Intel microcode

This article Article description::describes the process of updating the [[microcode on Intel processors.]]

Kernel
The following kernel support is required to be built-in:

Emerge
Install the microcode firmware package and the manipulation tool:

Configuration
To manually generate the microcode cpio archive use :

Genkernel
If you use to generate your initrd then add the  option to have it prepend an early cpio with the Intel and AMD microcode inside. No modifications to your bootloader config are necessary below.

Syslinux
Multiple initrd files are separated by commas in the  line. Set to load first:

GRUB Legacy
Add the generated microcode to the kernel command-line as the first. The root initramfs goes second separated by space. This step is necessary even if the system does not use an initrd image in order to boot. The microcode update merely leverages the initrd hooks:

GRUB
GRUB supports loading an early microcode. If the microcode file is named as showed above, it will be automatically detected when running. To declare a microcode file named differently, e.g., add this line to :

Regenerate the with:

Or edit directly to add the  as your first initrd:

Reboot and you're all done.

rEFInd
This example system has the EFI partition mounted to. The Linux kernel and initrd files have been placed in on the Linux rootfs.

If you are using the initrd keyword instead of the options keyword for specifying initrd, then try specifying multiple initrd files via separate initrd keywords, or migrate the declarations into options. Specifying multiple initrd via one initrd keyword fails on rEFInd. As always, make sure is the first initrd specified.

You can review and edit the kernel cmdline options from the rEFInd bootloader. With your Gentoo OS entry highlighted, press to access the menu entries, and press  again over the desired entry to review and edit. This is very useful for quick experimenting without need to edit.

See for keyword descriptions and The rEFInd Homepage for more on how to use rEFInd.

systemd-boot
Add the microcode as an argument to an initrd line. If you already have an initrd line, ensure the microcode line occurs first. The path to the microcode should be absolute to the root of the ESP.

For more information, see The Boot Loader Specification.

Xen (EFI)
Add a line to your with the ucode option. The path to the microcode is relative to the binary, so you will need to write the microcode into the correct location (default is ) or copy it there.

For more information, see the Xen EFI documentation.

Verification
Here is an example of a CPU with no available microcode updates (microcode already current) or the system was not configured to load them properly:

Here is the same CPU but with microcode updates being applied successfully:

The loaded microcode revision can be verified by running:

Kernel
Activate the following kernel options:

Software
Install :

OpenRC
Start microcode-ctl:

To start microcode-ctl at boot time, add it your boot runlevel:

systemd
See: Systemd. Simply make sure that the Microcode loader is set as a module in the kernel configuration as noted above. You don't need to add a service or do anything else.

Software
The -20171117-r1 package has been rewritten to use to process microcode data files. Users can now use the MICROCODE_SIGNATURES variable to install only a subset of microcode data files.

To install microcode data files for the system processor(s):

To install microcode data files for a specific processor use, or   to exclude a specific processor. An empty or undefined MICROCODE_SIGNATURES variable will install all microcode data files.

Install the microcode data files:

The -20171117-r1 installs which can be used to identify the processor signature(s).

To find the appropriate filename(s) for the listed signature(s) use:

The signature is found in microcode bundle, so the filename to use is.

Kernel
Enable and configure the CONFIG_MICROCODE, CONFIG_MICROCODE_INTEL , CONFIG_FIRMWARE_IN_KERNEL , CONFIG_EXTRA_FIRMWARE and CONFIG_EXTRA_FIRMWARE_DIR kernel options. The options must be built-in.

Rebuild and install the kernel as usual.

Verification
After the next reboot, you should see something like this:

External resources

 * http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html - An example unofficial source for microcodes