1

I am trying to manually update the microcode for the Intel i5-2410M.

Dell XPS 15z 2011 - Intel i5-2410M (Sandy bridge).

Ubuntu 18.04 (Debian) | Gnome | Grub2 | Systemd

I have installed some pre-packaged microcode from the Ubuntu repository, but I don't know if any of it applies to me:

apt install intel-microcode

dmsg | grep microcode

[ 0.000000] microcode: microcode updated early to revision 0x2d, date = 2018-02-07

[ 1.259590] microcode: sig=0x206a7, pf=0x10, revision=0x2d

[ 1.259643] microcode: Microcode Update Driver: v2.2.

Note that the date is February 7, 2018. Intel has a later release for the i5-2410M, April 25th 2018.

https://downloadcenter.intel.com/download/27776/Linux-Processor-Microcode-Data-File?product=52224


CVE-2018-3640 [rogue system register read] aka 'Variant 3a'

  • CPU microcode mitigates the vulnerability: NO

STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability)

How to fix: The microcode of your CPU needs to be upgraded to mitigate this vulnerability. This is usually done at boot time by your kernel (the upgrade is not persistent across reboots which is why it's done at each boot). If you're using a distro, make sure you are up to date, as microcode updates are usually shipped alongside with the distro kernel. Availability of a microcode update for you CPU model depends on your CPU vendor. You can usually find out online if a microcode update is available for your CPU by searching for your CPUID (indicated in the Hardware Check section). The microcode update is enough, there is no additional OS, kernel or software change needed.

CVE-2018-3639 [speculative store bypass] aka 'Variant 4'

  • Mitigated according to the /sys interface: NO (Vulnerable)

  • Kernel supports speculation store bypass: YES (found in /proc/self/status)

STATUS: VULNERABLE (Your CPU doesn't support SSBD)

How to fix: Your kernel is recent enough to use the CPU microcode features for mitigation, but your CPU microcode doesn't actually provide the necessary features for the kernel to use. The microcode of your CPU hence needs to be upgraded. This is usually done at boot time by your kernel (the upgrade is not persistent across reboots which is why it's done at each boot). If you're using a distro, make sure you are up to date, as microcode updates are usually shipped alongside with the distro kernel. Availability of a microcode update for you CPU model depends on your CPU vendor. You can usually find out online if a microcode update is available for your CPU by searching for your CPUID (indicated in the Hardware Check section).


» grep . /sys/devices/system/cpu/vulnerabilities/*

/sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI

/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Vulnerable

/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user pointer sanitization

/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB, IBRS_FW

Could someone please provide a breadcrumb for what I should researching, I am stuck pretty good right now. I appreciate your time.

0

Short answer: you have the most recent version. That download has microcode updates for many CPUs. At least one got updated but it wasn't for your CPU.

Details:

Note microcode sig is 0x206a7 revision 2d. Download the microcode updates and untar them. Look in the file called list for a line with 06-2a-07. (Why the numbers are swapped and zero padded is beyond me.)

06-2a-07/00000012       0000002d        2018-02-07

Thus you have the latest version.

You'd need to supply your OS but at least with Gentoo updating microcode is easy. You make an initramfs with the microcode via:

iucode_tool -S --write-earlyfw=/boot/early_ucode.cpio /lib/firmware/intel-ucode/*

Gentoo has patched grub to automatically include this initramfs.

If you want to examine this for your OS: find whatever initramfs your system uses. Extract it with cpio -idv < foo.img. The microcode will be called kernel/x86/microcode/GenuineIntel.bin You can then check it against what was in the tarball. For example:

md5sum kernel/x86/microcode/GenuineIntel.bin
63b77e80b39b5a3ed81a30682ef2c5ab  kernel/x86/microcode/GenuineIntel.bin

From the intel-ucode directory created when you extracted the tarball:

md5sum * | grep 63b77e80b39b5a3ed81a30682ef2c5ab
63b77e80b39b5a3ed81a30682ef2c5ab  06-2a-07
  • In the list file, what exactly am I looking at? Entry "06-2a-07/00000012" is dated "2018-02-07". Above and below that entry are newer and later dates. Is it outlining update dates per section of microcode, or per processor? – Evan Jun 1 '18 at 18:36
  • It is per processor. Note that I could find no official documentation on this. It is only based on my exploration. – Mark Wagner Jun 1 '18 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.