Microcode patch not complete with kernel 6

sidamos · Apprentice Joined: 16 Dec 2007 Posts: 246

I have 2 Core i5 systems (one older) that I wanted to update from kernel 5.15.88 to 6.1.12 but the newer one won't boot with kernel 6 and my .config. Only 1 page of text and then dark screen.

So I decided to start with a fresh .config for that system since mine is from kernel 2 or 3. Deleted my .config, also in the kernel config directory, and genkernel created a new one for me.
And the system boots nicely with the standard genkernel .config and kernel 6. So far, so good.

Then I thought, I should check about the microcode patches. I always generate them fresh before building a kernel. And now I come to my question.

The i5-3470S is the one that needed a fresh .config.

i5-3470S, 5.15.88, my .config:
# dmesg | grep microcode
[ 0.244887] microcode: sig=0x306a9, pf=0x2, revision=0x21
[ 0.244978] microcode: Microcode Update Driver: v2.2.

i5-3470S, 6.1.12, standard .config:
# dmesg | grep microcode
[ 0.000000] microcode: microcode updated early to revision 0x21, date = 2019-02-13
[ 0.131220] SRBDS: Vulnerable: No microcode
[ 1.394739] microcode: sig=0x306a9, pf=0x2, revision=0x21
[ 1.394813] microcode: Microcode Update Driver: v2.2.

i5-2500K, 6.1.12, my .config:
# dmesg | grep microcode
[ 0.772499] microcode: sig=0x206a7, pf=0x2, revision=0x2f
[ 0.772608] microcode: Microcode Update Driver: v2.2.

So, it looks like the i5-3470S, with the genkernel standard .config and kernel 6 is not fully patched anymore. Although it is using the same microcode patch version as before with kernel 5.

The microcode settings in the .config are set to "y", only the late loading one is not. But that is the same for both systems.

Anyone any idea why the i5-3470S with kernel 6 is not fully patched anymore?

Thanks!

NeddySeagoon · Posted: Sat Feb 18, 2023 1:16 pm Post subject:

sidamos,

Only early microcode updating is supported now.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

sidamos · Apprentice Joined: 16 Dec 2007 Posts: 246

Thanks for the super fast response!

So, I can't do anything.

I wonder why I do not have the same issue with the other system. The other system also does not say "microcode updated early".

NeddySeagoon · Posted: Sat Feb 18, 2023 1:32 pm Post subject:

sidamos,

You can use early microcode loading.
Build the microcode into the kernel binary. That works, its what I do.

I'm not sure if making the microcode its own initrd works any more. It used to, then you could load several initrds.
I don't know if that counts as early or late microcode loading.

There are several versions of the microcode on your system.
1. The one built into the CPU.
2. The version in your BIOS (it can update the microcode too).
3. The version that you provide for the kernel to use.

If the microrode is already up to date by the time the kernel checks, there is nothing for it to do.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

sidamos · Apprentice Joined: 16 Dec 2007 Posts: 246

The "i5-3470S, 6.1.12, standard .config" already says "microcode updated early".

But still the SRBDS issue is not patched. Maybe that is just like it is and nothing I can do about for that issue and that CPU with kernel 6.

The other system does not say "microcode updated early", so appears to still use initrd. But it still has no SRBDS issue. Maybe because that issue does not exist for that CPU.

At least that is what I would conclude. But I cannot prove it because the i5-3470S does not boot with kernel 6 and my old .config.

NeddySeagoon · Posted: Sat Feb 18, 2023 2:52 pm Post subject:

sidamos,

Check the newest microcode for your CPU. The method is correct.
If that's in use, you need to update the microcode.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

sidamos · Apprentice Joined: 16 Dec 2007 Posts: 246

This doc decribes pretty much how I do it. And I have sys-firmware/intel-microcode-20221108_p20221102 installed.

Also:
iucode_tool -S -l /lib/firmware/intel-ucode/*
[...]
selected microcodes:
109/001: sig 0x000306a0, pf_mask 0x12, 2011-04-07, rev 0x0007, size 6144
110/001: sig 0x000306a2, pf_mask 0x12, 2011-07-25, rev 0x000c, size 11264
111/001: sig 0x000306a4, pf_mask 0x12, 2011-09-08, rev 0x0007, size 9216
112/001: sig 0x000306a5, pf_mask 0x12, 2011-11-10, rev 0x0009, size 10240
113/001: sig 0x000306a6, pf_mask 0x12, 2011-11-14, rev 0x0004, size 8192
114/001: sig 0x000306a8, pf_mask 0x12, 2012-02-20, rev 0x0010, size 10240
115/001: sig 0x000306a9, pf_mask 0x12, 2019-02-13, rev 0x0021, size 14336

So, looks like rev 0x21 is the most recent one and that is the one that is being used for my system, according to dmesg and /proc/cpuinfo.

Seems like there just is not yet a patch for the SRBDS issue. Maybe it is a new issue for that CPU and kernel 6.

NeddySeagoon · Posted: Sat Feb 18, 2023 3:25 pm Post subject:

sidamos

intel-microcode-20230214_p20230212 is in ~arch.
Looking to see if it has a more recent microcode for your CPU is free.

If there is a new microcode, it's worth seeing what your search engine of choice says about it.
Lack of bad news is a good sign.

sidamos · Apprentice Joined: 16 Dec 2007 Posts: 246

Thanks for the hint. I installed the new firmware package. But there isn't a newer patch level for my CPU. At least I know now that I cannot do more. :-)