[Fujitsu Lifebook AH532] Installing Ubuntu on a USB-drive locks out firmware access

[Vegard Bakke]

I've been running pre-installed Windows 7 on a Fujitsu AH532 since 2012.

Two weeks back, I installed a Live-USB with Ubuntu 14.04. All working well, but I struggled getting it persistent, so I decided to do a full Ubuntu installation to another USB-drive. Leaving my Windows hard drive untouched.

What I did:
1) I entered my "BIOS" to change boot order, and booting from my Ubuntu Live-USB.

2) I tried following the installation guide https://help.ubuntu.com/community/Installation/UEFI-and-BIOS, but sizes were changed to:
 - 1MB BIOS Boot (pretty sure I left this unformatted,but it now reports as Ext4)
 - 666MB EFI System, FAT32
 - 30GB Linux Filesystem, Ext4
 - 999MB Linux Swap, Swap

3) I installed Ubuntu on a second USB-drive. Leaving my Windows hard-drive "intact" (?)

The result:
Now, I can only boot my machine by inserting my second full-installation-USB-drive.
I cannot boot Windows, and I cannot boot from my LiveUSB.

If I boot without inserting my full-installation-USB-drive, I get the boot screen telling me I can press F2 or F12. However, none of these have any effect, apart from making the beep. Then the computer enters the "Boot menu" (as well as the second menu "Application menu").

This bug feels very related to:
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1082418
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1273060
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1451387

$ lsb_release -rd
Description: Ubuntu 14.04.2 LTS
Release: 14.04

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: linux-image-3.16.0-41-generic 3.16.0-41.55~14.04.1
ProcVersionSignature: Ubuntu 3.16.0-41.55~14.04.1-generic 3.16.7-ckt11
Uname: Linux 3.16.0-41-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.7
Architecture: amd64
CurrentDesktop: Unity
Date: Sat Jul 4 08:05:03 2015
InstallationDate: Installed on 2015-06-18 (15 days ago)
InstallationMedia: Ubuntu 14.04.2 LTS "Trusty Tahr" - Release amd64 (20150218.1)
SourcePackage: linux-lts-utopic
UpgradeStatus: No upgrade log present (probably fresh install)
---
ApportVersion: 2.14.1-0ubuntu3.7
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/pcmC0D0p: vegard 2045 F...m pulseaudio
 /dev/snd/controlC0: vegard 2045 F.... pulseaudio
DistroRelease: Ubuntu 14.04
HibernationDevice: RESUME=UUID=b7bfbfab-671b-471c-ba59-210445db2063
InstallationDate: Installed on 2015-06-18 (16 days ago)
InstallationMedia: Ubuntu 14.04.2 LTS "Trusty Tahr" - Release amd64 (20150218.1)
MachineType: FUJITSU LIFEBOOK AH532
Package: linux (not installed)
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-41-generic.efi.signed root=UUID=b9d1f4be-275f-4b97-a68a-ccb2afa41781 ro quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 3.16.0-41.55~14.04.1-generic 3.16.7-ckt11
PulseList:
 Error: command ['pacmd', 'list'] failed with exit code 1: Home directory not accessible: Permission denied
 No PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
 linux-restricted-modules-3.16.0-41-generic N/A
 linux-backports-modules-3.16.0-41-generic N/A
 linux-firmware 1.127.11
Tags: trusty
Uname: Linux 3.16.0-41-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

_MarkForUpload: True
dmi.bios.date: 05/22/2012
dmi.bios.vendor: FUJITSU // Phoenix Technologies Ltd.
dmi.bios.version: Version 1.09
dmi.board.name: FJNBB1C
dmi.board.vendor: FUJITSU
dmi.chassis.type: 10
dmi.chassis.vendor: FUJITSU
dmi.modalias: dmi:bvnFUJITSU//PhoenixTechnologiesLtd.:bvrVersion1.09:bd05/22/2012:svnFUJITSU:pnLIFEBOOKAH532:pvr:rvnFUJITSU:rnFJNBB1C:rvr:cvnFUJITSU:ct10:cvr:
dmi.product.name: LIFEBOOK AH532
dmi.sys.vendor: FUJITSU

[penalvch (penalvch)]

Vegard Bakke, thank you for reporting this and helping make Ubuntu better. Please execute the following command, as it will automatically gather debugging information, in a terminal:
apport-collect 1471380

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

apport information

[Vegard Bakke (vegard-bakke)]

Just to let you know: I removed my original hard drive (with Windows pre-installed). It made no difference.

It was removed prior to filing this bug, And I am still running without the hard-drive. Meaning, apport-collect was also run without the original hard-drive.

From this I beleive that it was not the boot record on the hard drive that was tampered with.

I also beleive that Fuhitsu Lifebook AH532 came without secure boot. I did not have to shift-click on shutdown in Windows to tell the system I wanted to enter the"BIOS" when restarting. (Something I had to do on my newer laptop.)

Also, when I changed the boot order on the AH532 (prior to installing thef first LiveUSB) I entered what looked like the BIOS. It had all the old BIOS settings, and did not miss notice anything missing. On my newer laptop, I was puzzled that the "BIOS" looked different, missing a lot of features. (Now, I beleive that this "BIOS" was the UEFI boot screen.)

My conclusion: It might be that my Ubuntu installation thought my PC was using secure boot, even though it didn't. It tried installing as if it was secure boot, but this failed, and now I'm stuck. Prehaps....?

[Abdul Rehman (abdulrehman3)]

I have fujitsu lifebook ah532 of serial YLKVxxxxx,
want to install ubuntu 15.04 without messing anything,
I have access to Boot menu and Bios,
Currently Running Windows 10 Pro,
Hard disk partitions are GPT based.
Bios version 1.09

Hardware specs
Intel Core-i7 3612qm
4 GB DDR3 RAM
Intel HD 4000m

[penalvch (penalvch)]

Vegard Bakke, as per http://support.ts.fujitsu.com/Download/ShowFiles.asp an update to your computer's buggy and outdated BIOS is available (2.07). If you update to this following https://help.ubuntu.com/community/BIOSUpdate does it change anything?

If it doesn't, could you please both specify what happened, and provide the output of the following terminal command:
sudo dmidecode -s bios-version && sudo dmidecode -s bios-release-date

For more on BIOS updates and linux, please see https://help.ubuntu.com/community/ReportingBugs#Bug_reporting_etiquette .

Please note your current BIOS is already in the Bug Description, so posting this on the old BIOS would not be helpful. As well, you don't have to create a new bug report.

Once the BIOS is updated, if the problem is still reproducible, and the information above is provided, then please mark this report Status Confirmed. Otherwise, please mark this as Invalid.

Thank you for your understanding.

[Abdul Rehman (abdulrehman3)]

Command Output:

sudo dmidecode -s bios-version && sudo dmidecode -s bios-release-date

Version 1.09
05/22/2012

[penalvch (penalvch)]

Abdul Rehman, it will help immensely if you filed a new report via a terminal:
ubuntu-bug linux

Please feel free to subscribe me to it.

[Launchpad Janitor (janitor)]

[Expired for linux (Ubuntu) because there has been no activity for 60 days.]

[Tim Schumacher (timschumi)]

I tracked this down to a bunch of edge-cases in Fujitsu's UEFI implementation, the Linux kernel, and efibootmgr.

The method of restoring access by doing a CMOS-reset (shorting the CL1_CL2 test point) and flashing the BIOS [1] was already known, but I also created a tool [2] that is supposed to restore all relevant settings from within a running Linux installation. Please do make note of the list of supported configurations and of the disclaimer.

A proper kernel-side fix is pending, but it will take some time to land in mainline Linux, linux-stable and the Ubuntu kernel tree respectively.

[1] https://support.ts.fujitsu.com/
[2] https://github.com/timschumi/ah532-biostools/

[penalvch (penalvch)]

Hi Tim,

Thanks for attending to this!

If you know the pending commit submitted for inclusion into the Linux kernel, please feel free to add the URL of the mailing list / site.

Given above, I'll mark this as Confirmed.

[Tim Schumacher (timschumi)]

A workaround [1] (adapted from the respective mailing list submission [2] with minor edits) has been submitted to mainline Linux and was just released as part of Linux v6.8-rc7. Automatic backports into Linux 6.1, 6.6, and 6.7 are pending.

I'll submit separate linux-stable backports for 5.15, 5.10, 5.4, and 4.19 (required due to changed paths) once we get the first stable release on 6.8, that should be ample time for figuring out whether the approach introduces any issues.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a
[2] https://<email address hidden>/

[Tim Schumacher (timschumi)]

The workaround has now landed in all currently supported linux-stable branches:

linux-6.8: 6.8-rc7 (f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a)
linux-6.7: 6.7.9 (cbf12e716a52d260fabecdca7d5f6e7cd07aed6c)
linux-6.6: 6.6.21 (71da10e633a96593cf59af3f322a9c49a22cb71e)
linux-6.1: 6.1.81 (249d6ca4ff0022a4b51a8eb9fac6d7bff2c94d1b)
linux-5.15: 5.15.154 (9bc9c11c151ab27214cc204d954ee902e9bbe8e2)
linux-5.10: 5.10.215 (f33255ccbb0f627da76364cce72cf980d027142c)
linux-5.4: 5.4.274 (34b5d2ff9ed5cdea9f971f394c0d623761a4d357)
linux-4.19: 4.19.312 (a7bd7dbaa2ddcf8c5ed5d96df240f1442447d252)

I tested the recent Ubuntu 24.04 beta and made sure the issue is already fixed there.

Sadly, we just about missed the time (by about two months) to get the fix into the ISOs for Ubuntu 22.04.4.