Latest firmware (0071 and 0070) of NUC9i7QNX has wrong microcode

[orancho]

Hi,

I own an NUC9i7QNX and used it for software development with Intel SGX.

To run the SGX application, the current environment(mostly firmware) must be passed with a Remote Attestation report from Intel IAS flow. Below is the report I got from the IAS:

isvEnclaveQuoteStatus = CONFIGURATION_AND_SW_HARDENING_NEEDED
advisoryURL = https://security-center.intel.com
advisoryIDs = "INTEL-SA-00161", "INTEL-SA-00219", "INTEL-SA-00289", "INTEL-SA-00334", "INTEL-SA-00615"

There 2 issues:

1. As is informed in https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html, INTEL-SA-00161 has already been fixed in 2018 and the NUC9 line should not be affected to it.

2. As is informed in https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00219.html, INTEL-SA-00219 has already been fixed in 2019 with the internal graphic device disabled. I have iGPU disabled and installed an AMD GPU but still got the system affected with INTEL-SA-00219. Below are returned from `lspci`:

[krhougs@nuc3 ~]$ lspci
00:00.0 Host bridge: Intel Corporation 8th Gen Core Processor Host Bridge/DRAM Registers (rev 07)
00:01.0 PCI bridge: Intel Corporation 6th-10th Gen Core Processor PCIe Controller (x16) (rev 07)
00:08.0 System peripheral: Intel Corporation Xeon E3-1200 v5/v6 / E3-1500 v5 / 6th/7th/8th Gen Core Processor Gaussian Mixture Model
00:12.0 Signal processing controller: Intel Corporation Cannon Lake PCH Thermal Controller (rev 10)
00:14.0 USB controller: Intel Corporation Cannon Lake PCH USB 3.1 xHCI Host Controller (rev 10)
00:14.2 RAM memory: Intel Corporation Cannon Lake PCH Shared SRAM (rev 10)
00:15.0 Serial bus controller: Intel Corporation Cannon Lake PCH Serial IO I2C Controller #0 (rev 10)
00:15.1 Serial bus controller: Intel Corporation Cannon Lake PCH Serial IO I2C Controller #1 (rev 10)
00:16.0 Communication controller: Intel Corporation Cannon Lake PCH HECI Controller (rev 10)
00:17.0 SATA controller: Intel Corporation Cannon Lake Mobile PCH SATA AHCI Controller (rev 10)
00:1c.0 PCI bridge: Intel Corporation Cannon Lake PCH PCI Express Root Port #1 (rev f0)
00:1c.4 PCI bridge: Intel Corporation Cannon Lake PCH PCI Express Root Port #5 (rev f0)
00:1d.0 PCI bridge: Intel Corporation Cannon Lake PCH PCI Express Root Port #14 (rev f0)
00:1e.0 Communication controller: Intel Corporation Cannon Lake PCH Serial IO UART Host Controller (rev 10)
00:1f.0 ISA bridge: Intel Corporation Cannon Lake LPC Controller (rev 10)
00:1f.3 Audio device: Intel Corporation Cannon Lake PCH cAVS (rev 10)
00:1f.4 SMBus: Intel Corporation Cannon Lake PCH SMBus Controller (rev 10)
00:1f.5 Serial bus controller: Intel Corporation Cannon Lake PCH SPI Controller (rev 10)
00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (7) I219-LM (rev 10)
01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Oland XT [Radeon HD 8670 / R5 340X OEM / R7 250/350/350X OEM] (rev 83)
01:00.1 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] Oland/Hainan/Cape Verde/Pitcairn HDMI Audio [Radeon HD 7000 Series]
02:00.0 Network controller: Intel Corporation Wi-Fi 6 AX200 (rev 1a)
03:00.0 PCI bridge: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] (rev 06)
04:00.0 PCI bridge: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] (rev 06)
04:01.0 PCI bridge: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] (rev 06)
04:02.0 PCI bridge: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] (rev 06)
04:04.0 PCI bridge: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] (rev 06)
05:00.0 System peripheral: Intel Corporation JHL7540 Thunderbolt 3 NHI [Titan Ridge 4C 2018] (rev 06)
39:00.0 USB controller: Intel Corporation JHL7540 Thunderbolt 3 USB Controller [Titan Ridge 4C 2018] (rev 06)
6e:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)

I suspect that there should be some problem with the firmware or microcode.

The firmware version I tried is QX0071 and QX0070, they both have the same issue.

OS version: 

Linux nuc3 6.1.6-arch1-3 #1 SMP PREEMPT_DYNAMIC Mon, 16 Jan 2023 12:51:23 +0000 x86_64 GNU/Linux

Some useful info to debug:

[krhougs@nuc3 ~]$ sudo dmesg | grep microcode
[ 0.779079] microcode: sig=0x906ea, pf=0x20, revision=0xf0
[ 0.779240] microcode: Microcode Update Driver: v2.2.

[krhougs@nuc3 ~]$ grep 'stepping\|model\|microcode' /proc/cpuinfo
model : 158
model name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
stepping : 10
microcode : 0xf0
model : 158
model name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
stepping : 10
microcode : 0xf0
model : 158
model name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
stepping : 10
microcode : 0xf0
model : 158
model name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
stepping : 10
microcode : 0xf0
model : 158
model name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
stepping : 10
microcode : 0xf0
model : 158
model name : Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
stepping : 10
microcode : 0xf0

[Steven_Intel]

Hello orancho,

Thank you for posting on the Intel® communities.

I will take this information and investigate about this. As soon as I have an update, I will let you know.

Best regards,

Steven G.

Intel Customer Support Technician.

[Steven_Intel]

Hello orancho,

Please be aware that this issue should be fixed now. Are you getting this issue when using one of the supported operating systems (https://www.intel.com/content/www/us/en/support/articles/000005628/intel-nuc.html) for Intel® NUC9i7QNX?

Best regards,

Steven G.

Intel Customer Support Technician.

[Steven_Intel]

We would like to know if you were you able to check the previous post.

Let us know if you still need assistance.

Best regards,

Steven G.

Intel Customer Support Technician.

[orancho]

Checked on the page and can not find any information about Linux.

[orancho]

I have also checked other Linux distributions.

This happens on whatever distribution with mainline Linux kernel.

[Steven_Intel]

Thank you for your response.

You will need to test if the issue persists with a supported operating system (Windows 11, 64-bit*, Windows® 10 64-bit, Windows® Server 2019), since Linux operating systems are not supported by this NUC model.

Best regards,

Steven G.

Intel Customer Support Technician.

[Steven_Intel]

We would like to know if you were you able to check the previous post.

Let us know if you still need assistance.

Best regards,

Steven G.

Intel Customer Support Technician.

[Steven_Intel]

Since we have not heard back from you, we will close this thread. If you need any additional information, please submit a new question, as this thread will no longer be monitored.

Best regards,

Steven G.

Intel Customer Support Technician.