tony37 wrote: Tue Nov 03, 2020 10:03 am
What is it about the microcode you are worried about?
I developed this interest after discovering that my meticulous updating regimen of an occasional "aptitude update;aptitude full-upgrade" had left me on the same kernel for +-3 years, which rocked my naively trusting worldview. Now I am wondering what else has been neglected. At around the same time I heard of spectre-meltdown-checker, which, while it might be a little obsessively focused, did help to alert me to the outdated-kernel issue. With a lot of help from the forum MXers, I now have a more recent kernel, which I hope will receive ongoing updates.
However, spectre-meltdown-checker seems not entirely satisfied with this, and offers such encouraging comments as:
STATUS: VULNERABLE (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
and
CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: NO
> STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability)
> How to fix: The microcode of your CPU needs to be upgraded to mitigate this vulnerability. This is usually done at boot time by your kernel (the upgrade is not persistent across reboots which is why it's done at each boot). If you're using a distro, make sure you are up to date, as microcode updates are usually shipped alongside with the distro kernel. Availability of a microcode update for you CPU model depends on your CPU vendor. You can usually find out online if a microcode update is available for your CPU by searching for your CPUID (indicated in the Hardware Check section). The microcode update is enough, there is no additional OS, kernel or software change needed.
Sadly, I lack the wit to make much sense of these helpful hints, but my wishfulthinkotron translates that last comment "The microcode update is enough, there is no additional OS, kernel or software change needed." as "Clever, competent people will fix the problem for me, without me having to do anything" which, you must admit, is a cheering straw to clutch at.
On this subject, I commented out the blacklist for "microcode", so I hope this means my boot is trying to load it?
Code: Select all
$ cat /etc/modprobe.d/intel-microcode-blacklist.conf
# The microcode module attempts to apply a microcode update when
# it autoloads. This is not always safe, so we block it by default.
##blacklist microcode
I tried a boot with each kernel, but the results were not positive - what am I doing wrong?
Code: Select all
$ aptitude search 'ucode ?installed' 'microcode ?installed'
i amd64-microcode - Processor microcode firmware for AMD CPUs
i intel-microcode - Processor microcode firmware for Intel CPUs
i iucode-tool - Intel processor microcode tool
$ uname -a
Linux brain 4.13.0-1-amd64 #1 SMP Debian 4.13.13-1mx17 (2017-11-18) x86_64 GNU/Linux
yyy@zzz:~
$ lsmod | grep -i micro
yyy@zzz:~
$ sudo modprobe -v microcode
modprobe: FATAL: Module microcode not found in directory /lib/modules/4.13.0-1-amd64
yyy@zzz:~
$
$ uname -a
Linux brain 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1~mx17+1 (2020-10-20) x86_64 GNU/Linux
yyy@zzz:~
$ lsmod | grep -i micro
yyy@zzz:~
$ sudo modprobe -v microcode
[sudo] password for paul:
modprobe: FATAL: Module microcode not found in directory /lib/modules/4.19.0-12-amd64
So, questions:
1) Is there anything more I need to do to get my system up to date so that it stays up to date? One suggestion seems to be "update the microcode", but
1a) Is this possible?
1b) Is this necessary?
1c) How?
Thinking outside the box:
A fresh install of MX19 is an option - I have one ready and waiting - but I kinda like ecryptfs, which is not (yet) available there.
A fresh install of MX18.1 is an option (I have the media at hand) - would this neatly overcome the concern about what updates have been neglected? The Migration page says
Code: Select all
From MX-18 to MX-18.3
Update will be automatic through the normal update process.
but then again, it said something "similar" about migration from 17 to 18
Admittedly, it's basically laziness that has stopped this. And pride....I hoped I had left "Just reinstall" behind. And I would still have to fight with getting abcde to work with converting my CDs (another thread planned). And I am learning quite a bit, though it will probably all be forgotten within days.
