3 ms·

You are correct. uCode is installed by the BIOS, and then again later by the OS if there's more recently updated code.

by burnte 9y ago

tomxor 9y ago
Out of interest, do you know if the process of uploading the microcode via the OS independent of the BIOS? ... e.g on something with an unusual boot ROM like a mac or a Pi (pretend it had an x86) would the kernel not care? i.e it's just a CPU instruction?
- burnte 9y ago
  Yes, it is. OSes protect that ability to prevent malicious microcode, too. The update mechanism is published by Intel, too. Section 9.11 (not page 9.11) https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.pdf https://www.intel.com/content/dam/www/public/us/en/documents...
  - tomxor 9y ago
    I always assumed that the CPU itself would have an internal signature verification mechanism built in. But after searching it seems the OS or BIOS is responsible for quite a lot... I haven't found anything clearly stating if and where cryptographic signatures are verified. Once source at least suggested that it's only present on >2013 CPUs ! [edit] This is an interesting old paper on x86 microcode security: https://www.dcddcc.com/docs/2014_paper_microcode.pdf https://www.dcddcc.com/docs/2014_paper_microcode.pdf
- AnssiH 9y ago
  It should be independent, the Linux x86 microcode code ( https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/microcode/intel.c https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... and /amd.c) seems to write to MSR (model-specific register) 0x79 on Intel and MSR 0xc0010020 on AMD.
mjevans 9y ago
For Linux this is typically handled as an extra 'initrd' that the bootloading process hands off to before giving control over to the next (and real) initrd... https://wiki.archlinux.org/index.php/microcode#Enabling_Intel_microcode_updates https://wiki.archlinux.org/index.php/microcode#Enabling_Inte...

You are correct. uCode is installed by the BIOS, and then again later by the OS if there's more recently updated code.

by burnte 9y ago

You are correct. uCode is installed by the BIOS, and then again later by the OS if there's more recently updated code.

Out of interest, do you know if the process of uploading the microcode via the OS independent of the BIOS? ... e.g on something with an unusual boot ROM like a mac or a Pi (pretend it had an x86) would the kernel not care? i.e it's just a CPU instruction?

burnte 9y ago
Yes, it is. OSes protect that ability to prevent malicious microcode, too. The update mechanism is published by Intel, too. Section 9.11 (not page 9.11) https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.pdf https://www.intel.com/content/dam/www/public/us/en/documents...
- tomxor 9y ago
  I always assumed that the CPU itself would have an internal signature verification mechanism built in. But after searching it seems the OS or BIOS is responsible for quite a lot... I haven't found anything clearly stating if and where cryptographic signatures are verified. Once source at least suggested that it's only present on >2013 CPUs ! [edit] This is an interesting old paper on x86 microcode security: https://www.dcddcc.com/docs/2014_paper_microcode.pdf https://www.dcddcc.com/docs/2014_paper_microcode.pdf
AnssiH 9y ago
It should be independent, the Linux x86 microcode code ( https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/microcode/intel.c https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... and /amd.c) seems to write to MSR (model-specific register) 0x79 on Intel and MSR 0xc0010020 on AMD.

mjevans 9y ago

For Linux this is typically handled as an extra 'initrd' that the bootloading process hands off to before giving control over to the next (and real) initrd... https://wiki.archlinux.org/index.php/microcode#Enabling_Intel_microcode_updates https://wiki.archlinux.org/index.php/microcode#Enabling_Inte...