Intel has recalled the January version of its uc updates: https://newsroom.intel.com/news/root-cause-of-reboot-issue-identified-updated-guidance-for-customers-and-partners/ Hence those versions should be masked and not be installed by default as they can make your system unstable (I can confirm lockups during compiles caused by those uc versions).
If we do this, we should backport intel-microcode-20180108-r1.ebuild build changes to 20171117 or 20171117_p20171215-r1. Do we need to mask out our p20171215 builds as well is the big question.
That work is important should definitely be kept and backported to the earlier ebuild. The 20171117 one is the version that is "current" according to Intel: https://downloadcenter.intel.com/download/27337/Linux-Processor-Microcode-Data-File See top of page where it says: Version: 20171117 (Latest)
(In reply to Ortwin Glueck from comment #2) > See top of page where it says: Version: 20171117 (Latest) The 20171117_p20171215* builds pulled CPU-specific post-20171117 microcodes together. Should those be kept or blocked?
Let's just mask these new ones and leave the old as is. It does not fix anything of spectre/meltdown either. When the new ucode is out,we'll reuse the masked latest version and drop those problematic ones. I have this 2018 ucode on 2 servers and have't observed any reboots. I'm not suggesting to install them,but it may work for some computers.
(In reply to Tomáš Mózes from comment #4) > Let's just mask these new ones and leave the old as is. It does not fix > anything of spectre/meltdown either. Are you sure? This page suggests the opposite: https://wiki.gentoo.org/wiki/Project:Security/Vulnerabilities/Meltdown_and_Spectre > I have this 2018 ucode on 2 servers and have't observed any reboots. I was running the 20180108 on at least 11 servers and 2 laptops and only one laptop had a problem with it (reproducably). In my opinion it should be masked when it is not deemed safe by upstream (Intel). So if Intel says 20171117 is the "current" one, then it's that and nothing else.
(In reply to Ortwin Glueck from comment #5) > (In reply to Tomáš Mózes from comment #4) > > Let's just mask these new ones and leave the old as is. It does not fix > > anything of spectre/meltdown either. > > Are you sure? This page suggests the opposite: > https://wiki.gentoo.org/wiki/Project:Security/Vulnerabilities/ > Meltdown_and_Spectre I was referring to the vanilla 20171117, not the Gentoo custom version :) > > > I have this 2018 ucode on 2 servers and have't observed any reboots. > > I was running the 20180108 on at least 11 servers and 2 laptops and only one > laptop had a problem with it (reproducably). In my opinion it should be > masked when it is not deemed safe by upstream (Intel). So if Intel says > 20171117 is the "current" one, then it's that and nothing else. I agree to mask it, but the ones that want to test it need to unmask it, so you won't get it under normal circumstances. Adding a mask note regarding the possible reboots and installing at own risk would also be nice :)
Per guidance from Intel we should not be pushing newer microcodes than 20171117. Most (all?) other distros have followed suit and retracted anything newer. There are new microcodes available under NDA for testing and when its good it will go out.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0b22d8b55215ca7c138524e9ff63e67b27bdcd22 commit 0b22d8b55215ca7c138524e9ff63e67b27bdcd22 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2018-02-07 03:23:13 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2018-02-07 03:25:51 +0000 profiles: mask sys-firmware/intel-microcode which were pulled by upstream Closes: https://bugs.gentoo.org/646646 profiles/package.mask | 9 +++++++++ 1 file changed, 9 insertions(+)
I pushed a new sys-firmware/intel-microcode-20171117-r1 (51d07a0f5c5db7a9b8ea9a449e551c7f7408ad80) which incorporate our recent changes to the ebuild but is based on microcode data from 2017-11-17. This will cause the following downgrades (- => pulled; = -> version after downgrade): > 06-3c-03 > -| 1 | 306C3 | 32 (1,4,5) | 23 | 2017-11-20 | PRD | 0x5C00 | 0x0 | Yes | > =| 1 | 306C3 | 32 (1,4,5) | 22 | 2017-01-27 | PRD | 0x5800 | 0x0 | No | > > 06-3d-04 > -| 1 | 306D4 | C0 (6,7) | 28 | 2017-11-17 | PRD | 0x4800 | 0x0 | Yes | > =| 1 | 306D4 | C0 (6,7) | 25 | 2017-01-27 | PRD | 0x4400 | 0x0 | No | > > 06-3e-04 > -| 1 | 306E4 | ED (0,2,3,5,6,7) | 42A | 2017-12-01 | PRD | 0x3C00 | 0x0 | Yes | > =| 1 | 306E4 | ED (0,2,3,5,6,7) | 428 | 2014-05-29 | PRD | 0x3400 | 0x0 | No | > > 06-3f-02 > -| 1 | 306F2 | 6F (0,1,2,3,5,6) | 3B | 2017-11-17 | PRD | 0x8400 | 0x0 | Yes | > =| 1 | 306F2 | 6F (0,1,2,3,5,6) | 3A | 2017-01-30 | PRD | 0x8000 | 0x0 | No | > > 06-3f-04 > -| 1 | 306F4 | 80 (7) | 10 | 2017-11-17 | PRD | 0x4400 | 0x0 | Yes | > =| 1 | 306F4 | 80 (7) | F | 2017-01-30 | PRD | 0x4000 | 0x0 | No | > > 06-45-01 > -| 1 | 40651 | 72 (1,4,5,6) | 21 | 2017-11-20 | PRD | 0x5800 | 0x0 | Yes | > =| 1 | 40651 | 72 (1,4,5,6) | 20 | 2017-01-27 | PRD | 0x5000 | 0x0 | No | > > 06-46-01 > -| 1 | 40661 | 32 (1,4,5) | 18 | 2017-11-20 | PRD | 0x6400 | 0x0 | Yes | > =| 1 | 40661 | 32 (1,4,5) | 17 | 2017-01-27 | PRD | 0x6000 | 0x0 | No | > > 06-47-01 > -| 1 | 40671 | 22 (1,5) | 1B | 2017-11-17 | PRD | 0x3400 | 0x0 | Yes | > =| 1 | 40671 | 22 (1,5) | 17 | 2017-01-27 | PRD | 0x2C00 | 0x0 | No | > > 06-4e-03 > -| 1 | 406E3 | C0 (6,7) | C2 | 2017-11-16 | PRD | 0x18400 | 0x0 | Yes | > =| 1 | 406E3 | C0 (6,7) | BA | 2017-04-09 | PRD | 0x18000 | 0x0 | No | > > 06-55-04 > -| 1 | 50654 | B7 (0,1,2,4,5,7) | 200003C | 2017-12-08 | PRD | 0x6C00 | 0x0 | Yes | > =| 1 | 50654 | B7 (0,1,2,4,5,7) | 2000035 | 2017-10-17 | PRD | 0x6800 | 0x0 | No | > > 06-56-02 > -| 1 | 50662 | 10 (4) | 14 | 2017-12-16 | PRD | 0x7C00 | 0x0 | Yes | > =| 1 | 50662 | 10 (4) | F | 2015-12-12 | PRD | 0x7000 | 0x0 | No | > > 06-56-03 > -| 1 | 50663 | 10 (4) | 7000011 | 2017-12-16 | PRD | 0x5800 | 0x0 | Yes | > =| 1 | 50663 | 10 (4) | 700000D | 2016-10-12 | PRD | 0x5000 | 0x0 | No | > > 06-5e-03 > -| 1 | 506E3 | 36 (1,2,4,5) | C2 | 2017-11-16 | PRD | 0x18400 | 0x0 | Yes | > =| 1 | 506E3 | 36 (1,2,4,5) | BA | 2017-04-09 | PRD | 0x18000 | 0x0 | No | > > 06-7a-01 > -| 1 | 706A1 | 01 (0) | 22 | 2017-12-26 | PRD | 0x12000 | 0x0 | Yes | > =| 1 | 706A1 | 01 (0) | 1E | 2017-10-31 | PRD | 0x11C00 | 0x0 | No | > > 06-8e-09 > -| 1 | 806E9 | C0 (6,7) | 80 | 2018-01-04 | PRD | 0x18000 | 0x0 | Yes | > =| 1 | 806E9 | C0 (6,7) | 62 | 2017-04-27 | PRD | 0x17C00 | 0x0 | No | > > 06-8e-0a > -| 1 | 806EA | C0 (6,7) | 80 | 2018-01-04 | PRD | 0x18000 | 0x0 | Yes | > =| 1 | 806EA | C0 (6,7) | 70 | 2017-08-03 | PRD | 0x17800 | 0x0 | No | > > 06-9e-09 > -| 1 | 906E9 | 2A (1,3,5) | 80 | 2018-01-04 | PRD | 0x18000 | 0x0 | Yes | > =| 1 | 906E9 | 2A (1,3,5) | 5E | 2017-04-06 | PRD | 0x17C00 | 0x0 | No | > > 06-9e-0a > -| 1 | 906EA | 22 (1,5) | 80 | 2018-01-04 | PRD | 0x17C00 | 0x0 | Yes | > =| 1 | 906EA | 22 (1,5) | 70 | 2017-08-23 | PRD | 0x17400 | 0x0 | No | > > 06-9e-0b > -| 1 | 906EB | 02 (1) | 80 | 2018-01-04 | PRD | 0x18000 | 0x0 | Yes | > =| 1 | 906EB | 02 (1) | 72 | 2017-09-20 | PRD | 0x17C00 | 0x0 | No | >
