9

I want to upgrade my system to mitigate Spectre and Meltdown exploits.

The relevant Ubuntu page states that I need to update microcodes: "From a guest and non-hypervisor bare-metal perspective, as of the Feb 21 kernel updates, as far as we are aware, the mitigations for Spectre and Meltdown on 64-bit amd64, ppc64el and s390x are feature-complete as long as all microcode, firmware and hypervisor updates underneath the system are done. ..."

I have intel-microcode and iucode-tool installed and updated, however running dmesg | grep -i microcode and grep -i microcode /var/log/syslog* return nothing which makes me think that either the cpu microcode doesn't get updated or something else is wrong.

Packages are up to date and there have been restarts since the last update.

operating system: Lubuntu 16.04

CPU: Intel N3700 (Braswell)

enabled software repos: main, universe

enabled updates: xenial-security

Edit:
The output of grep name /proc/cpuinfo | sort -u is
model name : Intel(R) Pentium(R) CPU N3700 @ 1.60GHz

My processor is not Skylake, nor Kaby lake.

In /proc/cpuinfo hyper-threading shows up as supported, but this Intel page says it is not supported:
https://ark.intel.com/products/87261/Intel-Pentium-Processor-N3700-2M-Cache-up-to-2_40-GHz

Edit 2:
I ran sudo update-initramfs -u and rebooted. The outputs are still the same.

Output of /usr/sbin/iucode_tool -tb -lS /lib/firmware/intel-ucode/*:

/usr/sbin/iucode_tool: system has processor(s) with signature 0x000406c3
selected microcodes:

It seems that there is no updated microcode for my cpu, which is interesting since there was a selectable microcode in the Additional Drivers tab previously (late 2017); now, there isn't.

Edit 3:
Output of apt list --installed | grep intel-microcode:

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

intel-microcode/xenial-security,now 3.20180108.0+really20170707ubuntu16.04.1 amd64 [installed]

Edit 4:
Now I understand that there is no update for the cpu microcode, which means that the original problem is solved, and I will leave it as it is.

However, dmesg and journalctl -b should still output lines about microcode version, I believe.
I also noticed that these boot logs start at "5" instead of the tipical 1 or 0, and that there is a repeating error message which makes them truncated (dmesg says nothing about truncation, but journalctl says there are 371635 missed kernel messages, see below). I will ignore this for now.

March 19 06:36:40 NN systemd-journald[266]: Runtime journal (/run/log/journal/) is 8.0M, max 78.9M, 70.9M free.
March 19 06:36:40 NN systemd-journald[266]: Missed 371635 kernel messages
March 19 06:36:40 NN kernel: handle_bad_irq+0x0/0x230
March 19 06:36:40 NN kernel: ->irq_data.chip(): ffffffffbb172c40, 
March 19 06:36:40 NN kernel: chv_gpio_irqchip+0x0/0x120
March 19 06:36:40 NN kernel: ->action():           (null)
March 19 06:36:40 NN kernel:    IRQ_NOPROBE set
March 19 06:36:40 NN kernel: irq 115, desc: ffff9b91f5df8200, depth: 1, count: 0, unhandled: 0
March 19 06:36:40 NN kernel: ->handle_irq():  ffffffffb9ee8f70, 
March 19 06:36:40 NN kernel: handle_bad_irq+0x0/0x230
March 19 06:36:40 NN kernel: ->irq_data.chip(): ffffffffbb172c40, 
March 19 06:36:40 NN kernel: chv_gpio_irqchip+0x0/0x120
March 19 06:36:40 NN kernel: ->action():           (null)
March 19 06:36:40 NN kernel:    IRQ_NOPROBE set
March 19 06:36:40 NN kernel: irq 115, desc: ffff9b91f5df8200, depth: 1, count: 0, unhandled: 0
March 19 06:36:40 NN kernel: ->handle_irq():  ffffffffb9ee8f70, 
March 19 06:36:40 NN kernel: handle_bad_irq+0x0/0x230
March 19 06:36:40 NN kernel: ->irq_data.chip(): ffffffffbb172c40, 
March 19 06:36:40 NN kernel: chv_gpio_irqchip+0x0/0x120
March 19 06:36:40 NN kernel: ->action():           (null)
March 19 06:36:40 NN kernel:    IRQ_NOPROBE set
March 19 06:36:40 NN kernel: irq 115, desc: ffff9b91f5df8200, depth: 1, count: 0, unhandled: 0
March 19 06:36:40 NN kernel: ->handle_irq():  ffffffffb9ee8f70, 
March 19 06:36:40 NN kernel: handle_bad_irq+0x0/0x230
March 19 06:36:40 NN kernel: ->irq_data.chip(): ffffffffbb172c40, 
March 19 06:36:40 NN kernel: chv_gpio_irqchip+0x0/0x120
7
  • 1
    Here are detailed instructions on checking microcode on debian systems - lists.debian.org/debian-devel/2017/06/msg00308.html . Post the output of those commands. Start by identifying your processor with grep name /proc/cpuinfo | sort -u and note "Some of the processors in these two lists are not affected because they lack hyper-threading support. Run the command below in a command line shell (e.g. xterm), and it will output a message if hyper-threading is supported/enabled:" grep -q '^flags.*[[:space:]]ht[[:space:]]' /proc/cpuinfo && echo "Hyper-threading is supported"
    – Panther
    Mar 18, 2018 at 11:43
  • I edited the question. Mar 18, 2018 at 15:07
  • Can you please run sudo update-initramfs -u && sudo reboot and check again after reboot.
    – Panther
    Mar 18, 2018 at 16:03
  • 1
    Maybe there isn't a microcode for your cpu in ubuntu's package. run this to see /usr/sbin/iucode_tool -tb -lS /lib/firmware/intel-ucode/*
    – doug
    Mar 18, 2018 at 20:07
  • 1
    In "late 2017" you possibly had micro code for your cpu based on attempted spectre/meltdown fixes. That code has been removed/, i.e. the bundle has been reverted to previous which has nothing needed for your cpu.
    – doug
    Mar 19, 2018 at 11:24

3 Answers 3

5

Based on results of /usr/sbin/iucode_tool -tb -lS /lib/firmware/intel-ucode/* no microcode is being loaded for your cpu because at the moment there is none. That doesn't mean that there won't be in the future. You can safely leave intel-microcode and iucode-tool installed, if there is an update containing microcode for your cpu's signature it will then be used.

2

Bug in Meltdown/Spectre Intel Microcode

There was a bug in early 2018 Intel Microcode update to address Meltdown/Spectre security holes. As such the microcode had to be rolled back to a previous version.

Here is the microcode I'm using (having opted out of all updates starting January 2018):

$ apt list --installed | grep intel-microcode

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

intel-microcode/now 3.20170707.1~ubuntu16.04.0 amd64 [installed,upgradable to: 3.20180108.0+really20170707ubuntu16.04.1]

When you install Intel Microcode Update you will get this version or something similar:

intel-microcode/3.20180108.0+really20170707ubuntu16.04.1

Ubuntu 16.04 LTS Menu

I'm not sure about Lubuntu menu structure but for regular Ubuntu this is how you access the Intel Microcode Update controls:

Additional Drivers.png

The bottom option controls Intel Microcode Updates.

Install Intel Microcode from CLI

To skip the GUI menus altogether you can install from command line:

sudo apt update
sudo apt install intel-microcode

dmesg now shows correct output

After following the installation steps dmesg returns the desired output (unlike in your question where it shows nothing):

$ dmesg | grep -i microcode
[    1.166542] microcode: sig=0x506e3, pf=0x20, revision=0xba
[    1.166993] microcode: Microcode Update Driver: v2.2.
[16082.584598] microcode: microcode updated early to revision 0xba, date = 2017-04-09
8
  • In the question the OP clearly states "I have intel-microcode and iucode-tool installed and updated" so I am not really sure how this helps.
    – Panther
    Mar 18, 2018 at 19:02
  • @Panther I missed adding my dmesg output I originally had when I started writing the answer. I'll add that in. Basically after following the installation steps the dmesg output appears as it is supposed to. Mar 18, 2018 at 19:05
  • The OP also clearly states "running dmesg | grep -i microcode and grep -i microcode /var/log/syslog* return nothing" . I suspect we need to run sudo update-initramfs -u && sudo reboot
    – Panther
    Mar 18, 2018 at 19:22
  • @Panther It first appeared to me that microcode wasn't installed correctly. Good point about rebooting. The OP mentions nothing about that. I'll monitor OP's future reply to your comment under his question. I'm not sure about update-initramfs -u being needed as it's not listed here: askubuntu.com/questions/545925/…. However it never hurts. Mar 18, 2018 at 19:50
  • The microcode is normally part of the initramfs and is loaded during boot so, although not expected, I am suggesting rebuilding the initramfs as a possible fix to the OP unusual situation. Would help if we knew which microcode was installed.
    – Panther
    Mar 18, 2018 at 19:52
2

Ubuntu had released fixed kernal update against this exploit. The new kernal have required changes.

Reference: SecurityTeam/KnowledgeBase/SpectreAndMeltdown | Ubuntu Wiki

I am in Ubuntu 16.04, Using Nouveau display driver. In my case, Intel-microcode got uninstalled after installing new kernel.

This update is released right after intel had released bug fix for spectre bugs security vulnerability.

This should solve your problem.

If you got intel property driver replaced like in my place and still want intel-microcode property driver.

Intel Releases Linux CPU Microcodes To fix Meltdown & Spectre Bugs | bleepingcomputer.com

Currently, the new drivers are not included in Ubuntu ppa. Users may have to download it manually from Intel website.

Warning: This may cause driver conflict or instability in your Ubuntu. You have to install it on your own risk.

Download Linux Processor Microcode Data File | downloadcenter.intel.com

For me, I have no issue in my ubuntu laptop. So I don't want to take risk. I left Ubuntu team to decide what is best from my system. I am waiting update from Ubuntu driver team.

10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .