How to Install/Update Intel Microcode Firmware on Linux

If you are new to Linux system administration, how to install or update microcode firmware for Intel/AMD CPU using command line on Linux?

Microcode microcode is the CPU firmware provided by Intel/AMD. Linux's kernel can update CPU firmware at boot time without requiring a BIOS update. The processor's microcode is kept in memory, and the kernel can update this microcode each time the system is booted. These microcode updates from Intel/AMD can either fix bugs or use patches to prevent bugs. This article demonstrates how to install an AMD or Intel microcode update using the package manager or the Linux processor microcode update provided by Intel.

How to view the current microcode status

Run the following commands as root user:

# dmesg | grep microcode

The output is as follows:

Verify microcode update on a CentOS RHEL Fedora Ubuntu Debian Linux

Note that it is entirely possible for your CPU to have no microcode updates available here. If this is the case, its output might look like this:

[ 0.952699] microcode: sig=0x306a9, pf=0x10, revision=0x1c
[ 0.952773] microcode: Microcode Update Driver: v2.2.

How to Use a Package Manager to Install Microcode Firmware Updates on Linux

For Linux systems running on x86/amd64 architecture CPUs, Linux comes with tools to change or deploy microcode firmware. The procedure for installing AMD or Intel microcode firmware on Linux is as follows:

Open the terminal application
Debian/Ubuntu Linux user push input:sudo apt install intel-microcode
CentOS/RHEL Linux users enter:sudo yum install microcode_ctl

For popular Linux distributions, the package name is generally as follows:

microcode_ctl and linux-firmware - CentOS/RHEL microcode update package
intel-microcode - Microcode update packages for Intel CPUs for Debian/Ubuntu and derivative distributions
amd64-microcode - Microcode firmware for AMD CPUs for Debian/Ubuntu and derivative distributions
linux-firmware - Microcode firmware for Arch Linux distributions for AMD CPUs (you don't have to do anything, it's installed by default)
intel-ucode - Arch Linux distribution microcode firmware for Intel CPUs
microcode_ctl , linux-firmware and ucode-intel - Suse/OpenSUSE Linux microcode update packages

WARNING: In some cases, microcode updates can cause boot problems, for example, the server hangs or resets automatically during boot. The following steps were run on my machine and I am an experienced sysadmin. I am not responsible for any hardware failure caused by this. Before doing a firmware update, please fully evaluate the operational risk!

Example

On Debian/Ubuntu Linux systems with Intel CPUs, enter the following apt command / apt-get command :

$ sudo apt-get install intel-microcode

Example output is as follows:

How to install Intel microcode firmware Linux

You must restart the server to activate the microcode update:

$ sudo reboot

Check the microcode status after reboot:

# dmesg | grep 'microcode'

Example output is as follows:

[ 0.000000] microcode: microcode updated early to revision 0x1c, date = 2015-02-26
[ 1.604672] microcode: sig=0x306a9, pf=0x10, revision=0x1c
[ 1.604976] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba

If you are using a RHEL/CentOS system, use the yum command to try to install or update the following two packages:

$ sudo yum install linux-firmware microcode_ctl
$ sudo reboot
$ sudo dmesg | grep 'microcode'

How to update/install microcode downloaded from Intel website

Use the following methods to update/install microcode only if your CPU manufacturer recommends doing so, otherwise, the above methods should be used to update. Most Linux distributions can maintain and update the microcode through a package manager. The method of using the package manager is tested and is the safest way for most users.

How to Install Intel Processor Microcode Blocks for Linux (Released 20180108)

First go to the AMD or Intel website to get the latest microcode firmware. In this example, I have a file named ~/Downloads/microcode-20180108.tgz (don't forget to verify its checksum) and its purpose is to prevent meltdown/Spectre bugs. First use the tar command to extract it:

$ mkdir firmware
$ cd firmware
$ tar xvf ~/Downloads/microcode-20180108.tgz
$ ls -l

Example output is as follows:

drwxr-xr-x 2 vivek vivek 4096 Jan 8 12:41 intel-ucode
-rw-r--r-- 1 vivek vivek 4847056 Jan 8 12:39 microcode.dat
-rw-r--r-- 1 vivek vivek 1907 Jan 9 07:03 releasenote

I have only tested the following on CentOS 7.x/RHEL, 7.x/Debian 9.x and Ubuntu 17.10. /sys/devices/system/cpu/microcode/reload Older kernels from older distributions may not be able to use this method if you don't find the file. See discussion below. Note that some customers have experienced system reboots after applying a firmware update. Especially for systems running on Intel Broadwell and Haswell CPUs for clients and data center servers. Do not apply version 20180108 on Intel Broadwell and Haswell CPUs. Use the package manager way whenever possible.

Check to make sure there is /sys/devices/system/cpu/microcode/reload:

$ ls -l /sys/devices/system/cpu/microcode/reload

You must use the cp command to copy intel-ucode all files in the directory to the /lib/firmware/intel-ucode/ following:

$ sudo cp -v intel-ucode/* /lib/firmware/intel-ucode/

You just need to intel-ucode copy the entire /lib/firmware/ directory to the directory. Then write in the reload interface 1to reload the microcode file:

# echo 1 > /sys/devices/system/cpu/microcode/reload

Update the existing initramfs so that it can be loaded by the kernel on the next boot:

$ sudo update-initramfs -u
$ sudo reboot

After restarting, verify that the microcode has been updated by running the following command:

# dmesg | grep microcode

So far, it's all about updating the processor's microcode. If all goes well, your Intel CPU's firmware will already be up to date.

Reprinted to https://linux.cn/article-9411-1.html