no debian 9?
Wait for the package to be ready there: http://ftp.us.debian.org/debian/pool/non-free/i/intel-microc...
( the version of your OS doesn't matter, it's working for any Ubuntu / Debian release )
Intel has released new CPU microcode for download
71–80 of 112 posts
Re: Intel has released new CPU microcode for download
#72HN really needs a sticky feature for comments concerning security patches and other updates that can bork your machine. In this case, someone who dreams in hardware, breathes ASM and talks in bytes, needs to clearly inform the community here concerning these questions: - SHOULD THIS MICROCODE UPDATE BE PERFORMED SEPARATELY FROM RUNNING: apt-get update && apt-get upgrade ? - WHAT IS THE IDEAL/BEST WAY TO PERFORM THIS…
I like how HN's adherence to a certain simplicity has, I think, helped keep the community integrated, and relatively egalitarian and respectful (with a lot of other work going into that, as well, I'm sure). But there have been a few times, this year and recently, where very pertinent security issues have had threads of both immediate and enduring value, with information -- mostly in the comments -- both useful and no…
You can make this page! Start curating HN posts and comments and the other resources relative to your essential needs and see what magic falls out
Re: Intel has released new CPU microcode for download
#73HN really needs a sticky feature for comments concerning security patches and other updates that can bork your machine. In this case, someone who dreams in hardware, breathes ASM and talks in bytes, needs to clearly inform the community here concerning these questions: - SHOULD THIS MICROCODE UPDATE BE PERFORMED SEPARATELY FROM RUNNING: apt-get update && apt-get upgrade ? - WHAT IS THE IDEAL/BEST WAY TO PERFORM THIS…
While I understand your sentiment, probably the best action is to do the default, which is to wait for an update from your package manager/OS. The news on HN is, well news, so it's often fresh and breaking news. Acting on said news entails its own risks unless you know what you're doing, and there aren't ambiguities which may bork your computer.
On debian at least microcode updates arent included by default you have to install the appropriate package (intel vs amd)
Re: Intel has released new CPU microcode for download
#74Intel, AMD and Via microcode is being archived by CPUID, by the user community: https://www.win-raid.com/t3355f47-Intel-AMD-amp-VIA-CPU-Micr... "Collecting all available Production CPU microcodes is important for upgrading/downgrading purposes, for creating universal tools that can help people understand what microcode they use, for research on how the general technology works, for developers with no vendor represent…
For Windows there is also this:
https://labs.vmware.com/flings/vmware-cpu-microcode-update-d...
I have never tried it though.
Re: Intel has released new CPU microcode for download
#75Looks like they updated the microcode for every single processor they ever released, going all the way back to the Pentium.
The list includes: The Pentium 4, Pentium III, Pentium II, Pentium Pro and the original Pentium.
I didn't even know the Pentium had upgradable microcode.
Re: Intel has released new CPU microcode for download
#76Earlier quoted context omitted.
And slow down my computer? No thanks.
A microcode update is applied directly to the processor, typically during the boot process, and is a common practice to fix CPU bugs. It changes the microcode running on the hardware itself. This is totally different from the kernel PTI fixes, which attempt to deal with Meltdown by changing the way the operating systems for Linux/Mac/Windows/DragonFly (and hopefully soon *BSD) interacts with the hardware and page tab…
What he said isn't wrong, this new ucode changes fencing and branching prediction semantics regardless of using the instructions added for spectre.
The problem is varied. While most people should run the new ucode and pending kernel and toolchain fixes, not all must. Most businesses buy computers on rated performance, and they are about to take an unexpected performance haircut. Intel ucode isn't really optional, as there is no public change log and it is unknowable what critical stability fixes are within. so even in a closed system you can't selectively ignore it without some amount of negligence. This presents a big problem for HPC and other closed systems.
IBM, a more professional and customer focused HPC vendor, is offering a firmware flag to preserve pre-spectre behaviors. Most closed monolithic HPC clusters can ignore these vulns and the associated nvidia one.
Re: Intel has released new CPU microcode for download
#77Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible.
> Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible. They do have ./releasenote: Intel Processor Microcode Package for Linux 20180108 Release -- Updates upon 20171117 release -- IVT C0 (06-3e-04:ed) 428->42a SKL-U/Y D0 (06-4e-03:c0) ba->c2 BDW-U/Y E/F (06-3d-04:c0) 25->28 HSW-ULT Cx/Dx (06-45-01:72) 20->21 Crystalwell Cx (06-46-01:32…
From the command 'cpuid'
I believe the [XX]-[XX]-[XX] is:
-->stepping id>
Those values are all in the first few lines of output from 'cpuid'.
The [XX]->[XX] is probably [old microcode version]->[new microcode version]
If the cpuid for a processor is not listed in those release notes, I don't think there's a reason to believe the processor has received a microcode update. It might be worth comparing the microcode blob to Intel's last release in 2017-11 to confirm.
It looks to me like the microcode version can be read out from
hexdump | head -n1 | cut -f4,5 -d' '
where the first field is the lower 16 bits and the second field is the upper 16 bits. I don't have any documentation to prove this assumption, it is just based on comparing the listed microcode versions to those fields in the binary blobs. But doing a straight 'diff' would probably be good enough to tell if the microcode file has changed.
Some Linux vendors like CentOS, Debian and Ubuntu may have microcode updates for processors that weren't part of this release, I'm not sure.
Re: Intel has released new CPU microcode for download
#78Earlier quoted context omitted.
And no reverse engineering possible? I'm a bit surprised there is no enthusiast blog that tries to document intel microcode changes, but maybe I just haven't found it yet.
This might be interesting reading for you: http://inertiawar.com/microcode/ Signed with 2048-bit RSA, and probably encrypted too.
Thanks that was an absolutely fascinating read!
Re: Intel has released new CPU microcode for download
#79Looks like they updated the microcode for every single processor they ever released, going all the way back to the Pentium. The list includes: The Pentium 4, Pentium III, Pentium II, Pentium Pro and the original Pentium. I didn't even know the Pentium had upgradable microcode.
I thought you were joking and had a close look at the list. Turns out you're absolutely right!
Intel® Pentium® Processor 100 MHz, 50 MHz FSB Intel® Pentium® Processor 120 MHz, 60 MHz FSB Intel® Pentium® Processor 150 MHz, 60 MHz FSB Intel® Pentium® Processor 75 MHz, 50 MHz FSB Intel® Pentium® Processor 90 MHz, 60 MHz FSB
Re: Intel has released new CPU microcode for download
#80Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible.
> Literally tells us nothing about what's in it. Not even a changelog. Not even a sentence hinting as to what might be in it. Incredible. They do have ./releasenote: Intel Processor Microcode Package for Linux 20180108 Release -- Updates upon 20171117 release -- IVT C0 (06-3e-04:ed) 428->42a SKL-U/Y D0 (06-4e-03:c0) ba->c2 BDW-U/Y E/F (06-3d-04:c0) 25->28 HSW-ULT Cx/Dx (06-45-01:72) 20->21 Crystalwell Cx (06-46-01:32…
[deleted]