intel-microcode for Debian
--------------------------

Introduction:

Intel® 64 and IA-32 processors (x86_64 and i686 processors) are capable of
field-upgrading their control program (microcode).  These microcode updates
correct processor errata, and are often important for safe, correct system
operation.

While most of the microcode updates fix problems that happen extremely
rarely, there are enough updates fixing issues that would cause system
lockup, memory corruption, or unpredictable system behaviour, to warrant
taking it seriously.

Microcode updates are ephemeral: they will be lost after a processor hard
reset or after the processor is powered off.  They must be reapplied at
every boot and after the system wakes up from suspend to RAM or disk.

Updating the processor microcode is the responsibility of the system
firmware (BIOS or EFI).  However, not all vendors will release timely
updates for their firmware when Intel releases updated microcode, and most
users don't update their system firmware in a timely fashion (or at all)
anyway.

The end result is that, unless some other method of distributing microcode
updates is in place, the processor in many systems will be running with
outdated microcode, increasing the chances of incorrect system operation.


Updating the system processor:

1. install the initramfs-tools, iucode-tool and intel-microcode packages;

2. configure the system to use a initramfs created by initramfs-tools
   during boot (Debian kernels do this by default);

NOTE: if you're compiling your own kernel, for Linux v3.9 and later you
      must make sure early microcode update support is compiled in (see
      below).

3. reboot (not strictly necessary in most cases).


Microcode update details:

Debian can apply microcode updates to the system processors during the
operating system boot, with the help of the intel-microcode and iucode-tool
packages.

When used with Linux v3.9 or later, Debian can provide microcode data to
the kernel to apply during inital system processor and platform setup.
This greatly reduces the chances of system malfunction due to any issues
that are corrected by the microcode update.  In some cases, early microcode
updates will allow the kernel to sidestep the need to disable
functionality.  For example the very serious "Atom PSE erratum" can be
completely worked around without disabling PSE support.

The early microcode update requires both kernel support and that the
iucode-tool package to be installed to work.  It also requires the use of
an initramfs built by "update-initramfs -u".  Kernels v3.9 and later must
have options CONFIG_MICROCODE_EARLY and CONFIG_MICROCODE_INTEL_EARLY
enabled.

For Linux v3.8 and earlier kernels, the early microcode update
funcionality is not available, and Debian will have to update the
microcode through the "microcode" driver.

The following configurations are supported for the "microcode"
driver:

1. When an initramfs image is used (Debian default), both modular and
   built-in configs for the microcode driver will work, and microcode
   will be updated by the initramfs.  You must run "update-initramfs -u"
   when new microcode is manually installed to /lib/firmware (this will
   be done automatically when new microcode is installed by a package
   upgrade).

2. When an initramfs image is not used, only the modular microcode
   driver is supported.  If it doesn't autoload by itself in your kernel
   version, you should add it to /etc/modules.  You must install either
   the kmod or module-init-tools package, and the root filesystem with
   /lib/firmware must be available when the modules are loaded.

When the iucode-tool package is installed, the initramfs helpers will
attempt to restrict the number of microcodes added to the initramfs to the
bare minimum.  This behaviour can be changed and fine-tuned through the
/etc/default/intel-microcode file.

Also, when iucode-tool is installed, microcode from files matching
/usr/share/misc/intel-microcode* will be considered.  This allows the
easy use of microcode.dat files distributed directly by Intel.  Be careful
to not leave old files there, or you may end up using microcode that Intel
stopped distributing on purpose because they don't want it being used by
the general public(!).

NOTE: in order to avoid triggering kernel workarounds that disable system
features because of some of the worst microcode bugs, the microcode MUST be
updated by the BIOS/EFI, by the bootloader itself, or by the early update
mode of the Linux kernel (v3.9 and later).


Downloading new microcode data from Intel:

A new version of the microcode bundle can be downloaded directly from
Intel, either by navigating to the support section looking for downloads
for your processor, or through one of these RSS feeds:

http://feeds.downloadcenter.intel.com/rss/?p=483&lang=eng
http://feeds.downloadcenter.intel.com/rss/?p=2371&lang=eng

To manually install the downloaded microcode bundle, unpack the archive you
got from Intel and copy the microcode-*.dat file from the archive to
/usr/share/misc/intel-microcode.dat.

You should make sure the microcode data file is owned by root, and that it
can only be written to by root (e.g. mode 0644) for security reasons:

	chown root:root /usr/share/misc/intel-microcode.dat
	chmod 0644 /usr/share/misc/intel-microcode.dat

After you install the updated intel-microcode.dat file, run as root:

	modprobe cpuid
	iucode_tool --scan-system --write-firmware /usr/share/misc/intel-microcode.dat
	update-initramfs -u

* Note: Intel is a registered trademark of Intel Corporation.

 -- Henrique de Moraes Holschuh <hmh@debian.org> Sat, 29 Jul 2012 10:31:24 -0300
