Re: ANNOUNCEMENT: Intel processor microcode security update

[Elimar Riesebieter <riesebie@lxtec.de>]

* Henrique de Moraes Holschuh <hmh@debian.org> [2013-09-07 18:55 -0300]:

> On Sat, 07 Sep 2013, Elimar Riesebieter wrote:
> > * Elimar Riesebieter <riesebie@lxtec.de> [2013-09-07 15:32 +0200]:
> > > ACK, loaded as module. Thanks for the hint. But I can't find a note
> > > on how to verify the new microcode is loaded?
> > 
> > $ dmesg | grep micro
> > microcode: CPU0 sig=0x10676, pf=0x80, revision=0x610
> > microcode: CPU1 sig=0x10676, pf=0x80, revision=0x610
> > microcode: Microcode Update Driver: v2.00 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
> 
> Which means not updated (hint: no "updated" messages in the log).
> 
> Now, the intel-microcode changelog has this to say about sig 0x10686:
>     + Updated Microcodes:
>       sig 0x00010676, pf mask 0x01, 2010-09-29, rev 0x060f, size 4096
>       sig 0x00010676, pf mask 0x04, 2010-09-29, rev 0x060f, size 4096
>       sig 0x00010676, pf mask 0x10, 2010-09-29, rev 0x060f, size 4096
>       sig 0x00010676, pf mask 0x40, 2010-09-29, rev 0x060f, size 4096
>       sig 0x00010676, pf mask 0x80, 2010-09-29, rev 0x060f, size 4096
> 
> Your pf=0x80 is listed in there, rev 0x60f.  Your BIOS actually has *newer*
> microcode than what is present in intel-microcode.  I cross-checked with
> iucode-tool, and that's correct.
> 
> You might still benefit from intel-microcode if you have it installed and
> the non-free/proposed-updates repositories set up, as a future microcode
> update from Intel might have a newer version than 0x610, and you'd get it
> automatically along with any other package updates.
> 
> PS: note that *any* pfmask with bit 7 set (0x80 = 10000000b) would apply to
> your processor.  The rule is: if the signatures are the same, and "(pf &
> pfmask) == pf", the microcode is suitable for that processor.

Thank you very much for all the information ;-)

Elimar
-- 
  Experience is something you don't get until
  just after you need it!