Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel has released new CPU microcode for download

downloadcenter.intel.com

Post reply on HN
Print view View original

41–50 of 112 posts

Re: Intel has released new CPU microcode for download

#41

Post by wadkar »

mschuster91 wrote: post #23
1over137 wrote: post #12

Earlier quoted context omitted.

Does High Sierra update the microcode of the CPU? For Sierra, a patch is likely coming; there is "Security Update Developer Beta 2018-001" which you can get using their beta program.

What about those of us still on 10.11? That one is horrible already but the horror stories I see on a daily base from colleagues with 10.12/10.13, thanks but no thanks... I'm not a free QA engineer for Apple.

I was under the impression that the recent security update for El Capitan 10.11.6 contains required fixes. I am doing a clean install and upgrading all the way and check the PoC for any red flags. I will update here my findings. +1 for not upgrading to High/Sierra.

Update: According to https://support.apple.com/en-us/HT208331 the Security Update 2017-005 contains fixes for Meltdown.

Update 2: According to https://support.apple.com/en-us/HT208403 the Safari Update 11.0.2 contains fixes for Spectre.

So folks on 10.11.6 El Capitan should be good.

Re: Intel has released new CPU microcode for download

#42

Post by mrmondo »

blibble wrote: post #10
mrmondo wrote: post #2

To update the intel-ucode package to the system: - 1. Ensure the existence of /sys/devices/system/cpu/microcode/reload - 2. Copy intel-ucode directory to /lib/firmware, overwrite the files in /lib/firmware/intel-ucode/ - 3. Write the reload interface to 1 to reload the microcode files, e.g. echo 1 > /sys/devices/system/cpu/microcode/reload

don't forget to update your initramfs, else on reboot it won't be applied on debian: update-initramfs -u check with dmesg | grep microcode

Thanks, and on RHEL/CentOS/Fedora:

  dracut -f

Re: Intel has released new CPU microcode for download

#43

Post by chx »

mehrdadn wrote: post #40
kyledrake wrote: post #38

Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible.

> Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible. They do have ./releasenote: Intel Processor Microcode Package for Linux 20180108 Release -- Updates upon 20171117 release -- IVT C0 (06-3e-04:ed) 428->42a SKL-U/Y D0 (06-4e-03:c0) ba->c2 BDW-U/Y E/F (06-3d-04:c0) 25->28 HSW-ULT Cx/Dx (06-45-01:72) 20->21 Crystalwell Cx (06-46-01:32…

IVT is Ivytown aka. Ivy Bridge EX (past Xeon codenames: Clovertown, Gulftown, Harpertown, Jaketown, Gainestown -- although not all *town codenames covered Xeons, a lot did). All of these are easy to figure abbreviations of Intel code names, perhaps the newest ones a bit harder because we are not as used to them yet (CFL for Coffee Lake, GLK for Gemini Lake -- both of which are probably class action lawsuit targets as they shipped after Intel was told).

Re: Intel has released new CPU microcode for download

#44

Post by orblivion »

itomato wrote: post #18
pero wrote: post #9

no debian 9?

apt-get install intel-microcode https://wiki.debian.org/Microcode then follow the "releasenote".

I was just explained the other day on Hacker News how CPU microcode gets delivered with the Kernel. That it gets installed automatically on every boot. Why is it a separate package (which it turns out I don't have).

Re: Intel has released new CPU microcode for download

#45

Post by threeseed »

mschuster91 wrote: post #32
username223 wrote: post #30

Earlier quoted context omitted.

You (and colleagues) must have a strange workload. Despite my misgivings about an in-place file system change, the switch to 10.13 was pretty much painless. I use software from the latest Apple stuff, to aging programs from Adobe and other third parties, to GNU Emacs, to scripts written decades ago, so it doesn't seem like general breakage.

> You (and colleagues) must have a strange workload. Sometimes it's something as easy as installing the printer driver for a C1028i printer. On 10.13, it's stuck on "Configuring printer" forever. The printer driver is the currentmost available from the vendor, and the OS fully patched. Or something as grave as the famous empty password root backdoor. This alone is sufficient for me to not upgrade as long as possible…

> Or something as grave as the famous empty password root backdoor.

You mean the issue that was fixed quite a while ago now ?

I really don't understand the logic behind your position. OSX really is as buggy as it's always been. At least it's buggy with the latest security fixes applied.

Re: Intel has released new CPU microcode for download

#47

Post by rincebrain »

mehrdadn wrote: post #40
kyledrake wrote: post #38

Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible.

> Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible. They do have ./releasenote: Intel Processor Microcode Package for Linux 20180108 Release -- Updates upon 20171117 release -- IVT C0 (06-3e-04:ed) 428->42a SKL-U/Y D0 (06-4e-03:c0) ba->c2 BDW-U/Y E/F (06-3d-04:c0) 25->28 HSW-ULT Cx/Dx (06-45-01:72) 20->21 Crystalwell Cx (06-46-01:32…

The characters after the shorthand are probably chip revision.

{HSW,BDW,SKL,KBL,CFL} are probably Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake.

{HSX,BDX,SKX} appear to be the codenames for some variants of Haswell/Broadwell/Skylake - I find mixes of references to those being the Xeons, associated chipsets, and otherwise.

GLK appears to be Gemini Lake, a codename for some of Intel's really low power SoCs.

Re: Intel has released new CPU microcode for download

#48

Post by foxhop »

bcantrill wrote: post #14

Despite the name, this is not Linux-specific microcode. If you're running SmartOS or another illumos derivative, run ucodeadm(1) on the microcode.dat file (which will need to be renamed to have an "intel" prefix per the man page -- e.g., "intel-code.txt"). You can then run "ucodeadm -v" to validate that the new microcode has been loaded. (Note that this does not persist across a reboot, but we at Joyent are currently…

Awesome! Thanks for this!

Re: Intel has released new CPU microcode for download

#49

Post by kenrose »

wadkar wrote: post #41
mschuster91 wrote: post #23

Earlier quoted context omitted.

What about those of us still on 10.11? That one is horrible already but the horror stories I see on a daily base from colleagues with 10.12/10.13, thanks but no thanks... I'm not a free QA engineer for Apple.

I was under the impression that the recent security update for El Capitan 10.11.6 contains required fixes. I am doing a clean install and upgrading all the way and check the PoC for any red flags. I will update here my findings. +1 for not upgrading to High/Sierra. Update: According to https://support.apple.com/en-us/HT208331 the Security Update 2017-005 contains fixes for Meltdown. Update 2: According to https://sup…

From the first link, the Meltdown fix is only for High Sierra:

Available for: macOS High Sierra 10.13.1 Impact: An application may be able to read kernel memory (Meltdown)

Re: Intel has released new CPU microcode for download

#50

Post by em3rgent0rdr »

ars wrote: post #27

Wish Intel would say if this does anything useful without also updating the Kernel, or do you have to have both.

I presume you would need to do both, since there are multiple attack vectors. Some problems like meltdown can be mitigated via how the kernel handles page table's when switching to kernel mode, while some problems like spectre's branch manipulation need microcode updates.
Post reply on HN