[SOLVED] How to load new Intel microcode

keefaz · 01-10-2018, 05:22 PM

Yes I have read this document while searching for microcode file format informations, scary stuff (especially the javascript code at Appendix)

abga · 01-11-2018, 07:41 AM

Worth reading Intel's official performance impact benchmarks after applying the "mitigation" on Win10 - not effectively describing what, but presumably firmware + SW patch:

https://newsroom.intel.com/editorial...lient-systems/

kjhambrick · 01-11-2018, 08:20 AM

Quote:

Originally Posted by abga

Worth reading Intel's official performance impact benchmarks after applying the "mitigation" on Win10 - not effectively describing what, but presumably firmware + SW patch:

https://newsroom.intel.com/editorial...lient-systems/

I call BS on this one.

They're referencing desktop PeeCee and Laptop Performance Hits.

What they skilfully neglect to say in that marketing piece it is MUCH Worse on Servers, even on Microsoft Servers.

One anecdote I can provide ...

We've been running a CentOS-Based Server Application on AWS for five years or so.

Before Amazon did their forced reboots last week, the load averages ran consistently less than 1.00 ...

After the AWS forced reboot, our load averages skyrocketed to between 7.00 and 9.00 and our Server App took a dump -- it could no longed accept Client Connections and all hell broke loose.

Amazon's advice: buy a bigger instance -- a pisser after running on that Server since 2013 !

So we spent the weekend scrambling to move our hand-rolled server-side application to 'a bigger instance'.

It runs fine now but it cost us the entire weekend to migrate and then to clean up the aftermath in the DataBase Tables.

Not to mention our AWS Monthly Fees will increase proportionally.

And then there are our Client Apps Servers ( Data Conversion && Transfer Boxen ) which took a 38% dive on our Intel NUC Model after applying Intel's BIOS Updates and the CentOS 6 Kernel Updates.

I've not measured the effects on our Zotac ZBOXen ... Still waiting for a BIOS Update there, but I don't expect any better results.

Anyhow, my $0.02 worth ... rant-mode off.

-- kjh

abga · 01-11-2018, 08:43 AM

And if you consider that these are the "latest generation processors" and that, as reported my Redmond:
https://www.linuxquestions.org/quest...ml#post5804447
the performance impact on older "generations" - Haswell downwards will be higher, I'm afraid that Mr. Schneier was right:
"The security of pretty much every computer on the planet has just gotten a lot worse, and the only real solution -- which of course is not a solution -- is to throw them all away and buy new ones."
https://www.schneier.com/blog/archiv...and_mel_1.html

Double win for the big businesses

Well, at least apparently:
https://www.theguardian.com/technolo...-bugs-computer

bamunds · 01-11-2018, 10:07 AM

@abga and @Kjhambrick The information about performance after microcode AND kernel updates is more directly related to Greg K-H's thread on Meltdown, Spectre and other threats https://www.linuxquestions.org/quest...el-4175621133/. Please move the discussion on mitigation to that thread or the security thread. This thread is intended as a "howto" for microcode update and not intended to replace the security thread(s) or Greg K-H's thread.

Some may feel that readers should understand the performance impact of these latest microcode updates, OR the possibility that doing an update may actually be futile and simply getting a different processor is the only solution. However, there are some of us who wish to continue using our existing CPU's and want to know what is the proper procedure to be successful.

Thanks and Cheers

abga · 01-11-2018, 03:32 PM

@bamunds
My mistake in considering that some of you might care not only about the result, but also about its quality.
Please, do carry on and sorry for the interference.

bamunds · 01-11-2018, 04:48 PM

@abga Thank you for understanding the intent of this thread. This will be marked SOLVED once I have captured the process for "Howto upgrade Intel microcode" with examples of what tools to use and how to measure success of the installation. That needs to include what errors one might get. Cheers.

teoberi · 01-13-2018, 10:45 AM

Quote:

Originally Posted by keefaz

Best way it to make ramfs image imho.
iucode_tool has to be installed from sbo / Slackbuilds

Then, infos from /proc/cpuinfo will give you the correct microcode filename (see awk code above)

Once you know the correct microcode file, the easiest way to make the ramfs image is:

Code:

iucode_tool --write-earlyfw=/boot/intel-ucode.cpio /path/to/microcode_file

If you have already an initrd you have to merge it with intel-ucode.cpio image

Code:

cd /boot
cat intel-ucode.cpio initrd.gz > initrd-merged.gz

Then replace initrd.gz with initrd-merged.gz in lilo.conf

Edit: Wow posted too late again :/

If I run

Code:

iucode_tool -S -l /tmp/microcode-20180108/intel-ucode/*

the result is

Quote:

iucode_tool: system has processor(s) with signature 0x000906e9
...
microcode bundle 70: /tmp/microcode-20180108/intel-ucode/06-9e-09
microcode bundle 71: /tmp/microcode-20180108/intel-ucode/06-9e-0a
microcode bundle 72: /tmp/microcode-20180108/intel-ucode/06-9e-0b
...
selected microcodes:
070/001: sig 0x000906e9, pf_mask 0x2a, 2018-01-04, rev 0x0080, size 98304
071/001: sig 0x000906ea, pf_mask 0x22, 2018-01-04, rev 0x0080, size 97280
072/001: sig 0x000906eb, pf_mask 0x02, 2018-01-04, rev 0x0080, size 98304

The result contains 3 files, only one is for my processor signature.
I should choose

Quote:

070/001: sig 0x000906e9, pf_mask 0x2a, 2018-01-04, rev 0x0080, size 98304

keefaz · 01-14-2018, 06:54 PM

Yes I would choose 06-9e-09 microcode file

Code:

cd /boot
iucode_tool --write-earlyfw=intel-ucode.cpio /tmp/microcode-20180108/intel-ucode/06-9e-09

teoberi · 01-15-2018, 02:54 AM

OK is working!

Quote:

[ 0.000000] microcode: microcode updated early to revision 0x80, date = 2018-01-04
[ 3.736913] microcode: sig=0x906e9, pf=0x2, revision=0x80
[ 3.737751] microcode: Microcode Update Driver: v2.2.

ChrisAbela · 01-15-2018, 08:29 AM

Does anyone knows how to load microcode for AMD processors?

55020 · 01-15-2018, 11:13 AM

Quote:

Originally Posted by ChrisAbela

Does anyone knows how to load microcode for AMD processors?

Unlike Intel, AMD's microcode has a licence that allows it to be redistributed. So it comes with the Linux firmware blobs (in Slackware that's the kernel-firmware package) and is loaded automatically on boot. See your /lib/firmware/amd-ucode/ directory.

Darth Vader · 01-15-2018, 11:24 AM

Also, unlikely Intel, the AMD does NOT add or remove CPU features via microcode, then its microcode is safely to be loaded later, if the operating system survive until that, i.e. does not try to execute some faulty instruction or command.

keefaz · 01-15-2018, 11:57 AM

Quote:

Originally Posted by Darth Vader

Also, unlikely Intel, the AMD does NOT add or remove CPU features via microcode, then its microcode is safely to be loaded later, if the operating system survive until that, i.e. does not try to execute some faulty instruction or command.

What does AMD microcode do then?

Darth Vader · 01-15-2018, 12:06 PM

Quote:

Originally Posted by keefaz

What does AMD microcode do then?

The AMD microcode just adjust the behavior of (already) existent features, with adding or removing no one, unlikely Intel.