Re: Early loading of microcode updates with all firmware

From	Paul Menzel <pmenzel@molgen.mpg.de>
Newsgroups	linux.kernel
Subject	Re: Early loading of microcode updates with all firmware
Date	2017-06-30 17:50 +0200
Message-ID	<tY6lb-7hu-13@gated-at.bofh.it> (permalink)
References	<tY1ER-4os-5@gated-at.bofh.it> <tY2rg-4Tg-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Dear Borislav,


On 06/30/17 13:37, Borislav Petkov wrote:

> On Fri, Jun 30, 2017 at 12:44:43PM +0200, Paul Menzel wrote:
>> But, the microcode is not updated. For example, I have to manually run the
>> command below.
> 
> Yes, you need something in userspace to trigger that reload.
> 
>> Reading the document, that method is not explicitly mentioned there, so I
>> guess it’s not supported.
> 
> Note the "early" in that file's name.
> 
> And that method is supported - it is the late loading method. I could
> rename that file to microcode.txt and document all the loading methods
> there. Here's a TODO list item...
> 
>> So two question. If I want to add it to the initramfs image, the document
>> says to prepend the updates. But I am unclear how to create `microcode.bin`
>> to contain all the files in `/lib/firmware/intel-ucode/`, and then the ones
>> for AMD devices. Do I just concatenate both?
> 
> Here's a script I'm using, it should make it all clear:
> 
> ---
> #!/bin/bash
> 
> if [ -z "$1" ]; then
>      echo "You need to supply an initrd file"
>      exit 1
> fi
> 
> INITRD="$1"
> 
> DSTDIR=kernel/x86/microcode
> TMPDIR=/tmp/initrd
> 
> rm -rf $TMPDIR
> 
> mkdir $TMPDIR
> cd $TMPDIR
> mkdir -p $DSTDIR
> 
> if [ -d /lib/firmware/amd-ucode ]; then
> 	cat /lib/firmware/amd-ucode/microcode_amd*.bin > $DSTDIR/AuthenticAMD.bin
> fi
> 
> if [ -d /lib/firmware/intel-ucode ]; then
> 	cat /lib/firmware/intel-ucode/* > $DSTDIR/GenuineIntel.bin
> fi
> 
> find . | cpio -o -H newc >../ucode.cpio
> cd ..
> mv $INITRD $INITRD.orig
> cat ucode.cpio $INITRD.orig > $INITRD
> 
> rm -rf $TMPDIR
> ---
> 
> You can adjust the regex selecting the Intel files to something more
> restrictive as you don't want to carry everything in your initrd. Not
> that putting every microcode file in the initrd doesn't work - it does
> just fine.
> 
>> Regarding the section *Builtin microcode*, it would be quite cumbersome to
>> list all the microcode files. It looks like wildcards like `*` are not
>> supported. At least the build breaks, if `intel-ucode/*` is used in the
>> prompt.
> 
> Yes, you need to list them one-by-one.
> 
> I wouldn't use that method though as it means you need to rebuild the
> kernel when there's a new microcode. So stick to the initrd instead.

Thank you for the quick and useful response. I got it working now.


Kind regards,

Paul

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Early loading of microcode updates with all firmware Paul Menzel <pmenzel@molgen.mpg.de> - 2017-06-30 12:50 +0200
  Re: Early loading of microcode updates with all firmware Borislav Petkov <bp@alien8.de> - 2017-06-30 13:40 +0200
    Re: Early loading of microcode updates with all firmware Paul Menzel <pmenzel@molgen.mpg.de> - 2017-06-30 17:50 +0200

csiph-web