How to update/install microcode downloaded from Intel site $ ls -l /sys/devices/system/cpu/microcode/reload. ... $ sudo cp -v intel-ucode/* /lib/firmware/intel-ucode/ ... # echo command 1 > /sys/devices/system/cpu/microcode/reload. ... $ sudo update-initramfs -u. ... # dmesg | grep microcode. Nov 20, 2023

Re: Which intel-ucode file do I need? (2024)

Thanks for the reply, cowbat. I found a script for checking for CPU vulnerabilities. This is the GitHub repo for the script:

https://github.com/speed47/spectre-meltdown-checker/blob/master/FAQ.md

I ran the script. The result is lengthy.

The TL;DR is that there seem to be some vulnerabilities that could be addressed by an update to microcode.

While I'd like to apply a patch due the apparent vulnerabilities, some of the reading I did about doing so advised against messing with microcode on one's own. I'm no guru and I've never tried to patch microcode before, thus I'm hesitant. I will try to see if there has been some kind of patch provided by my distro in the last couple of years.

This is the script's output:

Spectre and Meltdown mitigation detection tool v0.46+

Checking for vulnerabilities on current system
Kernel is [35mLinux 5.15.145 #1 SMP PREEMPT Sun Dec 24 00:07:06 CST 2023 x86_64[0m
CPU is [35mIntel(R) Core(TM) i7-8550U CPU @ 1.80GHz[0m

[1;34mHardware check[0m
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: [42m[30m YES [0m
* CPU indicates IBRS capability: [42m[30m YES [0m (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* CPU indicates IBPB capability: [42m[30m YES [0m (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: [42m[30m YES [0m
* CPU indicates STIBP capability: [42m[30m YES [0m (Intel STIBP feature bit)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: [42m[30m YES [0m (Intel SSBD)
* L1 data cache invalidation
* CPU indicates L1D flush capability: [42m[30m YES [0m (L1D flush feature bit)
* Microarchitectural Data Sampling
* VERW instruction is available: [43m[30m NO [0m
* Indirect Branch Predictor Controls
* Indirect Predictor Disable feature is available: [43m[30m NO [0m
* Bottomless RSB Disable feature is available: [43m[30m NO [0m
* BHB-Focused Indirect Predictor Disable feature is available: [43m[30m NO [0m
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: [43m[30m NO [0m
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: [43m[30m NO [0m
* CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): [43m[30m NO [0m
* CPU explicitly indicates not being affected by Variant 4 (SSB_NO): [43m[30m NO [0m
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: [43m[30m NO [0m
* Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): [44m[30m NO [0m
* CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): [43m[30m NO [0m
* CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): [43m[30m NO [0m
* CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): [43m[30m NO [0m
* CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): [43m[30m NO [0m
* CPU explicitly indicates being affected by GDS and having mitigation control (GDS_CTRL): [44m[30m NO [0m
* CPU explicitly indicates not being affected by GDS (GDS_NO): [43m[30m NO [0m
* CPU supports Transactional Synchronization Extensions (TSX): [43m[30m NO [0m
* CPU supports Software Guard Extensions (SGX): [44m[30m YES [0m
* CPU supports Special Register Buffer Data Sampling (SRBDS): [42m[30m NO [0m
* CPU microcode is known to cause stability problems: [44m[30m NO [0m (family 0x6 model 0x8e stepping 0xa ucode 0x9a cpuid 0x806ea pfid 0x1)
* CPU microcode is the latest known available version: [44m[30m UNKNOWN [0m (latest microcode version for your CPU model is unknown)
* CPU vulnerability to the speculative execution attack variants
* Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): [43m[30m YES [0m
* Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): [43m[30m YES [0m
* Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): [43m[30m YES [0m
* Affected by CVE-2018-3640 (Variant 3a, rogue system register read): [43m[30m YES [0m
* Affected by CVE-2018-3639 (Variant 4, speculative store bypass): [43m[30m YES [0m
* Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): [43m[30m YES [0m
* Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): [43m[30m YES [0m
* Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): [43m[30m YES [0m
* Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): [43m[30m YES [0m
* Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): [43m[30m YES [0m
* Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): [43m[30m YES [0m
* Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): [43m[30m YES [0m
* Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): [43m[30m YES [0m
* Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): [43m[30m YES [0m
* Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): [43m[30m YES [0m
* Affected by CVE-2023-20593 (Zenbleed, cross-process information leak): [42m[30m NO [0m
* Affected by CVE-2022-40982 (Downfall, gather data sampling (GDS)): [43m[30m YES [0m
* Affected by CVE-2023-20569 (Inception, return address security (RAS)): [42m[30m NO [0m
* Affected by CVE-2023-23583 (Reptar, redundant prefix issue): [42m[30m NO [0m

[1;34mCVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
* Kernel has array_index_mask_nospec: [42m[30m YES [0m (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: [43m[30m NO [0m
* Kernel has mask_nospec64 (arm64): [43m[30m NO [0m
* Kernel has array_index_nospec (arm64): [43m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)

[1;34mCVE-2017-5715 aka 'Spectre Variant 2, branch target injection'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: IBRS, IBPB: conditional, STIBP: conditional, RSB filling, PBRSB-eIBRS: Not affected)
* Mitigation 1
* Kernel is compiled with IBRS support: [42m[30m YES [0m
* IBRS enabled and active: [42m[30m YES [0m
* Kernel is compiled with IBPB support: [42m[30m YES [0m
* IBPB enabled and active: [42m[30m YES [0m
* Mitigation 2
* Kernel has branch predictor hardening (arm): [43m[30m NO [0m
* Kernel compiled with retpoline option: [42m[30m YES [0m
* Kernel supports RSB filling: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (IBRS + IBPB are mitigating the vulnerability)

[1;34mCVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): [42m[30m YES [0m
* PTI enabled and active: [42m[30m YES [0m
* Reduced performance impact of PTI: [42m[30m YES [0m (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: [44m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: PTI)

[1;34mCVE-2018-3640 aka 'Variant 3a, rogue system register read'[0m
* CPU microcode mitigates the vulnerability: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU microcode mitigates the vulnerability)

[1;34mCVE-2018-3639 aka 'Variant 4, speculative store bypass'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB): [42m[30m YES [0m (found in /proc/self/status)
* SSB mitigation is enabled and active: [42m[30m YES [0m (per-thread through prctl)
* SSB mitigation currently active for selected processes: [42m[30m YES [0m (dhcpcd firefox-bin)
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

[1;34mCVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'[0m
* CPU microcode mitigates the vulnerability: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU microcode mitigates the vulnerability)

[1;34mCVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
* Kernel supports PTE inversion: [42m[30m YES [0m (found in kernel image)
* PTE inversion enabled and active: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)

[1;34mCVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'[0m
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor: [42m[30m NO [0m
* Mitigation 1 (KVM)
* EPT is disabled: [43m[30m NO [0m
* Mitigation 2
* L1D flush is supported by kernel: [42m[30m YES [0m (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: [42m[30m YES [0m (conditional flushes)
* Hardware-backed L1D flush supported: [42m[30m YES [0m (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: [43m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (this system is not running a hypervisor)

[1;34mCVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

[1;34mCVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

[1;34mCVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

[1;34mCVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

[1;34mCVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Not affected)
* TAA mitigation is supported by kernel: [42m[30m YES [0m (found tsx_async_abort in kernel image)
* TAA mitigation enabled and active: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Not affected)

[1;34mCVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (KVM: Mitigation: VMX disabled)
* This system is a host running a hypervisor: [42m[30m NO [0m
* iTLB Multihit mitigation is supported by kernel: [42m[30m YES [0m (found itlb_multihit in kernel image)
* iTLB Multihit mitigation enabled and active: [42m[30m YES [0m (KVM: Mitigation: VMX disabled)
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (this system is not running a hypervisor)

[1;34mCVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: No microcode)
* SRBDS mitigation control is supported by the kernel: [42m[30m YES [0m (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your CPU microcode may need to be updated to mitigate the vulnerability)

[1;34mCVE-2023-20593 aka 'Zenbleed, cross-process information leak'[0m
* Zenbleed mitigation is supported by kernel: [42m[30m YES [0m (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active: [44m[30m N/A [0m (CPU is incompatible)
* Zenbleed mitigation is supported by CPU microcode: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU vendor reported your CPU model as not affected)

[1;34mCVE-2022-40982 aka 'Downfall, gather data sampling (GDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: No microcode)
* GDS is mitigated by microcode: [43m[30m NO [0m
* Kernel supports software mitigation by disabling AVX: [42m[30m YES [0m (found gather_data_sampling in kernel image)
* Kernel has disabled AVX as a mitigation: [43m[30m NO [0m (AVX support is enabled)
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Vulnerable: No microcode)

[1;34mCVE-2023-20569 aka 'Inception, return address security (RAS)'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Not affected)
* Kernel supports mitigation: [42m[30m YES [0m (found spec_rstack_overflow in kernel image)
* Kernel compiled with SRSO support: [42m[30m YES [0m
* Kernel compiled with IBPB_ENTRY support: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU vendor reported your CPU model as not affected)

[1;34mCVE-2023-23583 aka 'Reptar, redundant prefix issue'[0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU vendor reported your CPU model as not affected)

> [46m[30mSUMMARY:[0m [42m[30mCVE-2017-5753:OK[0m [42m[30mCVE-2017-5715:OK[0m [42m[30mCVE-2017-5754:OK[0m [42m[30mCVE-2018-3640:OK[0m [42m[30mCVE-2018-3639:OK[0m [42m[30mCVE-2018-3615:OK[0m [42m[30mCVE-2018-3620:OK[0m [42m[30mCVE-2018-3646:OK[0m [41m[30mCVE-2018-12126:KO[0m [41m[30mCVE-2018-12130:KO[0m [41m[30mCVE-2018-12127:KO[0m [41m[30mCVE-2019-11091:KO[0m [42m[30mCVE-2019-11135:OK[0m [42m[30mCVE-2018-12207:OK[0m [41m[30mCVE-2020-0543:KO[0m [42m[30mCVE-2023-20593:OK[0m [41m[30mCVE-2022-40982:KO[0m [42m[30mCVE-2023-20569:OK[0m [42m[30mCVE-2023-23583:OK[0m

Re: Which intel-ucode file do I need? (2024)

FAQs

Do I need Intel Microcode? ›

Without them, you may experience spurious crashes or unexpected system halts that can be difficult to track down. All users with an AMD or Intel CPU should install the microcode updates to ensure system stability. In virtual machines and containers, the microcode updates belongs on the host, not in the guest system.

Read On ›

What is Ucode Intel? ›

The intel-ucode directory contains binary MCU files named in the family-model-stepping format. This file format is supported by most modern Linux distributions.

Read On ›

How do I find my Intel Microcode version? ›

The Intel® Processor Identification Utility reports the CPUID information for the installed processor, located under the CPUID DATA tab of the tool. The microcode version is listed in the CPUID DATA section and is called "CPU Revision".

Read The Full Story ›

Does microcode improve performance? ›

Microcode enables manufacturers to fix bugs, improve performance, and address security vulnerabilities without the need for physical hardware changes or full-scale firmware updates. However, microcode can also introduce vulnerabilities, underscoring the importance of its management and security.

What are the disadvantages of microcode? ›

However, horizontal microcode also has some drawbacks, such as large size, low flexibility, and high complexity. It requires more memory space to store the microcode, it is harder to modify or update the microcode, and it is more difficult to design and debug the microcode.

How to update Ucode? ›

How to update/install microcode downloaded from Intel site

$ ls -l /sys/devices/system/cpu/microcode/reload. ...
$ sudo cp -v intel-ucode/* /lib/firmware/intel-ucode/ ...
# echo command 1 > /sys/devices/system/cpu/microcode/reload. ...
$ sudo update-initramfs -u. ...
# dmesg | grep microcode.

Nov 20, 2023

Where is Intel microcode stored? ›

Processor interface

The processor boots up using a set of microcode held inside the processor and stored in an internal ROM.

Discover More ›

What is the meaning of Ucode? ›

The ucode system (written in lower case "ucode") is an identification number system that can be used to identify things in the real world uniquely. Digital information can be associated with objects and places, and the associated information can be retrieved by using ucode. ucode symbol.

Show Me More ›

Is microcode the same as firmware? ›

Firmware is a form of microcode or program embedded into hardware devices to help them operate effectively.

Tell Me More ›

Do modern CPUs use microcode? ›

While microcode is utilized in general-purpose CPUs in contemporary desktops, it also functions as a fallback path for scenarios that the faster hardwired control unit is unable to manage.

Keep Reading ›

How do I read my Intel CPU code? ›

Let's use the Intel® Core™ i9 processor 14900K as an example:

Brand: Intel® Core™
Brand modifier: i9.
Processor number: 14900.
Suffix: K. The first digit or two in the processor number denotes the architectural generation. The digits following the generation number—900—comprise the SKU number.

Get More Info ›

What is the purpose of microcode? ›

The microcode resides in a separate high-speed memory and functions as a translation layer between the machine instructions and the circuit level of the computer. Microcode enables the computer designer to create machine instructions without having to design electronic circuits.

View Details ›

Do I need to register Intel CPU? ›

You can view details about the Intel® Boxed Processor one-year limited warranty. You aren't required to register your Intel® processor for warranty services. Altering clock frequency or voltage may void any product warranties and reduce stability, security, performance, and life of the processor and other components.

Find Out More ›

Do I need Intel chipset software installation utility? ›

In many cases, the operating system recognizes all the pieces of the chipset without the INF. Do I need to install the Intel® Chipset Software Installation Utility? Unless you are installing an operating system, you don't need to install the Intel® Chipset Software Installation Utility.

Re: Which intel-ucode file do I need? (2024)

FAQs

Do I need Intel Microcode? ›

How do I read my Intel CPU code? ›

References