Intel-microcode open source. Really? Where is it?

[rik_rs]

Running the driver manager of Mint, I can read
intel-microcode (open-source)
Question: how Mint manages to have the intel microcode in source format? Can I see it?

The only intel microcode I know is this one
https://downloadcenter.intel.com/downlo ... -Data-File
and the only "open" I see is that I can "open" the zip and the binary files with ghex

This gives me the weird idea, just a glimpse, that Mint uses "Open source" in spite of "readable unkwnon binary"... but surely there is another reason...

[silfox2000]

Well, if it is open source, the license agreement sounds strange:

3. You may not reverse engineer, decompile, or disassemble the Software.

[now3by]

Spot on.
Intel microcode for sure it is Intel proprietary and encrypted.
It can contain anything Intel want including a bonus backdoor.

[Hoser Rob]

Running the driver manager of Mint, I can read
intel-microcode (open-source)
Question: how Mint manages to have the intel microcode in source format? Can I see it?...

Could you understand it???

[now3by]

Some people still understand ASM, this is not the point.

~28 years ago I used to program in ASM self-replicate code that changed his form; compiled working code had final size under 2Kb.
Have a look at microcode length, it size is from 2Kb to 100Kb... this is huge for pure ASM code just to correct something in original CPU code.

[rik_rs]

~28 years ago I used to program in ASM self-replicate code that changed his form; compiled working code had final size under 2Kb.
Have a look at microcode length, it size is from 2Kb to 100Kb... this is huge for pure ASM code just to correct something in original CPU code.

I have worked in assembler some decades ago, and the thing you are saying is the same I thought when I saw the file that is injected into the BIOS. Such file is 101062 lines, 4 bytes per row, so it's around 400kB of hex. When I was young, 400kB used to be an operating system!

Such file can be injected into the system via the driver manager or by hand
dd if=microcode.dat of=/dev/cpu/microcode bs=1M

However the main point is,
unless Mint can prove to have the source code of such intel-firmware mentioned in the driver manager, the "Open source" indication should be removed.
I suppose that is marked "Open source" because the numbers are in a text file... but that's not open source, otherwise hexdump win.exe > win.txt would make Windows open source.

By my understanding:
- the intel-firmware not only is not open source
- not only their license says that you can redistribute provided you DO NOT modify a single byte
- but it's also DIGITALLY SIGNED with a private key that only the manufacturer has (Intel), so even if I want to change such code FOR MYSELF before injecting it into the BIOS, my code will not work.

It's not by chance that Debian has such stuff into the NON-FREE repo.
https://packages.debian.org/search?keyw ... -microcode
and any user has at least to make the effort to set

Code: Select all

deb http://security.debian.org/ jessie/updates main contrib non-free
deb-src http://security.debian.org/ jessie/updates main contrib non-free
deb  http://deb.debian.org/debian jessie main contrib non-free
deb-src  http://deb.debian.org/debian jessie main contrib non-free

so it's impossibile to install such proprietary code by error.

Moreover, Debian also states:

The CPU-vendor-provided "opaque" update data itself, however, is non-free, and its contents are unknown to Debian.

(meaning: install at your risk and backdoor included just like Windows).

Now, I know the Mint distro doesn't care much about open source compared to other distros like Debian or FSF approved distros, however when I see in the driver manager intel-microcode (open-source), forgive me but I think it is too much!

[rik_rs]

Just to be more clear of what I'm talking about: the "Intel-microcode is tagged open source just like a real open source "Nouveau driver". My first post was ironic because I know not Mint nor Ubuntu have developed by themselves an intel-microcode, and cannot another firmware because the versione is the same of the Intel one.

firmware-intel.png

Moreover the microcode is not even assembler code but a secret kind of encrypted code.
The volume 3a of the Intel 64 and IA-32 Architectures Software Developer’s Manual explains only how to inject the code in section 9.11 "microcode update facilities" but it also states that the actual microcode is "encrypted" and full of checksums.

Even we could manage to decrypt such code, it's not assembler code, it's custom unknown code.
That's why sounds hilarious to call it "Open source": it just the extreme opposite. It can't exist anything more closed source than that!

[catweazel]

When I was young, 400kB used to be an operating system!

When I was young, the operating system consumed a whopping 3kB. User space was 1kB, and words were 4 bytes.

[rik_rs]

When I was young, the operating system consumed a whopping 3kB. User space was 1kB, and words were 4 bytes.

[rik_rs]

Same problem on Ubuntu (Xubuntu). Maybe Mint inherit this scam from Ubuntu?

Xubuntu_2018-01-23_09-18-40.png

[Schallaven]

This "open source" refers to the Microcode Update Driver, which is indeed open source (https://github.com/torvalds/linux/blob/ ... de/intel.c). The microcode itself is not; could be better labelled, indeed.

[rik_rs]

Let's say we can simply remove "Open source". The way used to transport bytes means nothing.