intel-microcode for Debian
--------------------------

Introduction:

Intel® 64 and IA-32 processors (x86_64 and i686 processors) are capable of
field-upgrading their control program (microcode).  These microcode updates
correct processor errata, and are often important for safe, correct system
operation.

While most of the microcode updates fix problems that happen extremely
rarely, there are enough updates fixing issues that would cause system
lockup, memory corruption, or unpredictable system behaviour, to warrant
taking it seriously.

Microcode updates are ephemeral: they will be lost after a processor hard
reset or after the processor is powered off.  They must be reapplied at
every boot and after the system wakes up from suspend to RAM or disk.

Updating the processor microcode is the responsibility of the system
firmware (BIOS or EFI).  However, not all vendors will release timely
updates for their firmware when Intel releases updated microcode, and most
users don't update their system firmware in a timely fashion (or at all)
anyway.

The end result is that, unless some other method of distributing microcode
updates is in place, the processor in many systems will be running with
outdated microcode, increasing the chances of incorrect system operation.

Debian can apply microcode updates to the system processors during the
operating system boot, with the help of the intel-microcode and iucode-tool
packages.  The following configurations are supported for the microcode
driver:

1. When an initramfs image is used (Debian default), both modular and
   built-in configs for the microcode driver will work, and microcode
   will be updated by the initramfs.  You must run "update-initramfs -u"
   when new microcode is manually installed to /lib/firmware (this will
   be done automatically when new microcode is installed by a package
   upgrade).

2. When an initramfs image is not used, only the modular microcode
   driver is supported.  If it doesn't autoload by itself in your kernel
   version, you should add it to /etc/modules.  You must install either
   the kmod or module-init-tools package, and the root filesystem with
   /lib/firmware must be available when the modules are loaded.

   This used to be safe, but since the 20140913 microcode update, we
   cannot assume it to be true anymore.  A microcode update may disable
   functionality currently in use by running processes, causing a
   disaster.  Always prefer method 1.

   Some microcodes are blacklisted from direct use by the microcode
   module.  If you need one of them, you are strongly advised to switch
   to an initramfs configuration.

When the iucode-tool package is installed, the initramfs helpers will
attempt to restrict the number of microcodes added to the initramfs to the
bare minimum.  This behaviour can be changed and fine-tuned through the
/etc/default/intel-microcode file.

Also, when iucode-tool is installed, microcode from files matching
/usr/share/misc/intel-microcode* will be considered.  This allows the
easy use of microcode.dat files distributed directly by Intel.  Be careful
to not leave old files there, or you may end up using microcode that Intel
stopped distributing on purpose because they don't want it being used by
the general public(!).

NOTE: in order to avoid triggering kernel workarounds that disable system
features because of some of the worst microcode bugs, the microcode MUST be
updated by the BIOS/EFI, by the bootloader itself, or by the kernel with
microcode data supplied by the bootloader.

NOTE FOR USERS OF NEWER (CUSTOM/BACKPORTED) KERNELS: If your Debian system
is running a custom or backported Linux kernel version 3.10 or newer,
please use the backported intel-microcode packages and the "early
initramfs" method of updating microcode.


Downloading new microcode data from Intel:

A new version of the microcode bundle can be downloaded directly from
Intel, either by navigating to the support section looking for downloads
for your processor, or through one of these RSS feeds:

http://feeds.downloadcenter.intel.com/rss/?p=483&lang=eng
http://feeds.downloadcenter.intel.com/rss/?p=2371&lang=eng

To manually install the downloaded microcode bundle, unpack the archive you
got from Intel and copy the microcode-*.dat file from the archive to
/usr/share/misc/intel-microcode.dat.

You should make sure the microcode data file is owned by root, and that it
can only be written to by root (e.g. mode 0644) for security reasons:

	chown root:root /usr/share/misc/intel-microcode.dat
	chmod 0644 /usr/share/misc/intel-microcode.dat

After you install the updated intel-microcode.dat file, run as root:

	modprobe cpuid
	iucode_tool --scan-system --write-firmware /usr/share/misc/intel-microcode.dat
	update-initramfs -u

* Note: Intel is a registered trademark of Intel Corporation.

 -- Henrique de Moraes Holschuh <hmh@debian.org> Sat, 29 Jul 2012 10:31:24 -0300
