no debian 9?
apt-get install intel-microcode https://wiki.debian.org/Microcode then follow the "releasenote".
Is intel-microcode not part of the linux-firmware package on Debian based distros?
Intel has released new CPU microcode for download
61–70 of 112 posts
Re: Intel has released new CPU microcode for download
#62Earlier quoted context omitted.
The characters after the shorthand are probably chip revision. {HSW,BDW,SKL,KBL,CFL} are probably Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake. {HSX,BDX,SKX} appear to be the codenames for some variants of Haswell/Broadwell/Skylake - I find mixes of references to those being the Xeons, associated chipsets, and otherwise. GLK appears to be Gemini Lake, a codename for some of Intel's really low power SoCs.
Skylake-X?
SKX = Skylake-X = Skylake Xeon, as distinct from SKL, which is the "client" die. The most important distinction is that SKX has AVX 512 and SKL does not.
Re: Intel has released new CPU microcode for download
#63As someone living/fighting through the performance degradation that the kernel patches have done to IO loads at AWS, I'm wondering if their Xen patches have had this or may include it in the future. Would really really rather that there were no more negative changes.
Some of the hypervisor fixes were dependent on the new microcode
Re: Intel has released new CPU microcode for download
#64Earlier quoted context omitted.
Only what Intel provides, the updates are AFAIK encrypted.
And no reverse engineering possible? I'm a bit surprised there is no enthusiast blog that tries to document intel microcode changes, but maybe I just haven't found it yet.
This might be interesting reading for you: http://inertiawar.com/microcode/
Signed with 2048-bit RSA, and probably encrypted too.
Re: Intel has released new CPU microcode for download
#65To update the intel-ucode package to the system: - 1. Ensure the existence of /sys/devices/system/cpu/microcode/reload - 2. Copy intel-ucode directory to /lib/firmware, overwrite the files in /lib/firmware/intel-ucode/ - 3. Write the reload interface to 1 to reload the microcode files, e.g. echo 1 > /sys/devices/system/cpu/microcode/reload
You forgot to say "on Linux".
For Dragonfly instructions see: https://www.dragonflydigest.com/2018/01/09/20710.html
Re: Intel has released new CPU microcode for download
#66HN really needs a sticky feature for comments concerning security patches and other updates that can bork your machine. In this case, someone who dreams in hardware, breathes ASM and talks in bytes, needs to clearly inform the community here concerning these questions: - SHOULD THIS MICROCODE UPDATE BE PERFORMED SEPARATELY FROM RUNNING: apt-get update && apt-get upgrade ? - WHAT IS THE IDEAL/BEST WAY TO PERFORM THIS…
I like how HN's adherence to a certain simplicity has, I think, helped keep the community integrated, and relatively egalitarian and respectful (with a lot of other work going into that, as well, I'm sure).
But there have been a few times, this year and recently, where very pertinent security issues have had threads of both immediate and enduring value, with information -- mostly in the comments -- both useful and not available elsewhere that I've seen, online.
Maybe another one of HN's select, few categories. E.g. "essential". Probably populated solely at the moderators' discretion. In that, I'm in favor of the benevolent dictators model: Maybe some polite and well-argued comments about what might belong, but no voting or manipulable -- technically nor socially -- as to what gets in there.
When a processor, platform, OS is significantly borked, and the knowledge is essential to a broad portion of this community. That would be what goes in there. Starts as regular threads. If the need to know and value of them are high enough, they get tagged with that category. So that, e.g. I can more readily find that Intel Management Engine thread a couple of months later, when I'm deciding whether I want to patch (or patch further) and what mitigations to keep in place.
I don't know, and maybe I'm wrong. Just an idea.
P.S. I don't know whether the front page would link "essential" somewhere, or whether it would be like some other qualifiers, that don't have a front page presence. Again, the simplicity of the front page, versus the value of the information and the need to know.
P.P.S. I really am afraid, though, of the arguments its presence might engender, as to what belongs in it, and the disharmony this might introduce and foster. There's a LOT of value to the existing simplicity (of the interface, if not always the elephant behind it).
Re: Intel has released new CPU microcode for download
#67FWIW, microcode is now included the patch that VMware released today. Gonna go test it out now... PSA: VMs have to be cold booted after patching and set to HW v11+ for PCID support EDIT: Just fired up my first Windows VM after patching ESXI and I'm now showing all green using the PowerShell script. Here's the link that I'm referring to: https://www.vmware.com/us/security/advisories/VMSA-2018-0004...
Yikes. So they refuse to vMotion to a host that's on the new microcode? I'm not even clear on how that would be supported -- it should Just Work if the host is in the cluster. Are hosts unable to rejoin a cluster after rebootign with this new microcode because they're effectively part of a different processor compatibility now? Does EVC affect how this impacts the ability to vMotion?
In a cluster, all hosts must be updated for the flags to be exposed to the guests. That is why you must update vCenter first, which prevents the patched hosts from being rejected.
Re: Intel has released new CPU microcode for download
#68HN really needs a sticky feature for comments concerning security patches and other updates that can bork your machine. In this case, someone who dreams in hardware, breathes ASM and talks in bytes, needs to clearly inform the community here concerning these questions: - SHOULD THIS MICROCODE UPDATE BE PERFORMED SEPARATELY FROM RUNNING: apt-get update && apt-get upgrade ? - WHAT IS THE IDEAL/BEST WAY TO PERFORM THIS…
While I understand your sentiment, probably the best action is to do the default, which is to wait for an update from your package manager/OS.
The news on HN is, well news, so it's often fresh and breaking news. Acting on said news entails its own risks unless you know what you're doing, and there aren't ambiguities which may bork your computer.
Re: Intel has released new CPU microcode for download
#69HN really needs a sticky feature for comments concerning security patches and other updates that can bork your machine. In this case, someone who dreams in hardware, breathes ASM and talks in bytes, needs to clearly inform the community here concerning these questions: - SHOULD THIS MICROCODE UPDATE BE PERFORMED SEPARATELY FROM RUNNING: apt-get update && apt-get upgrade ? - WHAT IS THE IDEAL/BEST WAY TO PERFORM THIS…
# Download new release of microcode from https://downloadcenter.intel.com/download/27431/Linux-Proces...
# Copy intel-ucode directory to /lib/firmware
# echo 1 > /sys/devices/system/cpu/microcode/reload
# update-initramfs -u
# Reboot
Also check - https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
Re: Intel has released new CPU microcode for download
#70HN really needs a sticky feature for comments concerning security patches and other updates that can bork your machine. In this case, someone who dreams in hardware, breathes ASM and talks in bytes, needs to clearly inform the community here concerning these questions: - SHOULD THIS MICROCODE UPDATE BE PERFORMED SEPARATELY FROM RUNNING: apt-get update && apt-get upgrade ? - WHAT IS THE IDEAL/BEST WAY TO PERFORM THIS…
No it doesn't, since that kind of thing is not what HN is for and there are many places that are. It does need fewer people typing breathlessly in all caps a lot.