LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 05-12-2018, 07:55 PM   #151
CTM
Member
 
Registered: Apr 2004
Distribution: Slackware
Posts: 301

Rep: Reputation: 279Reputation: 279Reputation: 279

Quote:
Originally Posted by kjhambrick View Post
I was not exactly sure what to do about the new intel-ucode-with-caveats/ directory but it is in the Package as /lib/firmware/intel-ucode-with-caveats/ if you want to use it.

In addition, the new Kernel Patches Directory is stored as /usr/doc/intel-microcode-20180425/linux-kernel-patches/
The firmware in intel-ucode-with-caveats/ is for a tiny number of Broadwell CPUs (certain Xeon E5 v4s are affected, AFAIK). The patches in linux-kernel-patches/ need to be applied to 4.4.x and 4.9.x kernel source trees (although apparently Intel is working on getting them backported) to prevent those CPUs from hanging when the firmware is uploaded. The kernel patches are otherwise unnecessary.
 
1 members found this post helpful.
Old 05-14-2018, 07:13 AM   #152
kjhambrick
Senior Member
 
Registered: Jul 2005
Location: Round Rock, TX
Distribution: Slackware64 14.2 + Multilib
Posts: 1,483

Rep: Reputation: 917Reputation: 917Reputation: 917Reputation: 917Reputation: 917Reputation: 917Reputation: 917Reputation: 917
Quote:
Originally Posted by CTM View Post
The firmware in intel-ucode-with-caveats/ is for a tiny number of Broadwell CPUs (certain Xeon E5 v4s are affected, AFAIK). The patches in linux-kernel-patches/ need to be applied to 4.4.x and 4.9.x kernel source trees (although apparently Intel is working on getting them backported) to prevent those CPUs from hanging when the firmware is uploaded. The kernel patches are otherwise unnecessary.
Thanks for the info CTM.

After building and installing intel-microcode.SlackBuild attached in the post above, you'll find two README files:
Code:
/usr/share/doc/intel-microcode-20180425/RELEASE_NOTE:
/usr/share/doc/intel-microcode-20180425/linux-kernel-patches/patch-readme
Reading these two files, the firmware for S-M-F == '06-4f-01' ( aka Xeon E5/E7 v4 and Core i7-69xx/68xx ) was moved from /lib/firmware/intel-ucode/ to /lib/firmware/intel-ucode-with-caveats/ with the 20180425 ucode update.

If you run one of these Skylake CPUs and you need to 'live load' the microcode for the processors and you're running a 4.4.y or 4.9.y Kernel, you'll need the kernel patches.

And as you said, these patches are being back-ported so the patches should be OBE at that point.

Or something like that ...

-- kjh

Last edited by kjhambrick; 05-14-2018 at 07:30 AM. Reason: added link to prior post
 
Old 04-16-2019, 03:46 AM   #153
teoberi
Member
 
Registered: Jan 2018
Location: Romania
Distribution: Slackware64-current (servers) / Ubuntu (workstations)
Posts: 92

Rep: Reputation: 34
Intel Page for Linux * Processor Microcode:
https://downloadcenter.intel.com/dow...le?product=873
Quote:
Version: Latest (Latest) Date: 8/7/2018
Quote:
Other Versions microcode-20190312
https://downloadmirror.intel.com/287...ode_readme.txt
What is this? Does anyone have more information?
 
Old 04-16-2019, 03:55 AM   #154
ponce
Senior Member
 
Registered: Aug 2004
Location: Pisa, Italy
Distribution: Slackware
Posts: 4,839

Rep: Reputation: Disabled
seems to be landed on debian but not adopted widely

https://repology.org/project/intel-microcode/packages

https://metadata.ftp-master.debian.o...o9+1_changelog

the fact that intel points for the latest version at 20180807 could mean that something might be wrong with the newer version but I hasn't been able to find no reports of this.
it might also mean that the new version hasn't been throughly tested but I haven't been able to find any information also in this sense...

Last edited by ponce; 04-16-2019 at 04:17 AM.
 
Old 04-16-2019, 04:39 AM   #155
teoberi
Member
 
Registered: Jan 2018
Location: Romania
Distribution: Slackware64-current (servers) / Ubuntu (workstations)
Posts: 92

Rep: Reputation: 34
Why is it not downloading from Intel servers but from GitHub?
It may be related to kernel 4.19.29 where a microcode update is announced.
https://cdn.kernel.org/pub/linux/ker...ngeLog-4.19.29
 
Old 04-21-2019, 03:19 AM   #156
teoberi
Member
 
Registered: Jan 2018
Location: Romania
Distribution: Slackware64-current (servers) / Ubuntu (workstations)
Posts: 92

Rep: Reputation: 34
The new Intel microcode-20190312 works well for a few days, even though I do not know exactly the answer to the previous questions.
 
1 members found this post helpful.
Old 04-26-2019, 08:50 AM   #157
igadoter
Senior Member
 
Registered: Sep 2006
Location: wroclaw, poland
Distribution: many, primary Slackware
Posts: 1,273
Blog Entries: 1

Rep: Reputation: Disabled
I think to recompile kernel for stable is ok - but what about -current? And please would someone be so kind to made some short summary of this thread - seems here are so many solutions of the problem stated I am completely lost - most promising for me looks what (resurrected) dark side of force proposed - I mean to concatenate initrd.gz - seems nice trick and sppose works in other situations - mhm I would really be interested to hear for what other purposes this trick can be used.
 
Old 04-27-2019, 02:30 PM   #158
AlleyTrotter
Member
 
Registered: Jun 2002
Location: Coal Township PA
Distribution: Slackware64-14.2 (5.2.2) UEFI enabled (LFS-8.4 when Slackware becomes too easy)
Posts: 539

Rep: Reputation: 198Reputation: 198
A different approach

Not the Slackware way, but seems easier to me.

http://linuxfromscratch.org/blfs/vie.../firmware.html

HTH
John

Actually its not the SBo way I guess
 
Old 04-30-2019, 09:00 AM   #159
Candelabrus
Member
 
Registered: Apr 2015
Location: Ponta Grossa - PR
Distribution: Slackware64
Posts: 135

Rep: Reputation: Disabled
Thanks for this thread, i used this method describe by BradPitt
https://www.linuxquestions.org/quest...ml#post5803641

I think worked, here my load using spectro script
According to the script i am not vulnerable at all
Code:
Spectre and Meltdown mitigation detection tool v0.40

Checking for vulnerabilities on current system
Kernel is Linux 5.0.10 #1 SMP Tue Apr 30 10:39:48 -03 2019 x86_64
CPU is Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available:  YES 
    * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)
  * Indirect Branch Prediction Barrier (IBPB)
    * PRED_CMD MSR is available:  YES 
    * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available:  YES 
    * CPU indicates STIBP capability:  YES  (Intel STIBP feature bit)
  * Speculative Store Bypass Disable (SSBD)
    * CPU indicates SSBD capability:  YES  (Intel SSBD)
  * L1 data cache invalidation
    * FLUSH_CMD MSR is available:  YES 
    * CPU indicates L1D flush capability:  YES  (L1D flush feature bit)
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO 
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO 
  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO 
  * CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO):  NO 
  * CPU/Hypervisor indicates L1D flushing is not necessary on this system:  NO 
  * Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA):  NO 
  * CPU supports Software Guard Extensions (SGX):  NO 
  * CPU microcode is known to cause stability problems:  NO  (model 0x3a family 0x6 stepping 0x9 ucode 0x20 cpuid 0x306a9)
  * CPU microcode is the latest known available version:  YES  (latest version is 0x20 dated 2018/04/10 according to builtin MCExtractor DB v96 - 2019/01/15)
* CPU vulnerability to the speculative execution attack variants
  * Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass):  YES 
  * Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES 
  * Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  YES 
  * Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read):  YES 
  * Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass):  YES 
  * Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  NO 
  * Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  YES 
  * Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  YES 

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface:  YES  (Mitigation: __user pointer sanitization)
* Kernel has array_index_mask_nospec:  YES  (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch:  NO 
* Kernel has mask_nospec64 (arm64):  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface:  YES  (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
* Mitigation 1
  * Kernel is compiled with IBRS support:  YES 
    * IBRS enabled and active:  YES  (for firmware code only)
  * Kernel is compiled with IBPB support:  YES 
    * IBPB enabled and active:  YES 
* Mitigation 2
  * Kernel has branch predictor hardening (arm):  NO 
  * Kernel compiled with retpoline option:  YES 
    * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
> STATUS:  NOT VULNERABLE  (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface:  YES  (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI):  YES 
  * PTI enabled and active:  YES 
  * Reduced performance impact of PTI:  YES  (CPU supports PCID, performance impact of PTI will be reduced)
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability:  YES 
> STATUS:  NOT VULNERABLE  (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface:  YES  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB):  YES  (found in /proc/self/status)
* SSB mitigation is enabled and active:  YES  (per-thread through prctl)
* SSB mitigation currently active for selected processes: readlink: falta operando
Tente "readlink --help" para mais informações.
basename: falta operando
Tente "basename --help" para mais informações.
 NO  (no process found using SSB mitigation through prctl)
> STATUS:  NOT VULNERABLE  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability:  N/A 
> STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface:  YES  (Mitigation: PTE Inversion)
* Kernel supports PTE inversion:  YES  (found in kernel image)
* PTE inversion enabled and active:  YES 
> STATUS:  NOT VULNERABLE  (Mitigation: PTE Inversion)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor:  NO 
* Mitigation 1 (KVM)
  * EPT is disabled:  NO 
* Mitigation 2
  * L1D flush is supported by kernel:  YES  (found flush_l1d in /proc/cpuinfo)
  * L1D flush enabled:  YES  (conditional flushes)
  * Hardware-backed L1D flush supported:  YES  (performance impact of the mitigation will be greatly reduced)
  * Hyper-Threading (SMT) is enabled:  YES 
> STATUS:  NOT VULNERABLE  (this system is not running a hypervisor)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK

Last edited by Candelabrus; 04-30-2019 at 09:04 AM.
 
Old 05-14-2019, 03:56 PM   #160
abga
Member
 
Registered: Jul 2017
Location: EU
Distribution: Slackware
Posts: 985

Rep: Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514
https://www.linuxquestions.org/quest...ml#post5995044
 
Old 05-14-2019, 10:07 PM   #161
abga
Member
 
Registered: Jul 2017
Location: EU
Distribution: Slackware
Posts: 985

Rep: Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514
On a Haswell U laptop (i3 - DELL) I tried the following:
- downloaded the latest Intel microcode pack:
https://github.com/intel/Intel-Linux...0190514.tar.gz
- unpacked the archive, got rid of the top level folder and repacked it into:
microcode-20190514.tgz
- used the Slackbuild form here:
http://www.slackbuilds.org/repositor...tel-microcode/
- changed in intel-microcode.SlackBuild
Code:
#from
VERSION=${VERSION:-20180807}
#to
VERSION=${VERSION:-20190514}
- build it & installed it & rebooted, only to find out that my CPU microcode wasn't updated, remained at its original revision=0x24 instead of updating to revision=0x25
- the release note form:
https://github.com/intel/Intel-Linux...0190514.tar.gz
contains:
Code:
HSW-U        C0/D0    6-45-1/72 00000024->00000025 Core Gen4
- and the guide, on page 9 - bottom, has my CPU listed with the new revision=0x25
https://www.intel.com/content/dam/ww...e_05132019.pdf
Code:
Haswell U
4th Generation Intel® Core™ 
Processor Family
Intel® Pentium® Processor Family
- well, either my CPU isn't yet supported/updated, this Intel microcode pack is still "beta" or ... I might have messed up something with the intel-microcode pack/SlackBuild. I double checked the last point and everything looks OK.

There's also a positive side to this, the latest spectre-meltdown-checker was happy to report that I'm "doomed" (never mind CVE-2018-3646)
https://github.com/speed47/spectre-meltdown-checker
Code:
CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* CPU supports the MD_CLEAR functionality:  NO
* Kernel supports using MD_CLEAR mitigation:  NO
> STATUS:  VULNERABLE  (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)

CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* CPU supports the MD_CLEAR functionality:  NO
* Kernel supports using MD_CLEAR mitigation:  NO
> STATUS:  VULNERABLE  (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* CPU supports the MD_CLEAR functionality:  NO
* Kernel supports using MD_CLEAR mitigation:  NO
> STATUS:  VULNERABLE  (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)

CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* CPU supports the MD_CLEAR functionality:  NO
* Kernel supports using MD_CLEAR mitigation:  NO
> STATUS:  VULNERABLE  (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:KO CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO
 
Old 05-14-2019, 10:27 PM   #162
AlleyTrotter
Member
 
Registered: Jun 2002
Location: Coal Township PA
Distribution: Slackware64-14.2 (5.2.2) UEFI enabled (LFS-8.4 when Slackware becomes too easy)
Posts: 539

Rep: Reputation: 198Reputation: 198
..................................

Last edited by AlleyTrotter; 05-14-2019 at 10:28 PM. Reason: my misque
 
Old 05-14-2019, 10:30 PM   #163
abga
Member
 
Registered: Jul 2017
Location: EU
Distribution: Slackware
Posts: 985

Rep: Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514
@AlleyTrotter
Thanks, that's the one I used. You actually quoted my link pointing to the same release
 
Old 05-15-2019, 01:48 AM   #164
Petri Kaukasoina
Member
 
Registered: Mar 2007
Posts: 408

Rep: Reputation: 259Reputation: 259Reputation: 259
Quote:
Originally Posted by abga View Post
- build it & installed it & rebooted, only to find out that my CPU microcode wasn't updated, remained at its original revision=0x24 instead of updating to revision=0x25
If you use lilo and load the microcode via its initrd= keyword, did you remember to run (mkinitrd and) lilo?

Last edited by Petri Kaukasoina; 05-15-2019 at 02:02 AM.
 
Old 05-15-2019, 12:27 PM   #165
abga
Member
 
Registered: Jul 2017
Location: EU
Distribution: Slackware
Posts: 985

Rep: Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514Reputation: 514
Quote:
Originally Posted by Petri Kaukasoina View Post
If you use lilo and load the microcode via its initrd= keyword, did you remember to run (mkinitrd and) lilo?
Thanks for the tip. I'm not using initrd and I checked if the microcode update driver was loaded on boot:
Code:
# dmesg | grep micro
[    3.680854] microcode: CPU0 sig=0x40651, pf=0x40, revision=0x24
[    3.681004] microcode: CPU1 sig=0x40651, pf=0x40, revision=0x24
[    3.681188] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
It's a Haswell i3-4005U DELL Laptop, kind of a test system / road warrior. Until now, DELL has always (promptly) published a BIOS update once Intel released their microcode. I still believe that there's actually no update for this CPU in Intel's latest microcode release ... will wait for DELL to confirm/infirm (BIOS update).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Is it possible to update intel microcode using kernel-huge and grub2, without initrd? lagavulin16 Slackware 5 01-03-2018 09:27 AM
intel-microcode-20170707 kjhambrick Slackware 1 07-15-2017 08:04 AM
Lenovo Thinkpad x220 - Proprietary Driver for Microcode for Intel processor? wh33t Linux - Hardware 2 06-15-2016 11:41 AM
intel-microcode error Soapm Linux - Newbie 3 06-25-2015 01:37 AM
Intel IA32 CPU microcode...What is it Jester888 Linux - General 1 02-08-2007 11:30 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 10:32 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration