<h1 id="intel-processor-microcode-package-for-linux">Intel Processor
Microcode Package for Linux</h1>
<h2 id="about">About</h2>
<p>The Intel Processor Microcode Update (MCU) Package provides a
mechanism to release updates for security advisories and functional
issues, including errata. In addition, MCUs are responsible for starting
the SGX enclave (on processors that support the SGX feature),
implementing complex behaviors (such as assists), and more. The
preferred method to apply MCUs is using the system BIOS. For a subset of
Intel's processors, the MCU can also be updated at runtime using the
operating system. The Intel Microcode Package shared here contains
updates for those processors that support OS loading of MCUs.</p>
<h2 id="why-update-the-microcode">Why update the microcode?</h2>
<p>Updating your microcode can help to mitigate certain potential
security vulnerabilities in CPUs as well as address certain functional
issues that could, for example, result in unpredictable system behavior
such as hangs, crashes, unexpected reboots, data errors, etc. To learn
more about applying MCUs to an Intel processor, see <a
href="https://software.intel.com/security-software-guidance/insights/microcode-update-guidance">Microcode
Update Guidance</a>.</p>
<h2 id="loading-microcode-updates">Loading microcode updates</h2>
<p>This package is provided for Linux distributors for inclusion in
their OS releases. Intel recommends obtaining the latest MCUs using the
OS vendor update mechanism. A good starting point is <a
href="https://software.intel.com/security-software-guidance/insights/guidance-system-administrators-mitigate-transient-execution-side-channel-issues">OS
and Software Vendor</a>. Expert users can update their microcode
directly outside the OS vendor mechanism. However, this method is
complex and could result in errors if performed incorrectly. Such errors
could include but are not limited to system freezes, inability to boot,
performance impacts, logical processors loading different updates, and
some updates not taking effect. As a result, this method should be
attempted by expert users only.</p>
<p>MCUs are best loaded from the BIOS. Certain MCUs must only be applied
from the BIOS. Such MCUs are never packaged in this package since they
are not appropriate for OS distribution. An OEM may receive microcode
update packages that are a superset of what is contained in this package
for inclusion in a BIOS.</p>
<p>OS vendors may choose to provide an MCU that the kernel can consume
for early loading. For example, Linux can apply an MCU very early in the
kernel boot sequence. In situations where a BIOS update isn't available,
early loading is the next best alternative to updating processor
microcode. <strong>Microcode states are reset on a power reset, hence
its required that the MCU be loaded every time during boot
process.</strong></p>
<h2 id="recommendation">Recommendation</h2>
<p>Using the initrd method to load an MCU is recommended as this method
will load the MCU at the earliest time for the most coverage. Systems
that cannot tolerate downtime may use the late-load method to update a
running system without a reboot.</p>
<h2
id="about-processor-signature-family-model-stepping-and-platform-id">About
Processor Signature, Family, Model, Stepping and Platform ID</h2>
<p>The Processor Signature is a number identifying the model and version
of an Intel processor. It can be obtained using the <em>CPUID
instruction</em>, via the command <em>lscpu</em>, or from the content of
<em>/proc/cpuinfo</em>. It's usually presented as 3 fields: Family,
Model, and Stepping.</p>
<p>For example, if a processor returns a value of "0x000906eb" from the
<em>CPUID instruction</em>:</p>
<table>
<thead>
<tr class="header">
<th style="text-align: left;">Reserved</th>
<th style="text-align: left;">Extended Family</th>
<th style="text-align: left;">Extended Model</th>
<th style="text-align: left;">Reserved</th>
<th style="text-align: left;">Processor Type</th>
<th style="text-align: left;">Family Code</th>
<th style="text-align: left;">Model Number</th>
<th style="text-align: left;">Stepping ID</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td style="text-align: left;">31:28</td>
<td style="text-align: left;">27:20</td>
<td style="text-align: left;">19:16</td>
<td style="text-align: left;">15:14</td>
<td style="text-align: left;">13:12</td>
<td style="text-align: left;">11:8</td>
<td style="text-align: left;">7:4</td>
<td style="text-align: left;">3:0</td>
</tr>
<tr class="even">
<td style="text-align: left;">xxxx</td>
<td style="text-align: left;">00000000b</td>
<td style="text-align: left;">1001b</td>
<td style="text-align: left;">xx</td>
<td style="text-align: left;">00b</td>
<td style="text-align: left;">0110b</td>
<td style="text-align: left;">1110b</td>
<td style="text-align: left;">1011b</td>
</tr>
</tbody>
</table>
<p>The corresponding Linux formatted file name will be "06-9e-0b",
where:</p>
<ul>
<li>Extended Family + Family = 0x06</li>
<li>Extended Model + Model Number = 0x9e</li>
<li>Stepping ID = 0xb</li>
</ul>
<p>A processor may be implemented for multiple platform types. Intel
processors have a 3bit Platform ID field in MSR(17H) that specifies the
platform type for up to 8 types. An MCU file for a specified processor
model may support multiple platforms. The Platform ID(s) supported by an
MCU is an 8bit mask where each set bit indicates a platform type that
the MCU supports. The Platform ID of a processor can be read in Linux
using rdmsr from <a
href="https://github.com/intel/msr-tools">msr-tools</a>.</p>
<h2 id="microcode-update-instructions">Microcode update
instructions</h2>
<p>The <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/intel-ucode">intel-ucode</a>
directory contains binary MCU files named in the
<code>family-model-stepping</code> format. This file format is supported
by most modern Linux distributions. It's generally located in the
/lib/firmware directory and can be updated through the microcode reload
interface following the late-load update instructions below.</p>
<h3 id="early-load-update">Early-load update</h3>
<p>To update early loading initrd, consult your Linux distribution on
how to package MCU files for early loading. Some distributions use
<code>update-initramfs</code> or <code>dracut</code>. Use the OS vendors
recommended method to help ensure that the MCU file is updated for early
loading before attempting the late-load procedure below.</p>
<h3 id="late-load-update">Late-load update</h3>
<p>To update the intel-ucode package to the system:</p>
<ol type="1">
<li>Ensure the existence of
<code>/sys/devices/system/cpu/microcode/reload</code></li>
<li>Download the latest microcode firmware</br>
<code>$ git clone https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files.git</code>
or</br>
<code>$ wget https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/archive/main.zip</code></li>
<li>Copy <code>intel-ucode</code> directory to
<code>/lib/firmware</code>, overwriting the files in
/lib/firmware/intel-ucode/</li>
<li>Write the reload interface to 1 to reload the microcode files,
e.g.</br>
<code>$ echo 1 &gt; /sys/devices/system/cpu/microcode/reload</code></br>
Microcode updates will be applied automatically without rebooting the
system.</li>
<li>Update an existing initramfs so that next time it gets loaded via
kernel:</br> <code>$ sudo update-initramfs -u</code></br>
<code>$ sudo reboot</code></li>
<li>Verify that the microcode was updated on boot or reloaded by echo
command:</br> <code>$ dmesg | grep microcode</code> or</br>
<code>$ cat /proc/cpuinfo | grep microcode | sort | uniq</code></li>
</ol>
<p>If you are using the OS vendor method to apply an MCU, the above
steps may have been done automatically during the update process.</p>
<p>The <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/intel-ucode-with-caveats">intel-ucode-with-caveats</a>
directory contains MCUs that need special handling. The BDX-ML MCU is
provided in this directory because it requires special commits in the
Linux kernel otherwise updating it might result in unexpected system
behavior. OS vendors must ensure that the late loader patches (provided
in <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/linux-kernel-patches">linux-kernel-patches</a>)
are included in the distribution before packaging the BDX-ML MCU for
late-loading.</p>
<p>The <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/linux-kernel-patches">linux-kernel-patches</a>
directory consists of kernel patches that address various issues related
to applying MCUs.</p>
<h2 id="notes">Notes</h2>
<ul>
<li>You can only update to a higher MCU version (downgrade is not
possible with the provided instructions)</li>
<li>To calculate Family-Model-Stepping, use Linux command:</br>
<code>$ printf "%x\n" &lt;number_to_convert_to_hex&gt;</code></li>
<li>There are multiple ways to check the MCU version number BEFORE
update. After cloning this Intel Microcode update repo , run the
following:
<ul>
<li><code>$ iucode_tool -l intel-ucode | grep -wF sig</code> (<a
href="https://gitlab.com/iucode-tool/iucode-tool/-/wikis/home">iucode_tool</a>
package is required)</li>
<li><code>$ od -t x4 &lt;Family-Model-Stepping&gt;</code> will read the
first 16 bytes of the microcode binary header specified in
&lt;Family-Model-Stepping&gt;. The third block is the microcode version.
For example: <code>$ od -t x4 06-55-04</code></br>
<code>0000000 00000001 *02000065* 09052019 00050654</code></li>
</ul></li>
</ul>
<h2 id="license">License</h2>
<p>See the <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/license">license</a>
file for details.</p>
<h2 id="security-policy">Security Policy</h2>
<p>See the <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/security.md">security.md</a>
file for details.</p>
<h2 id="release-note">Release Note</h2>
<p>See the <a
href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/releasenote.md">releasenote.md</a>
file for details.</p>
<h2 id="disclaimers">Disclaimers</h2>
<p>Intel technologies’ features and benefits depend on system
configuration and may require enabled hardware, software, or service
activation. Performance varies depending on system configuration. Check
with your system manufacturer or retailer or learn more at <a
href="https://www.intel.com"><span>www.intel.com</span></a>.</p>
<p>No product or component can be absolutely secure.</p>
<p>All information provided here is subject to change without notice.
Contact your Intel representative to obtain the latest Intel product
specifications and roadmaps.</p>
<p>The products and services described may contain defects or errors
known as errata which may cause deviations from published
specifications. Current characterized errata are available on
request.</p>
<p>Intel provides these materials as-is, with no express or implied
warranties.</p>
<p>© Intel Corporation. Intel, the Intel logo, and other Intel marks are
trademarks of Intel Corporation or its subsidiaries.</p>
<p>*Other names and brands may be claimed as the property of others.</p>
