[SOLVED] Should I use the intel-microcode driver?

[Kyowash]

Yesterday updates to the intel-microcode package were released to fix Spectre and Meltdown, but I don't use that driver. Should I start using it?

[Pjotr]

Yes.

If you have an Intel CPU, of course.

[Kyowash]

Yes.

If you have an Intel CPU, of course.

Yes, I have an Intel CPU. And what if performance is negatively affected? Would it be enough to disable it or does it update the version found in BIOS as well?

[Pjotr]

The BIOS isn't touched at all, so you can always revert this.

[Sir Charles]

I installed the Intel-microcode this morning and so far I haven't noticed any adversary effect on the performance of my computer, at least not with "naked eyes".

[michael louwe]

@ Kyowash, .......

...

.
Bear in mind that you should only install the new Intel microcode update if your Intel processor is 3rd-gen Haswell(= 2012) or newer.

Ubuntu has not been patched for the Spectre 2(CVE-2017-5715) bug yet, ie the IBRS and IBPB features. So, LM has to also received this patch together with the Intel microcode update before the mitigation can start to work, ie the 2 patches(= OS and CPU) work together.
... Depending on workload, there will be a performance hit, eg servers and heavy multi-tasking will be hit harder.

Ubuntu have only just released the kernel patch for the Meltdown bug(= KPTI feature)(CVE-2017-5754), eg kernel 4.4.108/109.

To uninstall the microcode, eg with a Live LM USB/DVD, please refer to this link ... https://www.howtoinstall.co/en/ubuntu/t ... ion=remove
To install the microcode ... https://www.howtoinstall.co/en/ubuntu/t ... -microcode

[BigEasy]

I installed the Intel-microcode this morning and so far I haven't noticed any adversary effect on the performance of my computer, at least not with "naked eyes".

"Installed" actually means that packet installation completed successfully (all files unpacked and copyed in appropriate directories) but doesn't means that microcode for your CPU became in use after that. Type:

Code: Select all

dmesg | grep microcode

and see.

[Sir Charles]

"Installed" actually means that packet installation completed successfully (all files unpacked and copyed in appropriate directories) but doesn't means that microcode for your CPU became in use after that. Type:

Code: Select all

dmesg | grep microcode

and see.

Code: Select all

dmesg | grep microcode
[    1.554170] microcode: sig=0x30678, pf=0x8, revision=0x831
[    1.554240] microcode: Microcode Update Driver: v2.2.

Does this mean that it is in use?

[BigEasy]

It means microcode was installed but not in use for your CPU. Same for me too.

[altair4]

https://www.bleepingcomputer.com/news/h ... e-updates/

[Pjotr]

It's a good idea to have it in (almost) any case, because Intel has promised to deliver new updates to it, which should fix Meltdown issues for CPU's up to 10 years old.

If you have it installed, you'll be notified automatically by Update Manager, whenever those new microcode updates arrive.

[michael louwe]

@ Marziano, .......

...

.
Your output likely means no new Intel microcode has been installed and applicable since purchase, ie the CPU is still running from microcode stored in BIOS firmware.
... Intel would likely not have supplied new and applicable Linux microcodes for older processors, eg the last applicable microcode update for Intel Core2Duo processors is dated 2010.

On my LM 17.3 box with Intel Core2Duo processor, Synaptic Package Manager is displaying the latest Intel microcode 20180108 which is inapplicable for my old processor. Pointless for me to install the Intel microcode 20180108.
... I will need to wait for Intel to release a newer Linux microcode which will patch my old Core2Duo processor, eg microcode 20180208(= date of release)

The Intel microcode update for Linux is usually only applicable to a few generations of processors, even though it is received by nearly all generations of Intel processors. According to Ubuntu, it is the responsibility of the users to verify that a newly released Intel microcode applies to their processors. There are tutorials on how to verify this.

[Kyowash]

@ Kyowash, .......

...

.
Bear in mind that you should only install the new Intel microcode update if your Intel processor is 3rd-gen Haswell(= 2012) or newer.

Ubuntu has not been patched for the Spectre 2(CVE-2017-5715) bug yet, ie the IBRS and IBPB features. So, LM has to also received this patch together with the Intel microcode update before the mitigation can start to work, ie the 2 patches(= OS and CPU) work together.
... Depending on workload, there will be a performance hit, eg servers and heavy multi-tasking will be hit harder.

Ubuntu have only just released the kernel patch for the Meltdown bug(= KPTI feature)(CVE-2017-5754), eg kernel 4.4.108/109.

To uninstall the microcode, eg with a Live LM USB/DVD, please refer to this link ... https://www.howtoinstall.co/en/ubuntu/t ... ion=remove
To install the microcode ... https://www.howtoinstall.co/en/ubuntu/t ... -microcode

But I'm not going to install it, it is updated automatically in the drivers administrator. Anyway this is the content of /proc/cpuinfo:

Code: Select all

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 60
model name	: Intel(R) Core(TM) i5-4460  CPU @ 3.20GHz
stepping	: 3
microcode	: 0x19
cpu MHz		: 3202.625
cache size	: 6144 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm invpcid_single kaiser tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida arat pln pts
bugs		:
bogomips	: 6385.42
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

processor	: 1
vendor_id	: GenuineIntel
cpu family	: 6
model		: 60
model name	: Intel(R) Core(TM) i5-4460  CPU @ 3.20GHz
stepping	: 3
microcode	: 0x19
cpu MHz		: 1600.125
cache size	: 6144 KB
physical id	: 0
siblings	: 4
core id		: 1
cpu cores	: 4
apicid		: 2
initial apicid	: 2
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm invpcid_single kaiser tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida arat pln pts
bugs		:
bogomips	: 6385.42
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

processor	: 2
vendor_id	: GenuineIntel
cpu family	: 6
model		: 60
model name	: Intel(R) Core(TM) i5-4460  CPU @ 3.20GHz
stepping	: 3
microcode	: 0x19
cpu MHz		: 1489.625
cache size	: 6144 KB
physical id	: 0
siblings	: 4
core id		: 2
cpu cores	: 4
apicid		: 4
initial apicid	: 4
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm invpcid_single kaiser tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida arat pln pts
bugs		:
bogomips	: 6385.42
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

processor	: 3
vendor_id	: GenuineIntel
cpu family	: 6
model		: 60
model name	: Intel(R) Core(TM) i5-4460  CPU @ 3.20GHz
stepping	: 3
microcode	: 0x19
cpu MHz		: 3398.750
cache size	: 6144 KB
physical id	: 0
siblings	: 4
core id		: 3
cpu cores	: 4
apicid		: 6
initial apicid	: 6
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm invpcid_single kaiser tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida arat pln pts
bugs		:
bogomips	: 6385.42
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

Can I use the driver?

[michael louwe]

@ Kyowash, .......

...

.
You have a 4th-gen Intel processor. So, the Intel microcode update is very likely applicable to your processor.

https://askubuntu.com/questions/545925/ ... e-properly [How to verify if there's a new microcode update for your processor (Intel)]

[Sir Charles]

@ Marziano, .......

...

.
Your output likely means no new Intel microcode has been installed and applicable since purchase, ie the CPU is still running from microcode stored in BIOS firmware.

.

In that case, what should I do? Should I uninstall it or just not bother, since it is not running anyway?
BTW, this is my cpu:
Intel(R) Celeron(R) CPU N2840 @ 2.16GHz

[Kyowash]

@ Kyowash, .......

.
You have a 4th-gen Intel processor. So, the Intel microcode update is very likely applicable to your processor.

https://askubuntu.com/questions/545925/ ... e-properly [How to verify if there's a new microcode update for your processor (Intel)]

Alright, in that case I'll use the microcode and if something is wrong I'll stop using it. Thank you all for your help and contribution.

[michael louwe]

@ Marziano, .......

...

.
The Intel Celeron N2840 is a low-budget processor released in 2014. Likely, Intel only patched for the Core i (i3, i5 and i7) line of processors for the initial microcode release.

[Sir Charles]

The Intel Celeron N2840 is a low-budget processor released in 2014. Likely, Intel only patched for the Core i (i3, i5 and i7) line of processors for the initial microcode release.

Yes it is, unfortunately! I was on the verge of getting me a new machine just one they before Meltspectre hit the world. Then I thought to wait and see the line up of 2018 and now everything is uncertain.