CPU Microcode: Difference between revisions

From Alpine Linux
m (→‎Obtaining microcode updates on Alpine: Added warning for Intel Atom PSE errata: This can only be fixed via firmware update)
 
(3 intermediate revisions by the same user not shown)
Line 7: Line 7:
== Obtaining microcode updates on Alpine ==
== Obtaining microcode updates on Alpine ==


{{Warning| Intel Atom users with a "PSE erratum" message in dmesg: The microcode update can only be applied by BIOS or UEFI update, not via initrd!}}
{{Warning| Certain Intel CPUs, such Intel Atom with PSE errata, and Intel Haswell + Broadwell with TSX errata, can only be fixed via BIOS or UEFI update (which includes microcode); if you are using one of these CPUs, please do not use the instructions below}}


On Alpine Linux, CPU microcode is loaded early via initrd images, premade images are available from packages:
On Alpine Linux, CPU microcode is loaded early via initrd images, premade images are available from packages:
Line 17: Line 17:
{{cmd|apk add {{pkg|intel-ucode}}}}
{{cmd|apk add {{pkg|intel-ucode}}}}


If you are using syslinux or grub in a typical setup, the packages will automatically append your extlinux.conf or grub.conf file and merely a reboot will be required to run the new microcode. Users using UEFI's built-in boot manager will have to use efibootmgr to add a second initrd line.
If you are using syslinux or grub in a typical setup, the packages will automatically append your {{path|extlinux.conf}} or {{path|grub.conf}} file and merely a reboot will be required to run the new microcode. Users using UEFI's built-in boot manager will have to use efibootmgr to add a second initrd line. Likewise if you are using the limine bootoader will need to add a 2nd MODULE_PATH directive in {{path|limine.cfg}} pointing to the ucode file.


== Verifying that the microcode image has loaded ==
== Verifying that the microcode image has loaded ==
Line 24: Line 24:
If the microcode initrd image was loaded, the microcode update driver will print a signature and revision
If the microcode initrd image was loaded, the microcode update driver will print a signature and revision


Example for Intel:
{{codeline|[ 2.198775 ] microcode: sig=0x6fd, pf=0x80, revision=0xa4}}
{{codeline|[ 2.198775 ] microcode: sig=0x6fd, pf=0x80, revision=0xa4}}
{{Todo|Example needed for AMD and VIA CPUs, they seem to print slightly differently.}}
[[Category:Security]]

Latest revision as of 16:50, 31 August 2023

CPU microcode is a form of firmware that controls the processor's internals.

In modern processors, the microcode handles execution of complex and highly specialized instructions. Parts of the microcode also act as firmware for the processor's embedded controllers, and it is even used to fix or to mitigate processor design/implementation errata/bugs. Given the complexity of modern processors, a CPU may have over a hundred such errata.

Recently, microcode updates have become mandatory for security due to side-channel attacks against CPUs.

Obtaining microcode updates on Alpine

Warning: Certain Intel CPUs, such Intel Atom with PSE errata, and Intel Haswell + Broadwell with TSX errata, can only be fixed via BIOS or UEFI update (which includes microcode); if you are using one of these CPUs, please do not use the instructions below


On Alpine Linux, CPU microcode is loaded early via initrd images, premade images are available from packages:

To obtain the microcode update package for AMD processors:

apk add amd-ucode

To obtain the microcode update package for Intel processors:

apk add intel-ucode

If you are using syslinux or grub in a typical setup, the packages will automatically append your extlinux.conf or grub.conf file and merely a reboot will be required to run the new microcode. Users using UEFI's built-in boot manager will have to use efibootmgr to add a second initrd line. Likewise if you are using the limine bootoader will need to add a 2nd MODULE_PATH directive in limine.cfg pointing to the ucode file.

Verifying that the microcode image has loaded

Run the command:

dmesg | grep microcode

If the microcode initrd image was loaded, the microcode update driver will print a signature and revision

Example for Intel: [ 2.198775 ] microcode: sig=0x6fd, pf=0x80, revision=0xa4

Todo: Example needed for AMD and VIA CPUs, they seem to print slightly differently.