Shipped intel-microcode differs from source

[Vinson Lee]

Several of the Intel microcode files that are shipped in intel-microcode_1.20130906.1ubuntu2 differ from the original source.

$ dpkg -l | grep intel-microcode
ii intel-microcode 1.20130906.1ubuntu2 amd64 Processor microcode firmware for Intel CPUs

$ wget http://archive.ubuntu.com/ubuntu/pool/multiverse/i/intel-microcode/intel-microcode_1.20130906.1ubuntu2.tar.xz
$ tar -xJf intel-microcode_1.20130906.1ubuntu2.tar.xz
$ mkdir intel-ucode
$ iucode-tool --write-firmware=intel-ucode intel-microcode-1.20130906.1ubuntu2/microcode-20130906.dat

$ diff -r intel-ucode /lib/firmware/intel-ucode
Only in intel-ucode: 06-03-02
Only in intel-ucode: 06-05-00
Only in intel-ucode: 06-05-01
Only in intel-ucode: 06-05-02
Only in intel-ucode: 06-05-03
Only in intel-ucode: 06-06-00
Only in intel-ucode: 06-06-05
Only in intel-ucode: 06-06-0a
Only in intel-ucode: 06-06-0d
Only in intel-ucode: 06-07-01
Only in intel-ucode: 06-07-02
Only in intel-ucode: 06-07-03
Only in intel-ucode: 06-08-01
Only in intel-ucode: 06-08-03
Only in intel-ucode: 06-08-06
Only in intel-ucode: 06-08-0a
Only in intel-ucode: 06-09-05
Only in intel-ucode: 06-0a-00
Only in intel-ucode: 06-0a-01
Only in intel-ucode: 06-0b-01
Only in intel-ucode: 06-0b-04
Only in intel-ucode: 06-0d-06
Only in intel-ucode: 06-0e-08
Only in intel-ucode: 06-0e-0c
Binary files intel-ucode/06-0f-02 and /lib/firmware/intel-ucode/06-0f-02 differ
Binary files intel-ucode/06-0f-06 and /lib/firmware/intel-ucode/06-0f-06 differ
Binary files intel-ucode/06-0f-07 and /lib/firmware/intel-ucode/06-0f-07 differ
Binary files intel-ucode/06-0f-0b and /lib/firmware/intel-ucode/06-0f-0b differ
Binary files intel-ucode/06-0f-0d and /lib/firmware/intel-ucode/06-0f-0d differ
Binary files intel-ucode/06-16-01 and /lib/firmware/intel-ucode/06-16-01 differ
Only in intel-ucode: 06-26-01
Only in intel-ucode: 0f-00-07
Only in intel-ucode: 0f-00-0a
Only in intel-ucode: 0f-01-02
Only in intel-ucode: 0f-02-04
Only in intel-ucode: 0f-02-05
Only in intel-ucode: 0f-02-06
Only in intel-ucode: 0f-02-07
Only in intel-ucode: 0f-02-09
Only in intel-ucode: 0f-03-02
Only in intel-ucode: 0f-03-03
Only in intel-ucode: 0f-03-04
Binary files intel-ucode/0f-06-05 and /lib/firmware/intel-ucode/0f-06-05 differ

[Henrique de Moraes Holschuh (hmh)]

On Mon, 18 Nov 2013, vlee wrote:
> Several of the Intel microcode files that are shipped in intel-
> microcode_1.20130906.1ubuntu2 differ from the original source.

iucode-tool is specifically engineered to not be able to modify microcode,
not even its metadata.

> $ tar -xJf intel-microcode_1.20130906.1ubuntu2.tar.xz
> $ mkdir intel-ucode
> $ iucode-tool --write-firmware=intel-ucode intel-microcode-1.20130906.1ubuntu2/microcode-20130906.dat

That is not how the package is built, therefore it is no wonder you won't
get the same result.

Read the main Makefile and also the debian/rules Makefile.

The package collects microcode from several microcode packs so as to be able
to support Pentium-II/Pentium-III boxes and original Xeon boxes which Intel
does not support anymore, for example. I don't know about Ubuntu, but
Debian and some of its derivatives still have a lot of users running on very
old (more than 10 years old) boxes.

The per-family-model-stepping microcode mini-packs in
/lib/firmware/intel-ucode have microcode for more than one processor
(family-model-stepping/F-M-S does NOT uniquely identify an Intel processor
model). When we add a microcode for a processor with the same F-M-S numbers
as one that Intel is still supporting in the latest microcode pack, the
mini-pack for /lib/firmware will be different because of the added
microcode.

It is worth noting that iucode-tool's sort order is not stabilized: it
depends on the particular set of input files you give to it in some boundary
conditions, and therefore two runs with different input files (or different
file ordering in the command line) may output microcodes in a slightly
different order, which would also cause "diff" to complain that files are
different.

If you want to compare microcode, use iucode-tool -W<directory> to get it to
write one microcode per file, and compare those. Also, read the
iucode-tool(8) manpage, option "--strict-checks" (which is enable by
default).

--
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh

[Michael Terry (mterry)]

Based on Henrique's comment, I'll close this bug.