conn # confirms that outputs wired IDG and also those wired to DIS are visible to X
LVDS2 connected primary 1920x1080+0+0 (normal left inverted right x axis y axis) 344mm x 193mm
VGA2 disconnected (normal left inverted right x axis y axis)
VIRTUAL1 disconnected (normal left inverted right x axis y axis)
LVDS-1-1 disconnected
VGA-1-1 disconnected
DP-1-1 disconnected
DP-1-2 disconnected
DP-1-3 disconnected

When connecting an external display, DIS will be powered on automatically and outputs are detected and handled almost perfectly by Ubuntu out of the box (more on this later). However, once DIS has been powered on, it cannot be powered off, even if no external monitor is connected. Further, if DIS is not powered off, the Thinkpad cannot be suspended, which is a pain.

sudo cat /sys/kernel/debug/vgaswitcheroo/switch 
0:DIS: :DynPwr:0000:01:00.0
1:IGD:+:Pwr:0000:00:02.0
echo "OFF" | sudo tee /sys/kernel/debug/vgaswitcheroo/switch
OFF
sudo cat /sys/kernel/debug/vgaswitcheroo/switch 
0:DIS: :DynPwr:0000:01:00.0
1:IGD:+:Pwr:0000:00:02.0

Others have experienced slightly different behaviour, in particular DIS being powered on (DynPwr) at boot, the common phenomenon is the inability to power off DIS via the command line. The author has suggested disabling the new automatic power management feature to allow the user to explicitly power on and power off the devices as needed.

Disabling automatic power management of the Nvidia graphics chip

Adapting the suggestion to Ubuntu 14.04 involved editing bootloader configuration so it passes the additional argument nouveau.runpm=0 to the kernel.

sudo nano /etc/default/grub # find and edit the GRUB_CMDLINE_LINUX_DEFAULT as follows:
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash nouveau.runpm=0"
sudo update-grub
sudo init 6 # reboot

Having rebooted the system, I verified that the configuration change indeed took effect. Power states DynPwr and DynOff disappeared, and manual power state switching could be successfully performed the same way as in Ubuntu 12.10.

cat /proc/cmdline # verify nouveau.runpm=0 was successfully passed to the kernel
BOOT_IMAGE=/boot/vmlinuz-3.13.0-35-generic.efi.signed root=UUID=2a924e40-1f12-4c5a-8f22-556d6e66ffa6 ro quiet splash nouveau.runpm=0 vt.handoff=7
sudo cat /sys/kernel/debug/vgaswitcheroo/switch # verify current power state
0:DIS: :Pwr:0000:01:00.0
1:IGD:+:Pwr:0000:00:02.0
echo "OFF" | sudo tee /sys/kernel/debug/vgaswitcheroo/switch # power off DIS
OFF
sudo cat /sys/kernel/debug/vgaswitcheroo/switch # verify power state again
0:DIS: :Off:0000:01:00.0
1:IGD:+:Pwr:0000:00:02.0

The surprise

Based on my knowledge of how outputs are wired on W530, my experiences on Ubuntu 12.10 and my observation in 14.04 so far I assumed that with DIS powered off, xrandr -q would not list the external VGA and DisplayPort outputs, or at least that connecting an external display to those outputs wired to the Nvidia chip would not do anything if the discrete GPU is powered off.

Contrary to my expectations, even if DIS is powered OFF, the external VGA and DiplayPort outputs are available to X, and hooking up an external monitor works the same way after this tweak as before. The Thinkpad can now be suspended, even with external outputs connected.

However, if an external display was active at the time the laptop was suspended, compiz crashed once the system resumed. This is a minor glitch resulting in a prompt to submit a bug report, and compiz is automatically restarted and fully functional even in this case. To be on the safe side, I would disconnect external displays before suspending - this seems to make sense anyway.

Disabling the discrete GPU on boot by default to save power

In order to save power, I disabled the Nvidia GPU during the boot process. I wanted X to be started with both IDG and DIS powered on, to make sure all outputs are properly detected. Customising /etc/rc.local is the approach I settled with, as this file is run after all other services, including X, have been started. This script does not do anything on a clean install, so all one needs to do is to insert one line before exit 0:

echo "OFF" > /sys/kernel/debug/vgaswitcheroo/switch
exit 0

External VGA working almost perfectly

In general I can confirm a lot of progress related to Optimus since 12.10. Outputs are detected out of the box, no need for a second X servers, special Xorg configuration and hybrid screenclone or other voodoo magic. The desktop can be extended to the external VGA, resolution and other parameters all configured using the GUI.

I observed one issue while testing LibreOffice presentations with the external monitor showing the current slide and the primary monitor showing the presentation overview. The current slide, rendered to the external VGA in fullscreen mode did not properly update. At first sight it seems to always be 1 slide behind compared to the LCD of the thinkpad, but moving the cursor over this area of the screen made the area around the cursor refresh, unveiling parts the actual current slide (XDamage came to my mind).

This issue I have not yet resolved. I do not have an external monitor at home, so I will have to wait and squeeze the investigation into my schedule during working hours.

Update: Workaround

I have settled with launching watch -n xrefresh before starting my presentation, and terminating it once I am done. This essentially forces a full refresh every second which yields acceptable experience. Not optimal, but just good enough.