Regression: Instant reboot on Core Ultra (Meteor Lake) with microcode 20260811 (rev 0x2a)

从 intel-ucode/06-aa-04 开始，比较 releases 20260512 和 20260811 中的修订版 0x28 与 0x2a。在 BIOS 1.16 上使用 systemd-boot，分别在有和没有 dis_ucode_ldr 的情况下复现，然后与 BIOS 1.17 进行比较。完成的要求是确立针对早期启动阶段 reboot 的安全项目级响应。

Updating intel-ucode to release 20260811 (which bumps revision from 0x28 to 0x2a for file 06-aa-04) causes an immediate hardware reboot during early boot right after selecting the kernel entry in systemd-boot.

No dmesg or kernel crash logs are saved due to the reboot occurring in the early microcode loading phase.

System Info

• Device: Lenovo ThinkPad T14s Gen 5
• BIOS Version: N46ET26W (1.16) (Date: 04/29/2026)
• Embedded Controller (EC): N46HT18W
• CPU: Intel Core Ultra 7 155U (Family 6, Model 170 / 0xAA, Stepping 4)
• Affected Microcode File: intel-ucode/06-aa-04
• Kernel / OS: Arch Linux, kernel 7.1.8-arch1-3
• Bootloader: systemd-boot
• Working Revision: 0x28 (release 20260512)
• Failing Revision: 0x2a (release 20260811)

Steps to Reproduce & Workaround

1. Update intel-ucode to release 20260811.
2. Boot system with initrd /intel-ucode.img configured in systemd-boot.
3. Select kernel entry — system instantly triggers a hardware reboot.
4. Workaround: Downgrading intel-ucode to release 20260512 (revision 0x28) restores normal boot behavior.

Update / Root Cause

Lenovo released BIOS version 1.17 (N46UR12W) on 11 Aug 2026. The changelog explicitly mentions:

- (New) Updated the CPU Microcode to version 0x2a (CPUID: 0xA06A4)

Findings:

1. On BIOS 1.16 (N46UR11W): Early loading microcode 0x2a via initrd causes an instant hardware reset during early kernel initialization.
2. Workaround via dis_ucode_ldr: Adding dis_ucode_ldr to the kernel command line allows the system to boot successfully on BIOS 1.16 even with intel-ucode.img present in initrd, confirming the crash occurs strictly within the OS early microcode loader.
3. On BIOS 1.17 (N46UR12W): System boots normally without issues because microcode 0x2a is already baked into the system firmware.

Updating to vendor BIOS 1.17 works as a permanent fix, but applying early microcode updates via OS initrd on recent prior BIOS releases (like 1.16) should ideally not result in early-boot hardware crashes.