Fresh Ubuntu 20.04 won't boot after intel-microcode update on ThinkPad T460s

[Markus Konrad]

Installed Ubuntu 20.04 from USB disk using the first Ubuntu 20.04 installation image released end of April. The system installs and boots fine. Then, I run a system update via `apt update && apt upgrade` with updates to Ubuntu 20.04.1. intel-microcode is updated on this occasion to version 3.20201110.0ubuntu0.20.04.2. Update installation succeeds but subsequent reboots most of the time fail. I can access GRUB but a normal boot of any of the installed kernels results in either a black screen or a screen with a cursor blinking ad infinitum. Booting in recovery mode via GRUB and then "resume" works, but external display is not detected in this case. Sometimes however (maybe 1/5 of the time), making a reboot from this state works.

When I uninstall intel-microcode via `apt purge intel-microcode` the problems disappear. I can boot the system without any problem.

I had occasional boot problems already since several months, but they could be resolved by just rebooting (pressing the power key for a long time). After the latest update, this wouldn't work anymore, so in the end I tried out re-installing Ubuntu which resulted in the problems described above.

I'm using a Lenovo ThinkPad T460s with system firmware version N1CET37W (1.05) which is quite old.

[Alban VACHETTE (albanvachette)]

I have the same issue on my asus UX303UB.

I downgraded intel-microcode to version "3.20191115.1ubuntu3" in order to boot my PC.

Here is the output of the command "lscpu" on my PC :

Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
Address sizes: 39 bits physical, 48 bits virtual
CPU(s): 4
On-line CPU(s) list: 0-3
Thread(s) per core: 2
Core(s) per socket: 2
Socket(s): 1
NUMA node(s): 1
Vendor ID: GenuineIntel
CPU family: 6
Model: 78
Model name: Intel(R) Core(TM) i5-6200U CPU @ 2.30GHz
Stepping: 3
CPU MHz: 2700.033
CPU max MHz: 2800,0000
CPU min MHz: 400,0000
BogoMIPS: 4800.00
Virtualization: VT-x
L1d cache: 64 KiB
L1i cache: 64 KiB
L2 cache: 512 KiB
L3 cache: 3 MiB
NUMA node0 CPU(s): 0-3
Vulnerability Itlb multihit: KVM: Mitigation: VMX disabled
Vulnerability L1tf: Mitigation; PTE Inversion; VMX conditional cache flushes, SMT vulnerable
Vulnerability Mds: Mitigation; Clear CPU buffers; SMT vulnerable
Vulnerability Meltdown: Mitigation; PTI
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl and seccomp
Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2: Mitigation; Full generic retpoline, IBPB conditional, IBRS_FW, STIBP conditional, RSB filling
Vulnerability Srbds: Vulnerable: No microcode
Vulnerability Tsx async abort: Not affected
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon
                                  pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcn
                                 t tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgs
                                 base tsc_adjust bmi1 avx2 smep bmi2 erms invpcid mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_
                                 epp md_clear flush_l1d

[Markus Konrad (mkonrad)]

I can confirm that downgrading intel-microcode to version "3.20191115.1ubuntu3" resolves the issue. I've marked the package as "on hold" for now.

Here's my "lscpu" output that I forgot in my initial report:

Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
Address sizes: 39 bits physical, 48 bits virtual
CPU(s): 4
On-line CPU(s) list: 0-3
Thread(s) per core: 2
Core(s) per socket: 2
Socket(s): 1
NUMA node(s): 1
Vendor ID: GenuineIntel
CPU family: 6
Model: 78
Model name: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz
Stepping: 3
CPU MHz: 799.864
CPU max MHz: 3400.0000
CPU min MHz: 400.0000
BogoMIPS: 5599.85
Virtualization: VT-x
L1d cache: 64 KiB
L1i cache: 64 KiB
L2 cache: 512 KiB
L3 cache: 4 MiB
NUMA node0 CPU(s): 0-3
Vulnerability Itlb multihit: KVM: Mitigation: VMX disabled
Vulnerability L1tf: Mitigation; PTE Inversion; VMX conditional cache flushes, SMT vulnerable
Vulnerability Mds: Mitigation; Clear CPU buffers; SMT vulnerable
Vulnerability Meltdown: Mitigation; PTI
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl and seccomp
Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2: Mitigation; Full generic retpoline, IBPB conditional, IBRS_FW, STIBP conditional, RSB f
                                 illing
Vulnerability Srbds: Vulnerable: No microcode
Vulnerability Tsx async abort: Mitigation; Clear CPU buffers; SMT vulnerable
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acp
                                 i mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_per
                                 fmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64
                                  monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic
                                  movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cp
                                 uid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept
                                 vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx
                                  smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hw
                                 p_notify hwp_act_window hwp_epp md_clear flush_l1d

[Henrique de Moraes Holschuh (hmh)]

For the record: systems with firmware outdated enough to actually hit this microcode update issue *most likely* have several other critical security issues in their Intel platform, not just in the processor.

The outdated firmware not only blocks you from updating the processor microcode (thus several processor issues remain), but also very likely has vulnerabilities in other platform components such as the Intel Management Engine.

It is your decision to keep your system running like that, but please ensure you actually understand the risks you are taking: review the missing firmware update changelogs/advisories/release notes in your system vendor's website to understand which fixes you are missing, and also check the running processor microcode version to understand which processor microcode fixes you are missing.

[Markus Konrad (mkonrad)]

Thank you for giving a hint to the out-of-date firmware and its implications.

I wanted to update my firmware using fwupdmgr and the firmware binary files provided by Lenovo. Unfortunately the firmware can only be flashed when the system boots via UEFI, but my computer won't boot in UEFI mode, only legacy (BIOS) mode. It doesn't find any bootable device in UEFI-only mode (not even a USB stick with Ubuntu).