Arch Linux

Heronymous

Member

Registered: 2016-08-18

Posts: 11

[Solved] Microcode Updating using Xen with Arch dom0

Hi,

I have configured my system so that I have Arch sitting as dom0 on a Xen hypervisor and I'm struggling with how to get xen to load the microcode provided by the intel-ucode package.  I have modified a grub menuentry so that it contains the following:

...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=scan xsave=1
...
module2 /initramfs-linux.img
module2 /intel-ucode.img

where

 ...ucode=scan... 

and

 module2 /intel-ucode.img 

are my changes.

My expected outcome is that

dmesg | grep microcode

returns info about the microcode. Instead I get:

 [    7.305936] MDS: Vulnerable: Clear CPU buffers attempted, no microcode

I have tried

...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=-1 xsave=1
...
module2 /initramfs-linux.img
module2 /intel-ucode.img

where scan was changed to -1, but this does not help. Can someone point to what I am doing wrong? Thank you in advance.

Last edited by Heronymous (2019-08-03 16:44:33)

---

For every debit, there is a credit.

loqs

Member

Registered: 2014-03-06

Posts: 19,101

Re: [Solved] Microcode Updating using Xen with Arch dom0

What if you reverse the order of the initrds so ucode is listed first?

...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=scan xsave=1
...
module2 /intel-ucode.img
module2 /initramfs-linux.img

Heronymous

Member

Registered: 2016-08-18

Posts: 11

Re: [Solved] Microcode Updating using Xen with Arch dom0

What if you reverse the order of the initrds so ucode is listed first?

...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=scan xsave=1
...
module2 /intel-ucode.img
module2 /initramfs-linux.img

That doesn't seem to work either. In fact, it causes a kernel panic, so I guess xen (or multiboot) expects the initramfs to be the second module2 (the first being the kernel itself).

---

For every debit, there is a credit.

loqs

Member

Registered: 2014-03-06

Posts: 19,101

Re: [Solved] Microcode Updating using Xen with Arch dom0

Looking at [1] and [2] I would suggest trying extracting the intel-ucode.img placing

mv initramfs-linux.img initramfs-linux.img.orig
cat intel-ucode.img initramfs-linux.img.orig > initramfs-linux.img try that with the config stanze
...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=scan xsave=1
...
module2 /initramfs-linux.img

If that method fails extract GenuineIntel.bin from /boot/intel-ucode.img place it as /boot/GenuineIntel.bin and try with the boot stanza
...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=1 xsave=1
...
module2 /initramfs-linux.img
module2 /GenuineIntel.bin
...
or if it is an EFI system the stanza appears to be
...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=GenuineIntel.bin xsave=1
...
module2 /initramfs-linux.img

[1] https://www.suse.com/support/kb/doc/?id=7022546
[2] https://www.kernel.org/doc/Documentatio … rocode.txt

Heronymous

Member

Registered: 2016-08-18

Posts: 11

Re: [Solved] Microcode Updating using Xen with Arch dom0

Looking at [1] and [2] I would suggest trying extracting the intel-ucode.img placing

mv initramfs-linux.img initramfs-linux.img.orig
cat intel-ucode.img initramfs-linux.img.orig > initramfs-linux.img try that with the config stanze
...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=scan xsave=1
...
module2 /initramfs-linux.img

If that method fails extract GenuineIntel.bin from /boot/intel-ucode.img place it as /boot/GenuineIntel.bin and try with the boot stanza
...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=1 xsave=1
...
module2 /initramfs-linux.img
module2 /GenuineIntel.bin
...
or if it is an EFI system the stanza appears to be
...
echo 'Loading Xen 4.12.0'
multiboot2 /xen-4.12.0.gz ucode=GenuineIntel.bin xsave=1
...
module2 /initramfs-linux.img

[1] https://www.suse.com/support/kb/doc/?id=7022546
[2] https://www.kernel.org/doc/Documentatio … rocode.txt

So none of those methods seemed to work for me. HOWEVER! I found a way that does work. Going back over The xen cmdline options for ucode, I found that doing what xen recommends was the effective method. By doing the following:
In /etc/mkinitcpio.conf put

...
BINARIES=(.../kernel/x86/microcode/GenuineIntel.bin...)
...

And in /etc/xen/grub.conf put

...
XEN_HYPERVISOR_CMDLINE="...ucode=scan..."
...

The drawbacks are that I have to manually extract GenuineIntel.bin, from intel-ucode.img, and move it to /kernel/x86/microcode/. (Though nothing a pacman hook can't fix) Plus

dmesg | grep microcode

no longer registers the microcode being loaded. However

grep -m1 microcode /proc/cpuinfo

shows the corrent microcode.

EDIT:

The hook I created is as follows:
GenuineIntel.hook

[Trigger] 
Operation = Install
Operation = Upgrade
Type = Package
Target = intel-ucode

[Action] 
Description = "Extracting GenuineIntel.bin..."
Depends = intel-ucode
Depends = p7zip
When = PostTransaction
Exec = /usr/bin/7z e /boot/intel-ucode.img -so > /kernel/x86/microcode/GenuineIntel.bin

Last edited by Heronymous (2019-08-03 17:56:34)

---

For every debit, there is a credit.