Difference between revisions of "Intel microcode"

From Gentoo Wiki
Jump to:navigation Jump to:search
(Move aged note to "External resources")
m (typo repair)
 
(15 intermediate revisions by 12 users not shown)
Line 1: Line 1:
 
<languages />
 
<languages />
−
<translate>{{InfoBox stack
+
<translate><!--T:1-->
 +
{{InfoBox stack
 
|{{InfoBox wikipedia|Microcode|header=true}}
 
|{{InfoBox wikipedia|Microcode|header=true}}
 
|{{InfoBox package|sys-firmware/intel-microcode}}
 
|{{InfoBox package|sys-firmware/intel-microcode}}
 
}}
 
}}
  
−
This article [[Article description::describes the process of updating the [[microcode]] on Intel processors.]]
+
<!--T:2-->
 +
This article [[Article description::describes the process of updating the {{Link|microcode}} on Intel processors.]]
  
−
== Installation ==
+
== {{Anchor|Installation}} Installation == <!--T:3-->
  
−
=== Kernel ===
+
=== {{Anchor|Kernel}} Kernel === <!--T:4-->
  
 +
<!--T:5-->
 
The following kernel support is required to be built-in:
 
The following kernel support is required to be built-in:
  
 +
<!--T:6-->
 
{{KernelBox|title=Enable CONFIG_BLK_DEV_INITRD, CONFIG_MICROCODE, and CONFIG_MICROCODE_INTEL|1=
 
{{KernelBox|title=Enable CONFIG_BLK_DEV_INITRD, CONFIG_MICROCODE, and CONFIG_MICROCODE_INTEL|1=
 
General setup  --->
 
General setup  --->
Line 21: Line 25:
 
}}
 
}}
  
 +
<!--T:7-->
 
{{Warning|Modules do not work for early microcode, so make sure microcode loading is built-in.}}
 
{{Warning|Modules do not work for early microcode, so make sure microcode loading is built-in.}}
  
−
=== Emerge ===
+
<!--T:88-->
 +
{{Important|
 +
Since kernel version 6.6, the '''microcode''' loading support is '''enabled by default''', and the above configuration no longer exists:<code>CONFIG_MICROCODE_INTEL</code> was replaced with <code>CONFIG_CPU_SUP_INTEL</code>. <ref>https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6bcfdd75d53390a67f67237f4eafc77d9772056</ref>
 +
}}
  
 +
=== USE flags ===
 +
{{USEflag|package=sys-firmware/intel-microcode}}
 +
 +
=== {{Anchor|Emerge}} Emerge === <!--T:8-->
 +
 +
<!--T:9-->
 
Install the microcode firmware package and the manipulation tool:
 
Install the microcode firmware package and the manipulation tool:
  
−
{{Emerge
+
<!--T:10-->
−
|sys-apps/iucode_tool
 
−
|params+=--oneshot --noreplace
 
−
}}
 
 
{{Emerge
 
{{Emerge
 
|sys-firmware/intel-microcode
 
|sys-firmware/intel-microcode
Line 36: Line 47:
 
}}
 
}}
  
−
== Configuration ==
+
== {{Anchor|Configuration}} Configuration == <!--T:11-->
  
−
{{Note|If the <code>initramfs</code> USE flag is active the <code>intel-microcode</code> ebuild will automatically install a cpio archive of all microcode into {{c|/boot/intel-uc.img}}.}}
+
<!--T:12-->
 +
{{Note|If the <code>initramfs</code> USE flag is active the <code>intel-microcode</code> ebuild will ensure that a cpio archive of all microcode is either directly installed into {{c|/boot/intel-uc.img}}, or it will instruct {{Link|installkernel}} to generate one when the kernel is installed.}}
  
−
To manually generate the microcode cpio archive use {{c|iucode_tool}}:
+
<!--T:13-->
 +
To manually generate the microcode {{Link|cpio}} archive use {{c|iucode_tool}}:
  
 +
<!--T:14-->
 
{{RootCmd|1=iucode_tool -S --write-earlyfw{{=}}/boot/early_ucode.cpio /lib/firmware/intel-ucode/*|output=<pre>
 
{{RootCmd|1=iucode_tool -S --write-earlyfw{{=}}/boot/early_ucode.cpio /lib/firmware/intel-ucode/*|output=<pre>
 
iucode_tool: system has processor(s) with signature 0x000306c3
 
iucode_tool: system has processor(s) with signature 0x000306c3
Line 47: Line 61:
 
</pre>}}
 
</pre>}}
  
−
=== Genkernel ===
+
=== {{Anchor|Genkernel}} Genkernel === <!--T:15-->
  
 +
<!--T:16-->
 
If {{c|genkernel}} is used to generate the initrd then add the {{c|--microcode-initramfs}} option to have it prepend an early cpio with the Intel and AMD microcode inside. No modifications to the bootloader config are necessary below.
 
If {{c|genkernel}} is used to generate the initrd then add the {{c|--microcode-initramfs}} option to have it prepend an early cpio with the Intel and AMD microcode inside. No modifications to the bootloader config are necessary below.
  
−
=== Syslinux ===
+
=== {{Anchor|Syslinux}} Syslinux === <!--T:17-->
  
 +
<!--T:18-->
 
Multiple initrd files are separated by commas in the <code>INITRD</code> line. Set {{Path|early_ucode.cpio}} to load first:
 
Multiple initrd files are separated by commas in the <code>INITRD</code> line. Set {{Path|early_ucode.cpio}} to load first:
  
 +
<!--T:19-->
 
{{FileBox|filename=/boot/syslinux.cfg|lang=text|1=
 
{{FileBox|filename=/boot/syslinux.cfg|lang=text|1=
 
LABEL gentoo
 
LABEL gentoo
Line 62: Line 79:
 
}}
 
}}
  
−
=== GRUB Legacy ===
+
=== {{Anchor|GRUB_Legacy}} GRUB Legacy === <!--T:20-->
  
 +
<!--T:21-->
 
Add the generated microcode to the kernel command-line as the first <code>initrd</code>. The root initramfs goes second separated by space.  This step is necessary even if the system does not use an initrd image in order to boot. The microcode update merely leverages the initrd hooks:
 
Add the generated microcode to the kernel command-line as the first <code>initrd</code>. The root initramfs goes second separated by space.  This step is necessary even if the system does not use an initrd image in order to boot. The microcode update merely leverages the initrd hooks:
  
 +
<!--T:22-->
 
{{FileBox|title=Example GRUB Legacy configuration for microcode update|filename=/boot/grub/grub.conf|lang=text|1=
 
{{FileBox|title=Example GRUB Legacy configuration for microcode update|filename=/boot/grub/grub.conf|lang=text|1=
 
title Gentoo Linux 4.4.6
 
title Gentoo Linux 4.4.6
Line 73: Line 92:
 
}}
 
}}
  
−
=== GRUB ===
+
=== {{Anchor|GRUB}} GRUB === <!--T:23-->
  
 +
<!--T:24-->
 
Starting with version 2.02-r1, GRUB supports loading an early microcode. If the microcode file is named after one of the following: {{Path|intel-uc.img}}, {{Path|intel-ucode.img}}, {{Path|amd-uc.img}}, {{Path|amd-ucode.img}}, {{Path|early_ucode.cpio}}, or {{Path|microcode.cpio}}, it will be automatically detected when running {{c|grub-mkconfig}}. To declare a microcode file named differently, e.g. {{Path|ucode.cpio}}, add this line to {{Path|/etc/default/grub}}:
 
Starting with version 2.02-r1, GRUB supports loading an early microcode. If the microcode file is named after one of the following: {{Path|intel-uc.img}}, {{Path|intel-ucode.img}}, {{Path|amd-uc.img}}, {{Path|amd-ucode.img}}, {{Path|early_ucode.cpio}}, or {{Path|microcode.cpio}}, it will be automatically detected when running {{c|grub-mkconfig}}. To declare a microcode file named differently, e.g. {{Path|ucode.cpio}}, add this line to {{Path|/etc/default/grub}}:
  
 +
<!--T:25-->
 
{{FileBox|filename=/etc/default/grub|title=|lang=bash|1=
 
{{FileBox|filename=/etc/default/grub|title=|lang=bash|1=
 
GRUB_EARLY_INITRD_LINUX_CUSTOM="ucode.cpio"
 
GRUB_EARLY_INITRD_LINUX_CUSTOM="ucode.cpio"
 
}}
 
}}
  
 +
<!--T:26-->
 
Regenerate the {{Path|grub.cfg}} with:
 
Regenerate the {{Path|grub.cfg}} with:
  
 +
<!--T:27-->
 
{{RootCmd|1=grub-mkconfig -o /boot/grub/grub.cfg|output=<pre>
 
{{RootCmd|1=grub-mkconfig -o /boot/grub/grub.cfg|output=<pre>
 
Generating grub configuration file ...
 
Generating grub configuration file ...
Line 90: Line 113:
 
</pre>}}
 
</pre>}}
  
 +
<!--T:28-->
 
Or, for earlier versions than 2.02-r1, edit {{Path|grub.cfg}} directly to add the {{Path|early_ucode.cpio}} as the first initrd:
 
Or, for earlier versions than 2.02-r1, edit {{Path|grub.cfg}} directly to add the {{Path|early_ucode.cpio}} as the first initrd:
  
 +
<!--T:29-->
 
{{FileBox|filename=/boot/grub/grub.cfg|1=
 
{{FileBox|filename=/boot/grub/grub.cfg|1=
 
menuentry 'Gentoo Linux 4.14' {
 
menuentry 'Gentoo Linux 4.14' {
Line 100: Line 125:
 
}}
 
}}
  
 +
<!--T:30-->
 
Finally, reboot.
 
Finally, reboot.
  
−
=== rEFInd ===
+
=== {{Anchor|rEFInd}} rEFInd === <!--T:31-->
  
 +
<!--T:32-->
 
{{FileBox|filename=/efi/EFI/refind/refind.conf|lang=text|1=
 
{{FileBox|filename=/efi/EFI/refind/refind.conf|lang=text|1=
 
menuentry Linux {
 
menuentry Linux {
−
 
 
   icon EFI/refind/icons/os_gentoo.png
 
   icon EFI/refind/icons/os_gentoo.png
 
   volume foo
 
   volume foo
Line 118: Line 144:
 
}}
 
}}
  
 +
<!--T:33-->
 
This example system has the EFI partition {{Path|/dev/sda1}} mounted to {{Path|/efi}}. The Linux kernel and initrd files have been placed in {{Path|/boot}} on the Linux rootfs.
 
This example system has the EFI partition {{Path|/dev/sda1}} mounted to {{Path|/efi}}. The Linux kernel and initrd files have been placed in {{Path|/boot}} on the Linux rootfs.
  
 +
<!--T:34-->
 
If using the '''initrd''' keyword instead of the '''options''' keyword for specifying initrd, then try specifying multiple initrd files via separate '''initrd''' keywords, or migrate the declarations into '''options'''. Specifying multiple initrd via one '''initrd''' keyword fails on rEFInd. As always, make sure {{Path|boot/early_code.cpio}} is the first initrd specified.
 
If using the '''initrd''' keyword instead of the '''options''' keyword for specifying initrd, then try specifying multiple initrd files via separate '''initrd''' keywords, or migrate the declarations into '''options'''. Specifying multiple initrd via one '''initrd''' keyword fails on rEFInd. As always, make sure {{Path|boot/early_code.cpio}} is the first initrd specified.
  
 +
<!--T:35-->
 
Review and edit the kernel <var>cmdline</var> options from the rEFInd bootloader. With the Gentoo OS entry highlighted, press {{Key|F2}} to access the menu entries, and press {{Key|F2}} again over the desired entry to review and edit. This is very useful for quick experimenting without need to edit {{Path|refind.conf}}.
 
Review and edit the kernel <var>cmdline</var> options from the rEFInd bootloader. With the Gentoo OS entry highlighted, press {{Key|F2}} to access the menu entries, and press {{Key|F2}} again over the desired entry to review and edit. This is very useful for quick experimenting without need to edit {{Path|refind.conf}}.
  
 +
<!--T:36-->
 
{{FileBox|filename=/boot/refind_linux.conf|lang=text|1=
 
{{FileBox|filename=/boot/refind_linux.conf|lang=text|1=
 
"Boot using default options"    "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw initrd=boot\intel-ucode.img initrd=boot\amd-ucode.img initrd=boot\initramfs-%v.img"
 
"Boot using default options"    "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw initrd=boot\intel-ucode.img initrd=boot\amd-ucode.img initrd=boot\initramfs-%v.img"
−
}
 
 
}}
 
}}
  
 +
<!--T:37-->
 
Finalize the configuration in {{Path|/boot/refind_linux.conf}}. Keep in mind that rEFInd searches initramfs relatively partition, so if the
 
Finalize the configuration in {{Path|/boot/refind_linux.conf}}. Keep in mind that rEFInd searches initramfs relatively partition, so if the
 
/boot partition is separate, search it with "initrd=intel-ucode.img initrd=initramfs-%v.img" (because boot partition don't have /boot folder). Use backslashes \, or the kernel may not find the files.
 
/boot partition is separate, search it with "initrd=intel-ucode.img initrd=initramfs-%v.img" (because boot partition don't have /boot folder). Use backslashes \, or the kernel may not find the files.
 
See {{Path|refind.conf}} for keyword descriptions and [https://www.rodsbooks.com/refind/ The rEFInd Homepage] for more on how to use rEFInd.
 
See {{Path|refind.conf}} for keyword descriptions and [https://www.rodsbooks.com/refind/ The rEFInd Homepage] for more on how to use rEFInd.
  
−
=== systemd-boot ===
+
=== {{Anchor|systemd-boot}} systemd-boot === <!--T:38-->
  
 +
<!--T:39-->
 
Add the microcode as an argument to an '''initrd''' line. If an initrd line already exists, ensure the microcode entry occurs first. The path to the microcode should be absolute to the root of the ESP.
 
Add the microcode as an argument to an '''initrd''' line. If an initrd line already exists, ensure the microcode entry occurs first. The path to the microcode should be absolute to the root of the ESP.
  
 +
<!--T:40-->
 
{{FileBox|filename=/boot/EFI/loader/entries/example|lang=text|1=
 
{{FileBox|filename=/boot/EFI/loader/entries/example|lang=text|1=
 
title      Gentoo/Linux
 
title      Gentoo/Linux
Line 146: Line 178:
 
}}
 
}}
  
 +
<!--T:41-->
 
For more information, see [https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/ The Boot Loader Specification].
 
For more information, see [https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/ The Boot Loader Specification].
  
−
=== Xen (EFI) ===
+
=== {{Anchor|Xen_.28EFI.29}} Xen (EFI) === <!--T:42-->
  
 +
<!--T:43-->
 
Add a line to the {{Path|xen.cfg}} with the <var>ucode</var> option. The path to the microcode is relative to the {{Path|xen.efi}} binary. Ensure to write the microcode into the correct location (default is {{Path|/boot/EFI/Gentoo}}) or copy it there.
 
Add a line to the {{Path|xen.cfg}} with the <var>ucode</var> option. The path to the microcode is relative to the {{Path|xen.efi}} binary. Ensure to write the microcode into the correct location (default is {{Path|/boot/EFI/Gentoo}}) or copy it there.
  
 +
<!--T:44-->
 
{{FileBox|filename=/boot/EFI/Gentoo/xen.cfg|lang=ini|1=
 
{{FileBox|filename=/boot/EFI/Gentoo/xen.cfg|lang=ini|1=
 
[global]
 
[global]
Line 162: Line 197:
 
}}
 
}}
  
 +
<!--T:45-->
 
For more information, see the [https://xenbits.xen.org/docs/unstable/misc/efi.html Xen EFI] documentation.
 
For more information, see the [https://xenbits.xen.org/docs/unstable/misc/efi.html Xen EFI] documentation.
  
−
== New method without initram-fs/disk (efistub compatible) ==
+
== {{Anchor|New_method_without_initram-fs.2Fdisk_.28efistub_compatible.29}} New method without initram-fs/disk (efistub compatible) == <!--T:46-->
  
 +
<!--T:47-->
 
{{Warning|This will only work on a 64-bit kernel and will have no effect otherwise. 32-bit systems need to use an initramfs.}}
 
{{Warning|This will only work on a 64-bit kernel and will have no effect otherwise. 32-bit systems need to use an initramfs.}}
  
−
{{Note|This method should be preferable, especially for EFI-Stub systems (some motherboard firmware might have issues with parsing/passing custom boot command line options), since these changes are less likely to leave the system unbootable (and possibly unrepairable without an EFI compatible rescue disk which can be very tricky on headless machines) the way a broken firmware boot entry and/or incorrect initram-fs/disk would, while it also works on BIOS systems or EFI systems with custom bootloaders on disk. However, this requires a relatively recent kernel version (possibly unstable at the time of writing). It was tested with Linux 4.8.0}}
+
<!--T:48-->
 +
{{Note|This method should be preferable, especially for EFI-Stub systems (some motherboard firmware might have issues with parsing/passing custom boot command line options), since these changes are less likely to leave the system unbootable (and possibly unrepairable without an EFI compatible rescue disk which can be very tricky on headless machines) the way a broken firmware boot entry and/or incorrect initram-fs/disk would, while it also works on BIOS systems or EFI systems with custom bootloaders on disk.}}
  
−
=== Software ===
+
=== {{Anchor|Software}} Software === <!--T:49-->
  
 +
<!--T:50-->
 
The {{Package|sys-firmware/intel-microcode}}-20171117-r1 package has been rewritten to use {{c|iucode_tool}} to process microcode data files. Users can now use the <var>MICROCODE_SIGNATURES</var> variable to install only a subset of microcode data files.
 
The {{Package|sys-firmware/intel-microcode}}-20171117-r1 package has been rewritten to use {{c|iucode_tool}} to process microcode data files. Users can now use the <var>MICROCODE_SIGNATURES</var> variable to install only a subset of microcode data files.
  
 +
<!--T:51-->
 
To install microcode data files for the system processor(s):
 
To install microcode data files for the system processor(s):
  
 +
<!--T:52-->
 
{{FileBox|filename=/etc/portage/make.conf|1=
 
{{FileBox|filename=/etc/portage/make.conf|1=
 
MICROCODE_SIGNATURES="-S"
 
MICROCODE_SIGNATURES="-S"
 
}}
 
}}
  
 +
<!--T:53-->
 
To install microcode data files for a specific processor use <code>MICROCODE_SIGNATURES="-s 0x000306c3"</code>, or <code>MICROCODE_SIGNATURES="-s !0x000306c3"</code> to exclude a specific processor. An empty or undefined <var>MICROCODE_SIGNATURES</var> variable will install all microcode data files.
 
To install microcode data files for a specific processor use <code>MICROCODE_SIGNATURES="-s 0x000306c3"</code>, or <code>MICROCODE_SIGNATURES="-s !0x000306c3"</code> to exclude a specific processor. An empty or undefined <var>MICROCODE_SIGNATURES</var> variable will install all microcode data files.
  
 +
<!--T:54-->
 
Install the microcode data files:
 
Install the microcode data files:
  
 +
<!--T:55-->
 
{{Emerge|sys-firmware/intel-microcode}}
 
{{Emerge|sys-firmware/intel-microcode}}
  
 +
<!--T:56-->
 
The {{Package|sys-firmware/intel-microcode}}-20171117-r1 installs {{c|iucode_tool}} which can be used to identify the processor signature(s).
 
The {{Package|sys-firmware/intel-microcode}}-20171117-r1 installs {{c|iucode_tool}} which can be used to identify the processor signature(s).
  
 +
<!--T:57-->
 
{{Cmd|iucode_tool -S|output=<pre>
 
{{Cmd|iucode_tool -S|output=<pre>
 
iucode_tool: system has processor(s) with signature 0x000306c3
 
iucode_tool: system has processor(s) with signature 0x000306c3
 
</pre>}}
 
</pre>}}
  
 +
<!--T:58-->
 
To find the appropriate filename(s) for the listed signature(s) use:
 
To find the appropriate filename(s) for the listed signature(s) use:
  
 +
<!--T:59-->
 
{{Cmd|iucode_tool -S -l /lib/firmware/intel-ucode/*|output=<pre>
 
{{Cmd|iucode_tool -S -l /lib/firmware/intel-ucode/*|output=<pre>
 
iucode_tool: system has processor(s) with signature 0x000306c3
 
iucode_tool: system has processor(s) with signature 0x000306c3
Line 203: Line 251:
 
</pre>}}
 
</pre>}}
  
 +
<!--T:60-->
 
The signature is found in microcode bundle <code>49</code>, so the filename to use is {{Path|/lib/firmware/intel-ucode/06-3c-03}}.
 
The signature is found in microcode bundle <code>49</code>, so the filename to use is {{Path|/lib/firmware/intel-ucode/06-3c-03}}.
  
−
=== Kernel ===
+
<!--T:89-->
 +
{{See|See the [https://forums.gentoo.org/viewtopic-p-8798002.html#8798002 intel ucode for Core i7-8650U] forums post for an easier way to get the necessary microcode file.}}
 +
 
 +
=== {{Anchor|Kernel}} Kernel === <!--T:61-->
  
 +
<!--T:62-->
 
Enable and configure the <var>CONFIG_MICROCODE</var>, <var>CONFIG_MICROCODE_INTEL</var>, <var>CONFIG_FIRMWARE_IN_KERNEL</var>, <var>CONFIG_EXTRA_FIRMWARE</var> and <var>CONFIG_EXTRA_FIRMWARE_DIR</var> kernel options.
 
Enable and configure the <var>CONFIG_MICROCODE</var>, <var>CONFIG_MICROCODE_INTEL</var>, <var>CONFIG_FIRMWARE_IN_KERNEL</var>, <var>CONFIG_EXTRA_FIRMWARE</var> and <var>CONFIG_EXTRA_FIRMWARE_DIR</var> kernel options.
  
 +
<!--T:63-->
 
{{Warning|Every option ''must'' be set as built into the kernel, not as a kernel module.}}
 
{{Warning|Every option ''must'' be set as built into the kernel, not as a kernel module.}}
  
 +
<!--T:64-->
 
{{KernelBox|title=Enabling Microcode Loading Support|1=
 
{{KernelBox|title=Enabling Microcode Loading Support|1=
 
Processor type and features  --->
 
Processor type and features  --->
Line 216: Line 271:
 
     [*]  Intel microcode loading support
 
     [*]  Intel microcode loading support
  
 +
<!--T:65-->
 
Device Drivers  --->
 
Device Drivers  --->
 
   Generic Driver Options  --->
 
   Generic Driver Options  --->
Line 221: Line 277:
 
       -*-  Firmware loading facility  
 
       -*-  Firmware loading facility  
 
       (intel-ucode/06-3c-03) Build named firmware blobs into the kernel binary  
 
       (intel-ucode/06-3c-03) Build named firmware blobs into the kernel binary  
−
       (/lib/firmware) Firmware blobs root directory (NEW)
+
       (/lib/firmware) Firmware blobs root directory  
 
}}
 
}}
  
 +
<!--T:66-->
 
{{Note|The <var>CONFIG_EXTRA_FIRMWARE</var> and <var>CONFIG_EXTRA_FIRMWARE_DIR</var> options need to be set to the values identified by {{c|iucode_tool}}. In this example for an Intel i7-4790K processor, <var>CONFIG_EXTRA_FIRMWARE</var> is set to <code>intel-ucode/06-3c-03</code> and <var>CONFIG_EXTRA_FIRMWARE_DIR</var> is set to <code>/lib/firmware</code>.}}
 
{{Note|The <var>CONFIG_EXTRA_FIRMWARE</var> and <var>CONFIG_EXTRA_FIRMWARE_DIR</var> options need to be set to the values identified by {{c|iucode_tool}}. In this example for an Intel i7-4790K processor, <var>CONFIG_EXTRA_FIRMWARE</var> is set to <code>intel-ucode/06-3c-03</code> and <var>CONFIG_EXTRA_FIRMWARE_DIR</var> is set to <code>/lib/firmware</code>.}}
  
 +
<!--T:67-->
 
{{Note|The <var>CONFIG_EXTRA_FIRMWARE</var> option allows specifying multiple firmware files by listing them space-separated.}}
 
{{Note|The <var>CONFIG_EXTRA_FIRMWARE</var> option allows specifying multiple firmware files by listing them space-separated.}}
  
−
[[Kernel/Rebuild|Rebuild and install]] the kernel as usual.
+
<!--T:68-->
 +
{{Link|Kernel/Rebuild|Rebuild and install}} the kernel as usual.
  
−
== Verification ==
+
== {{Anchor|Verification}} Verification == <!--T:69-->
  
 +
<!--T:70-->
 
After the next reboot, the loaded microcode revision can be verified by running:
 
After the next reboot, the loaded microcode revision can be verified by running:
  
 +
<!--T:71-->
 
{{Cmd|1=grep microcode /proc/cpuinfo|output=<pre>
 
{{Cmd|1=grep microcode /proc/cpuinfo|output=<pre>
−
microcode : 0xa4
+
microcode : 0x22
−
microcode : 0xa4
+
microcode : 0x22
 
</pre>}}
 
</pre>}}
  
−
The dmesg output should include:
+
<!--T:72-->
 +
The {{c|dmesg}} output should include:
  
 +
<!--T:73-->
 
{{RootCmd|1=dmesg {{!}} grep microcode|output=<pre>
 
{{RootCmd|1=dmesg {{!}} grep microcode|output=<pre>
 
[    0.000000] microcode: microcode updated early to revision 0x22, date = 2017-01-27
 
[    0.000000] microcode: microcode updated early to revision 0x22, date = 2017-01-27
Line 247: Line 310:
 
</pre>}}
 
</pre>}}
  
 +
<!--T:74-->
 
Here is an example of a CPU with no available microcode updates (microcode already current) or the system was not configured to load them properly:
 
Here is an example of a CPU with no available microcode updates (microcode already current) or the system was not configured to load them properly:
  
 +
<!--T:75-->
 
{{RootCmd|1=dmesg {{!}} grep microcode|output=<pre>
 
{{RootCmd|1=dmesg {{!}} grep microcode|output=<pre>
 
[    1.196567] microcode: CPU0 sig=0x6fd, pf=0x80, revision=0xa3
 
[    1.196567] microcode: CPU0 sig=0x6fd, pf=0x80, revision=0xa3
Line 255: Line 320:
 
</pre>}}
 
</pre>}}
  
 +
<!--T:76-->
 
Here is the same CPU but with microcode updates being applied successfully:
 
Here is the same CPU but with microcode updates being applied successfully:
  
 +
<!--T:77-->
 
{{RootCmd|1=dmesg {{!}} grep microcode|output=<pre>
 
{{RootCmd|1=dmesg {{!}} grep microcode|output=<pre>
 
[    0.000000] microcode: microcode updated early to revision 0xa4, date = 2010-10-02
 
[    0.000000] microcode: microcode updated early to revision 0xa4, date = 2010-10-02
Line 264: Line 331:
 
</pre>}}
 
</pre>}}
  
 +
<!--T:78-->
 
{{Note|If genkernel and legacy GRUB are used, the first line may be absent. Instead, check the microcode revision before and after the changes.}}
 
{{Note|If genkernel and legacy GRUB are used, the first line may be absent. Instead, check the microcode revision before and after the changes.}}
  
 +
<!--T:79-->
 
{{Note|Note how this is the very first step of the kernel logs now.}}
 
{{Note|Note how this is the very first step of the kernel logs now.}}
  
−
{{Note|If genkernel and legacy GRUB are used, the first line may be absent. Instead, check the microcode revision before and after the changes.}}
+
<!--T:80-->
 +
{{Important|It is possible the microcode has already been fully updated by your {{Link|BIOS}} vendor. In that case the {{c|dmesg}} output does not contain the update log message.}}
  
−
{{Note|Be aware that injecting the microcode update directly into the motherboard firmware (which might sounds tempting) might result in CPU0 being updated but the rest of the CPUs (or CPU cores in a multi-core system) being left at their initial revision (which might cause more problems than running them all at the same initial version). And, since most stock motherboard firmware has some microcode updates (even in their initial release versions), it's probably a good enough reason for everybody to make sure their kernel tries to update all CPUs (and cores) to the same version (so, let this update driver running even if the kernel has the same version which is stored in the motherboard firmware). Injecting the microcode into the firmware might be desirable still (to make sure it's loaded for the boot CPU before the kernel is loaded and able to update the rest of the microcode).}}
+
<!--T:81-->
 +
{{Note|Be aware that injecting the microcode update directly into the motherboard firmware (which might sound tempting) might result in CPU0 being updated but the rest of the CPUs (or CPU cores in a multi-core system) being left at their initial revision (which might cause more problems than running them all at the same initial version). And, since most stock motherboard firmware has some microcode updates (even in their initial release versions), it's probably a good enough reason for everybody to make sure their kernel tries to update all CPUs (and cores) to the same version (so, let this update driver running even if the kernel has the same version which is stored in the motherboard firmware). Injecting the microcode into the firmware might be desirable still (to make sure it's loaded for the boot CPU before the kernel is loaded and able to update the rest of the microcode).}}
  
−
== See also ==
+
== {{Anchor|See also}} See also == <!--T:82-->
  
−
* {{See also|Intel}}
+
<!--T:83-->
 
* {{See also|Microcode}}
 
* {{See also|Microcode}}
 +
* {{See also|AMD microcode}}
  
−
== External resources ==
+
== {{Anchor|External_resources}} External resources == <!--T:84-->
  
 +
<!--T:85-->
 
* http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html - An example unofficial source for microcodes
 
* http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html - An example unofficial source for microcodes
 
*  
 
*  
 
{{Important|The microcode-ctl utility has been deprecated as of version 1.28-r1 (Gentoo unstable)<ref>https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=719cc5ef240b766953ddbe1e7a6593f8091eed12 The microcode-ctl utility has been deprecated as of version 1.28-r1 (Gentoo unstable) and no longer contains the init script. It also does not work on certain CPUs such as Intel Haswells.</ref> and was [https://gitweb.gentoo.org/repo/gentoo.git/commit/sys-apps/microcode-ctl?id{{=}}6915ad825559f329b8d2989ab232932906a8cbf4 removed from the Gentoo repository].}}
 
{{Important|The microcode-ctl utility has been deprecated as of version 1.28-r1 (Gentoo unstable)<ref>https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=719cc5ef240b766953ddbe1e7a6593f8091eed12 The microcode-ctl utility has been deprecated as of version 1.28-r1 (Gentoo unstable) and no longer contains the init script. It also does not work on certain CPUs such as Intel Haswells.</ref> and was [https://gitweb.gentoo.org/repo/gentoo.git/commit/sys-apps/microcode-ctl?id{{=}}6915ad825559f329b8d2989ab232932906a8cbf4 removed from the Gentoo repository].}}
  
−
== References ==
+
== {{Anchor|References}} References == <!--T:86-->
  
 +
<!--T:87-->
 
{{reflist}}
 
{{reflist}}
  

Latest revision as of 10:01, 12 February 2025

Other languages:

This article describes the process of updating the microcode on Intel processors.

Installation

Kernel

The following kernel support is required to be built-in:

KERNEL Enable CONFIG_BLK_DEV_INITRD, CONFIG_MICROCODE, and CONFIG_MICROCODE_INTEL
General setup  --->
    [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
Processor type and features  --->
    <*> CPU microcode loading support
    [*]   Intel microcode loading support
Warning
Modules do not work for early microcode, so make sure microcode loading is built-in.
Important
Since kernel version 6.6, the microcode loading support is enabled by default, and the above configuration no longer exists:CONFIG_MICROCODE_INTEL was replaced with CONFIG_CPU_SUP_INTEL. [1]

USE flags

USE flags for sys-firmware/intel-microcode Intel IA32/IA64 microcode update data

+initramfs Install a small initramfs for use with CONFIG_MICROCODE_EARLY
+split-ucode Install the split binary ucode files (used by the kernel directly)
dist-kernel Delegate microcode initramfs generation to sys-kernel/installkernel
hostonly Only install ucode(s) supported by currently available (=online) processor(s)
vanilla Only install microcode updates from Intel's official microcode tarball
Data provided by the Gentoo Package Database · Last update: 2026-08-13 12:14 More information about USE flags

Emerge

Install the microcode firmware package and the manipulation tool:

root #emerge --ask --noreplace sys-firmware/intel-microcode

Configuration

Note
If the initramfs USE flag is active the intel-microcode ebuild will ensure that a cpio archive of all microcode is either directly installed into /boot/intel-uc.img, or it will instruct installkernel to generate one when the kernel is installed.

To manually generate the microcode cpio archive use iucode_tool:

root #iucode_tool -S --write-earlyfw=/boot/early_ucode.cpio /lib/firmware/intel-ucode/*
iucode_tool: system has processor(s) with signature 0x000306c3
iucode_tool: Writing selected microcodes to: /boot/early_ucode.cpio

Genkernel

If genkernel is used to generate the initrd then add the --microcode-initramfs option to have it prepend an early cpio with the Intel and AMD microcode inside. No modifications to the bootloader config are necessary below.

Syslinux

Multiple initrd files are separated by commas in the INITRD line. Set early_ucode.cpio to load first:

FILE /boot/syslinux.cfg
LABEL gentoo
    MENU LABEL Gentoo Linux 4.4.6
    LINUX /vmlinuz-4.4.6-gentoo
    INITRD /early_ucode.cpio,/initrd-4.4.6-gentoo.img

GRUB Legacy

Add the generated microcode to the kernel command-line as the first initrd. The root initramfs goes second separated by space. This step is necessary even if the system does not use an initrd image in order to boot. The microcode update merely leverages the initrd hooks:

FILE /boot/grub/grub.confExample GRUB Legacy configuration for microcode update
title Gentoo Linux 4.4.6
root (hd0,0)
kernel /boot/vmlinuz-4.4.6-gentoo root=/dev/sda3
initrd /boot/intel-uc.img /boot/initrd.img

GRUB

Starting with version 2.02-r1, GRUB supports loading an early microcode. If the microcode file is named after one of the following: intel-uc.img, intel-ucode.img, amd-uc.img, amd-ucode.img, early_ucode.cpio, or microcode.cpio, it will be automatically detected when running grub-mkconfig. To declare a microcode file named differently, e.g. ucode.cpio, add this line to /etc/default/grub:

FILE /etc/default/grub
GRUB_EARLY_INITRD_LINUX_CUSTOM="ucode.cpio"

Regenerate the grub.cfg with:

root #grub-mkconfig -o /boot/grub/grub.cfg
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-4.6.3-gentoo
Found initrd image: /boot/early_ucode.cpio /initramfs-genkernel-x86_64-4.6.3-gentoo
done

Or, for earlier versions than 2.02-r1, edit grub.cfg directly to add the early_ucode.cpio as the first initrd:

FILE /boot/grub/grub.cfg
menuentry 'Gentoo Linux 4.14' {
  root=hd0,1
  linux /boot/linux-4.14.12 root=LABEL=ROOT rootfstype=ext4 ro
  initrd /boot/early_ucode.cpio /boot/initrd.img
}

Finally, reboot.

rEFInd

FILE /efi/EFI/refind/refind.conf
menuentry Linux {
  icon EFI/refind/icons/os_gentoo.png
  volume foo
  loader boot/vmlinuz
  options "initrd=boot/early_ucode.cpio initrd=boot/bootsplash-initramfs console=tty1 ro root=foo"
 
  submenuentry "Old Kernel" {
    loader boot/vmlinuz.old
  }
}

This example system has the EFI partition /dev/sda1 mounted to /efi. The Linux kernel and initrd files have been placed in /boot on the Linux rootfs.

If using the initrd keyword instead of the options keyword for specifying initrd, then try specifying multiple initrd files via separate initrd keywords, or migrate the declarations into options. Specifying multiple initrd via one initrd keyword fails on rEFInd. As always, make sure boot/early_code.cpio is the first initrd specified.

Review and edit the kernel cmdline options from the rEFInd bootloader. With the Gentoo OS entry highlighted, press F2 to access the menu entries, and press F2 again over the desired entry to review and edit. This is very useful for quick experimenting without need to edit refind.conf.

FILE /boot/refind_linux.conf
"Boot using default options"     "root=PARTUUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX rw initrd=boot\intel-ucode.img initrd=boot\amd-ucode.img initrd=boot\initramfs-%v.img"

Finalize the configuration in /boot/refind_linux.conf. Keep in mind that rEFInd searches initramfs relatively partition, so if the /boot partition is separate, search it with "initrd=intel-ucode.img initrd=initramfs-%v.img" (because boot partition don't have /boot folder). Use backslashes \, or the kernel may not find the files. See refind.conf for keyword descriptions and The rEFInd Homepage for more on how to use rEFInd.

systemd-boot

Add the microcode as an argument to an initrd line. If an initrd line already exists, ensure the microcode entry occurs first. The path to the microcode should be absolute to the root of the ESP.

FILE /boot/EFI/loader/entries/example
title      Gentoo/Linux
version    4.13.13
options    root=/dev/sda1
linux      /4.13.13/linux
initrd     /4.13.13/intel_ucode
initrd     /4.13.13/initrd

For more information, see The Boot Loader Specification.

Xen (EFI)

Add a line to the xen.cfg with the ucode option. The path to the microcode is relative to the xen.efi binary. Ensure to write the microcode into the correct location (default is /boot/EFI/Gentoo) or copy it there.

FILE /boot/EFI/Gentoo/xen.cfg
[global]
default=gentoo
 
[gentoo]
kernel=vmlinuz-4.4.6-gentoo root=/dev/sda1
ramdisk=initrd-4.4.6-gentoo.img
ucode=early_ucode.cpio

For more information, see the Xen EFI documentation.

New method without initram-fs/disk (efistub compatible)

Warning
This will only work on a 64-bit kernel and will have no effect otherwise. 32-bit systems need to use an initramfs.
Note
This method should be preferable, especially for EFI-Stub systems (some motherboard firmware might have issues with parsing/passing custom boot command line options), since these changes are less likely to leave the system unbootable (and possibly unrepairable without an EFI compatible rescue disk which can be very tricky on headless machines) the way a broken firmware boot entry and/or incorrect initram-fs/disk would, while it also works on BIOS systems or EFI systems with custom bootloaders on disk.

Software

The sys-firmware/intel-microcode-20171117-r1 package has been rewritten to use iucode_tool to process microcode data files. Users can now use the MICROCODE_SIGNATURES variable to install only a subset of microcode data files.

To install microcode data files for the system processor(s):

FILE /etc/portage/make.conf
MICROCODE_SIGNATURES="-S"

To install microcode data files for a specific processor use MICROCODE_SIGNATURES="-s 0x000306c3", or MICROCODE_SIGNATURES="-s !0x000306c3" to exclude a specific processor. An empty or undefined MICROCODE_SIGNATURES variable will install all microcode data files.

Install the microcode data files:

root #emerge --ask sys-firmware/intel-microcode

The sys-firmware/intel-microcode-20171117-r1 installs iucode_tool which can be used to identify the processor signature(s).

user $iucode_tool -S
iucode_tool: system has processor(s) with signature 0x000306c3

To find the appropriate filename(s) for the listed signature(s) use:

user $iucode_tool -S -l /lib/firmware/intel-ucode/*
iucode_tool: system has processor(s) with signature 0x000306c3
[...]
microcode bundle 49: /lib/firmware/intel-ucode/06-3c-03
[...]
selected microcodes:
  049/001: sig 0x000306c3, pf_mask 0x32, 2017-01-27, rev 0x0022, size 22528

The signature is found in microcode bundle 49, so the filename to use is /lib/firmware/intel-ucode/06-3c-03.

See also
See the intel ucode for Core i7-8650U forums post for an easier way to get the necessary microcode file.

Kernel

Enable and configure the CONFIG_MICROCODE, CONFIG_MICROCODE_INTEL, CONFIG_FIRMWARE_IN_KERNEL, CONFIG_EXTRA_FIRMWARE and CONFIG_EXTRA_FIRMWARE_DIR kernel options.

Warning
Every option must be set as built into the kernel, not as a kernel module.
KERNEL Enabling Microcode Loading Support
Processor type and features  --->
    <*> CPU microcode loading support
    [*]   Intel microcode loading support

Device Drivers  --->
  Generic Driver Options  --->
    Firmware Loader  --->
      -*-   Firmware loading facility 
      (intel-ucode/06-3c-03) Build named firmware blobs into the kernel binary 
      (/lib/firmware) Firmware blobs root directory
Note
The CONFIG_EXTRA_FIRMWARE and CONFIG_EXTRA_FIRMWARE_DIR options need to be set to the values identified by iucode_tool. In this example for an Intel i7-4790K processor, CONFIG_EXTRA_FIRMWARE is set to intel-ucode/06-3c-03 and CONFIG_EXTRA_FIRMWARE_DIR is set to /lib/firmware.
Note
The CONFIG_EXTRA_FIRMWARE option allows specifying multiple firmware files by listing them space-separated.

Rebuild and install the kernel as usual.

Verification

After the next reboot, the loaded microcode revision can be verified by running:

user $grep microcode /proc/cpuinfo
microcode	: 0x22
microcode	: 0x22

The dmesg output should include:

root #dmesg | grep microcode
[    0.000000] microcode: microcode updated early to revision 0x22, date = 2017-01-27
[    1.153262] microcode: sig=0x306c3, pf=0x2, revision=0x22
[    1.153815] microcode: Microcode Update Driver: v2.2.

Here is an example of a CPU with no available microcode updates (microcode already current) or the system was not configured to load them properly:

root #dmesg | grep microcode
[    1.196567] microcode: CPU0 sig=0x6fd, pf=0x80, revision=0xa3
[    1.196575] microcode: CPU1 sig=0x6fd, pf=0x80, revision=0xa3
[    1.196623] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba

Here is the same CPU but with microcode updates being applied successfully:

root #dmesg | grep microcode
[    0.000000] microcode: microcode updated early to revision 0xa4, date = 2010-10-02
[    1.207385] microcode: CPU0 sig=0x6fd, pf=0x80, revision=0xa4
[    1.207393] microcode: CPU1 sig=0x6fd, pf=0x80, revision=0xa4
[    1.207445] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
Note
If genkernel and legacy GRUB are used, the first line may be absent. Instead, check the microcode revision before and after the changes.
Note
Note how this is the very first step of the kernel logs now.
Important
It is possible the microcode has already been fully updated by your BIOS vendor. In that case the dmesg output does not contain the update log message.
Note
Be aware that injecting the microcode update directly into the motherboard firmware (which might sound tempting) might result in CPU0 being updated but the rest of the CPUs (or CPU cores in a multi-core system) being left at their initial revision (which might cause more problems than running them all at the same initial version). And, since most stock motherboard firmware has some microcode updates (even in their initial release versions), it's probably a good enough reason for everybody to make sure their kernel tries to update all CPUs (and cores) to the same version (so, let this update driver running even if the kernel has the same version which is stored in the motherboard firmware). Injecting the microcode into the firmware might be desirable still (to make sure it's loaded for the boot CPU before the kernel is loaded and able to update the rest of the microcode).

See also

External resources

Important
The microcode-ctl utility has been deprecated as of version 1.28-r1 (Gentoo unstable)[2] and was removed from the Gentoo repository.

References

  1. ↑ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6bcfdd75d53390a67f67237f4eafc77d9772056
  2. ↑ https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=719cc5ef240b766953ddbe1e7a6593f8091eed12 The microcode-ctl utility has been deprecated as of version 1.28-r1 (Gentoo unstable) and no longer contains the init script. It also does not work on certain CPUs such as Intel Haswells.
Retrieved from "https://wiki.gentoo.org/index.php?title=Intel_microcode&oldid=1339487"