Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Ian Campbell]

I think I remember some discussion of something in this area not too
long ago on xen-devel. CC-s added.

Konrad, do you know of any issues with ucode=scan in 4.4? 

On Wed, 2015-05-13 at 10:27 +0200, Stephan Seitz wrote:
> Package: xen-hypervisor-4.5-amd64
> Version: 4.5.0-1
> Severity: normal
> 
> Dear Maintainer,
> 
> according to the documentation the option ucode=scan should tell XEN to 
> look for a microcode update in an uncompressed initrd.
> 
> While I don’t use the Debian kernel the tools to generate the initrd are 
> part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0” 
> creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”, 
> so I think the initrd is allright.
> 
> But according to /proc/cpuinfo the microcode update doesn’t happen. If 
> I copy GenuineIntel.bin to /boot, create a new module section in grub.cfg 
> and boot with ucode=-1, then the update is working. In both cases dmesg 
> or „xl dmesg” don’t tell anything about microcode updates (successfull or 
> not).
> 
> The option ucode=scan doesn’t work with XEN 4.4 either or with 3.6 
> kernels.
> 
> -- System Information:
> Debian Release: stretch/sid
>   APT prefers oldoldstable-updates
>   APT policy: (500, 'oldoldstable-updates'), (500, 'testing'), (500, 'stable')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386
> 
> Kernel: Linux 4.0.2-Dom0 (SMP w/8 CPU cores)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
> Init: sysvinit (via /sbin/init)
> 
> xen-hypervisor-4.5-amd64 depends on no packages.
> 
> Versions of packages xen-hypervisor-4.5-amd64 recommends:
> ii  xen-utils-4.5  4.5.0-1
> 
> xen-hypervisor-4.5-amd64 suggests no packages.
> 
> -- no debconf information
> 
> _______________________________________________
> Pkg-xen-devel mailing list
> Pkg-xen-devel@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Konrad Rzeszutek Wilk]

> > according to the documentation the option ucode=scan should tell XEN to 
> > look for a microcode update in an uncompressed initrd.
> > 
> > While I don’t use the Debian kernel the tools to generate the initrd are 
> > part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0” 
> > creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”, 
> > so I think the initrd is allright.


Is the initramfs compressed? The scanning code can't deal if the initramfs
is compressed - so you either have to glue the compressed initramfs and
the cpio with the microcode together (where the microcode has to go first).


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Ian Campbell]

On Wed, 2015-05-13 at 11:57 -0400, Konrad Rzeszutek Wilk wrote:
> > > according to the documentation the option ucode=scan should tell XEN to 
> > > look for a microcode update in an uncompressed initrd.
> > > 
> > > While I don’t use the Debian kernel the tools to generate the initrd are 
> > > part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0” 
> > > creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”, 
> > > so I think the initrd is allright.
> 
> 
> Is the initramfs compressed?

The successful use of "cpio -i < /boot/initrd.img" would suggest not, I
don't think cpio knows how to decompress things by itself.

Ian.


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Stephan Seitz]

[-- Attachment #1.1: Type: text/plain, Size: 1100 bytes --]

On Wed, May 13, 2015 at 11:57:55AM -0400, Konrad Rzeszutek Wilk wrote:
>> > according to the documentation the option ucode=scan should tell XEN to
>> > look for a microcode update in an uncompressed initrd.
>> >
>> > While I don’t use the Debian kernel the tools to generate the initrd are
>> > part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0”
>> > creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”,
>> > so I think the initrd is allright.
>Is the initramfs compressed? The scanning code can't deal if the 

[stse@osgiliath]: file /boot/initrd.img-4.0.2-Dom0 
/boot/initrd.img-4.0.2-Dom0: ASCII cpio archive (SVR4 with no CRC)

I don’t think the initrd is compressed.

http://lists.xen.org/archives/html/xen-users/2014-05/msg00053.html says 
that I have to use „cpio -H newc” not „cpio -o c”, but I don’t know how 
the Debian tools create the initrd.

Shade and sweet water!

	Stephan

-- 
| Stephan Seitz          E-Mail: stse@fsing.rootsland.net |
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 3735 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Ian Campbell]

On Thu, 2015-05-14 at 22:45 +0200, Stephan Seitz wrote:
> On Wed, May 13, 2015 at 11:57:55AM -0400, Konrad Rzeszutek Wilk wrote:
> >> > according to the documentation the option ucode=scan should tell XEN to
> >> > look for a microcode update in an uncompressed initrd.
> >> >
> >> > While I don’t use the Debian kernel the tools to generate the initrd are
> >> > part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0”
> >> > creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”,
> >> > so I think the initrd is allright.
> >Is the initramfs compressed? The scanning code can't deal if the 
> 
> [stse@osgiliath]: file /boot/initrd.img-4.0.2-Dom0 
> /boot/initrd.img-4.0.2-Dom0: ASCII cpio archive (SVR4 with no CRC)
> 
> I don’t think the initrd is compressed.
> 
> http://lists.xen.org/archives/html/xen-users/2014-05/msg00053.html says 
> that I have to use „cpio -H newc” not „cpio -o c”, but I don’t know how 
> the Debian tools create the initrd.

The intel-microcode package contains:
/usr/share/initramfs-tools/hooks/intel_microcode
which will be called during initamfs generation.

It seems to call iucode_tool, from the iucode-tool package. That's a
binary tool which seems to include its own cpio writer implementation,
I've no idea if that is like a 'newc' or not.

However:
ijc@dagon:tmp$ find iucode-tool/ | cpio -o > normal.cpio
828 blocks
ijc@dagon:tmp$ find iucode-tool/ | cpio -o -H newc > newc.cpio
840 blocks
ijc@dagon:tmp$ file *.cpio
newc.cpio:   ASCII cpio archive (SVR4 with no CRC)
normal.cpio: cpio archive

So the fact that yours reports the same as newc.cpio makes me reasonably
confident it is in the correct form.

So I think the issue must be elsewhere.

In iucode_tool.c I found:
        /* Gross hack to work around a Linux kernel bug: for file
         * entries, force file data into a 16-byte alignment by
         * appending NULs to the file name.  Verified to be compatible
         * with GNU pax, and GNU cpio */
        s = (size) ? (16 - (*pos + bufsize) % 16) % 16 : 0;

I wonder if perhaps this confuses Xen? I doubt it somehow.

Here's an idea. First extract the real initrd from the back half of the
initrd:
        ijc@dagon:tmp$ cat /boot/initrd.img | ( cpio -t >&2 ; cat ) > initrd.real
        kernel
        kernel/x86
        kernel/x86/microcode
        kernel/x86/microcode/GenuineIntel.bin
        16 blocks
        ijc@dagon:tmp$ file initrd.real 
        initrd.real: gzip compressed data, last modified: Sun Apr 19 16:31:17 2015, from Unix
        ijc@dagon:tmp$ zcat initrd.real | cpio -t | head -n 5
        .
        etc
        etc/ld.so.conf.d
        etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
        etc/ld.so.conf.d/x86_64-linux-gnu.conf

Now you can experiment with regenerating the ucode bit with whatever
commands are recommended and reconcatenating the two. If that works then
we know there is some incompatibility between iucode-tools's output and
Xen's cpio reader (could be a bug in either or both I think). 

Ian.


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Stephan Seitz]

[-- Attachment #1.1: Type: text/plain, Size: 1327 bytes --]

On Fri, May 15, 2015 at 08:26:42AM +0100, Ian Campbell wrote:
>Here's an idea. First extract the real initrd from the back half of the
>initrd:
>        ijc@dagon:tmp$ cat /boot/initrd.img | ( cpio -t >&2 ; cat ) > initrd.real
>        kernel
>        kernel/x86
>        kernel/x86/microcode
>        kernel/x86/microcode/GenuineIntel.bin
>        16 blocks
>        ijc@dagon:tmp$ file initrd.real
>        initrd.real: gzip compressed data, last modified: Sun Apr 19 16:31:17 2015, from Unix
>        ijc@dagon:tmp$ zcat initrd.real | cpio -t | head -n 5
>        .
>        etc
>        etc/ld.so.conf.d
>        etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
>        etc/ld.so.conf.d/x86_64-linux-gnu.conf
>
>Now you can experiment with regenerating the ucode bit with whatever
>commands are recommended and reconcatenating the two. If that works then
>we know there is some incompatibility between iucode-tools's output and
>Xen's cpio reader (could be a bug in either or both I think).

All right. Can you please provide some commands how to create and 
reconcatenate the two initrds? I don’t have any experience with cpio.

Shade and sweet water!

	Stephan

-- 
| Stephan Seitz          E-Mail: stse@fsing.rootsland.net |
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 3735 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Ian Campbell]

On Tue, 2015-05-19 at 13:31 +0200, Stephan Seitz wrote:
> On Fri, May 15, 2015 at 08:26:42AM +0100, Ian Campbell wrote:
> >Here's an idea. First extract the real initrd from the back half of the
> >initrd:
> >        ijc@dagon:tmp$ cat /boot/initrd.img | ( cpio -t >&2 ; cat ) > initrd.real
> >        kernel
> >        kernel/x86
> >        kernel/x86/microcode
> >        kernel/x86/microcode/GenuineIntel.bin
> >        16 blocks
> >        ijc@dagon:tmp$ file initrd.real
> >        initrd.real: gzip compressed data, last modified: Sun Apr 19 16:31:17 2015, from Unix
> >        ijc@dagon:tmp$ zcat initrd.real | cpio -t | head -n 5
> >        .
> >        etc
> >        etc/ld.so.conf.d
> >        etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
> >        etc/ld.so.conf.d/x86_64-linux-gnu.conf
> >
> >Now you can experiment with regenerating the ucode bit with whatever
> >commands are recommended and reconcatenating the two. If that works then
> >we know there is some incompatibility between iucode-tools's output and
> >Xen's cpio reader (could be a bug in either or both I think).
> 
> All right. Can you please provide some commands how to create and 
> reconcatenate the two initrds? I don’t have any experience with cpio.

The reconcatenate bit is easy, just:
   $ cat initrd.ucode initrd.real > initrd.img
With initrd.real extracted above.

initrd.ucode creation I'm a little unsure about but something like:

$ mkdir initrd.ucode.tree
$ cd initrd.ucode.tree
$ cat /boot/initrd.img | cpio -id
$ find 
.
./kernel
./kernel/x86
./kernel/x86/microcode
./kernel/x86/microcode/GenuineIntel.bin
$ find | cpio -o -H newc > ../initrd.ucode

Is what I think is required/expected.

BTW, could you please post the output "xl dmesg" for the failing case, I
should have asked for that right at the start in case it contains
anything of use.

Ian.


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Stephan Seitz]

[-- Attachment #1.1: Type: text/plain, Size: 1169 bytes --]

On Tue, May 19, 2015 at 12:47:51PM +0100, Ian Campbell wrote:
>The reconcatenate bit is easy, just:
>   $ cat initrd.ucode initrd.real > initrd.img
>With initrd.real extracted above.
>
>initrd.ucode creation I'm a little unsure about but something like:
>
>$ mkdir initrd.ucode.tree
>$ cd initrd.ucode.tree
>$ cat /boot/initrd.img | cpio -id
>$ find
>.
>./kernel
>./kernel/x86
>./kernel/x86/microcode
>./kernel/x86/microcode/GenuineIntel.bin
>$ find | cpio -o -H newc > ../initrd.ucode

That interesting. Your steps lead to an initrd with the same size as the 
initrd created by the Debian tools. But the new one is working with 
ucode=scan, the old one isn’t.

>BTW, could you please post the output "xl dmesg" for the failing case, I
>should have asked for that right at the start in case it contains
>anything of use.

I can do this, but neither „xl dmesg” nor „dmesg” are telling anything 
about microcode. Are there ways to make the hypervisor more verbose?

Shade and sweet water!
	
	Stephan

-- 
| Stephan Seitz          E-Mail: stse@fsing.rootsland.net |
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 3735 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Stephan Seitz]

[-- Attachment #1.1: Type: text/plain, Size: 361 bytes --]

Hi Ian & Co!

Any new ideas about this bug? I’m not sure if this is a bug in the 
hypervisor or in the tools generating the initrd.

The manual steps provided by Ian generate a working initrd.

Many greetings,

	Stephan

-- 
| Stephan Seitz          E-Mail: stse@fsing.rootsland.net |
| Public Keys: http://fsing.rootsland.net/~stse/keys.html |

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 3735 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Atom2]

Am 13.05.15 um 15:41 schrieb Ian Campbell:
> I think I remember some discussion of something in this area not too
> long ago on xen-devel. CC-s added.
I assume you refer to this discussion which happend to be on the 
xen-users mailing list:
http://lists.xen.org/archives/html/xen-users/2014-05/msg00052.html

Especially look at the first answer 
(http://lists.xen.org/archives/html/xen-users/2014-05/msg00053.html).
Following those points mentioned in there should get you up and running 
- unless there's really a bug lurking somewhere.

My guess is that the cpio archive was not created with the (required) 
cpio option "-H newc".

Regards Atom2
> Konrad, do you know of any issues with ucode=scan in 4.4?
>
> On Wed, 2015-05-13 at 10:27 +0200, Stephan Seitz wrote:
>> Package: xen-hypervisor-4.5-amd64
>> Version: 4.5.0-1
>> Severity: normal
>>
>> Dear Maintainer,
>>
>> according to the documentation the option ucode=scan should tell XEN to
>> look for a microcode update in an uncompressed initrd.
>>
>> While I don’t use the Debian kernel the tools to generate the initrd are
>> part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0”
>> creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”,
>> so I think the initrd is allright.
>>
>> But according to /proc/cpuinfo the microcode update doesn’t happen. If
>> I copy GenuineIntel.bin to /boot, create a new module section in grub.cfg
>> and boot with ucode=-1, then the update is working. In both cases dmesg
>> or „xl dmesg” don’t tell anything about microcode updates (successfull or
>> not).
>>
>> The option ucode=scan doesn’t work with XEN 4.4 either or with 3.6
>> kernels.
>>
>> -- System Information:
>> Debian Release: stretch/sid
>>    APT prefers oldoldstable-updates
>>    APT policy: (500, 'oldoldstable-updates'), (500, 'testing'), (500, 'stable')
>> Architecture: amd64 (x86_64)
>> Foreign Architectures: i386
>>
>> Kernel: Linux 4.0.2-Dom0 (SMP w/8 CPU cores)
>> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
>> Shell: /bin/sh linked to /bin/dash
>> Init: sysvinit (via /sbin/init)
>>
>> xen-hypervisor-4.5-amd64 depends on no packages.
>>
>> Versions of packages xen-hypervisor-4.5-amd64 recommends:
>> ii  xen-utils-4.5  4.5.0-1
>>
>> xen-hypervisor-4.5-amd64 suggests no packages.
>>
>> -- no debconf information
>>
>> _______________________________________________
>> Pkg-xen-devel mailing list
>> Pkg-xen-devel@lists.alioth.debian.org
>> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-xen-devel
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Ian Campbell]

Thanks Atom2, thanks for the refs, I've added the Debian bug and the
submitter back to the CC.

On Wed, 2015-05-13 at 22:11 +0200, Atom2 wrote:
> Am 13.05.15 um 15:41 schrieb Ian Campbell:
> > I think I remember some discussion of something in this area not too
> > long ago on xen-devel. CC-s added.
> I assume you refer to this discussion which happend to be on the 
> xen-users mailing list:
> http://lists.xen.org/archives/html/xen-users/2014-05/msg00052.html
> 
> Especially look at the first answer 
> (http://lists.xen.org/archives/html/xen-users/2014-05/msg00053.html).

This says "not 'cpio -o c' as some information on the internet
suggests", do you have a link? Is it to something the xenproject
controls and could update (i.e. our wiki and/or in tree docs?)

Cheers,
Ian.
> Following those points mentioned in there should get you up and running 
> - unless there's really a bug lurking somewhere.
> 
> My guess is that the cpio archive was not created with the (required) 
> cpio option "-H newc".
> 
> Regards Atom2
> > Konrad, do you know of any issues with ucode=scan in 4.4?
> >
> > On Wed, 2015-05-13 at 10:27 +0200, Stephan Seitz wrote:
> >> Package: xen-hypervisor-4.5-amd64
> >> Version: 4.5.0-1
> >> Severity: normal
> >>
> >> Dear Maintainer,
> >>
> >> according to the documentation the option ucode=scan should tell XEN to
> >> look for a microcode update in an uncompressed initrd.
> >>
> >> While I don’t use the Debian kernel the tools to generate the initrd are
> >> part of Debian. The command „cpio -i < /boot/initrd.img-4.0.2-Dom0”
> >> creates the directory structure „kernel/x86/microcode/GenuineIntel.bin”,
> >> so I think the initrd is allright.
> >>
> >> But according to /proc/cpuinfo the microcode update doesn’t happen. If
> >> I copy GenuineIntel.bin to /boot, create a new module section in grub.cfg
> >> and boot with ucode=-1, then the update is working. In both cases dmesg
> >> or „xl dmesg” don’t tell anything about microcode updates (successfull or
> >> not).
> >>
> >> The option ucode=scan doesn’t work with XEN 4.4 either or with 3.6
> >> kernels.
> >>
> >> -- System Information:
> >> Debian Release: stretch/sid
> >>    APT prefers oldoldstable-updates
> >>    APT policy: (500, 'oldoldstable-updates'), (500, 'testing'), (500, 'stable')
> >> Architecture: amd64 (x86_64)
> >> Foreign Architectures: i386
> >>
> >> Kernel: Linux 4.0.2-Dom0 (SMP w/8 CPU cores)
> >> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> >> Shell: /bin/sh linked to /bin/dash
> >> Init: sysvinit (via /sbin/init)
> >>
> >> xen-hypervisor-4.5-amd64 depends on no packages.
> >>
> >> Versions of packages xen-hypervisor-4.5-amd64 recommends:
> >> ii  xen-utils-4.5  4.5.0-1
> >>
> >> xen-hypervisor-4.5-amd64 suggests no packages.
> >>
> >> -- no debconf information
> >>
> >> _______________________________________________
> >> Pkg-xen-devel mailing list
> >> Pkg-xen-devel@lists.alioth.debian.org
> >> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-xen-devel
> >
> >
> > _______________________________________________
> > Xen-devel mailing list
> > Xen-devel@lists.xen.org
> > http://lists.xen.org/xen-devel
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [Pkg-xen-devel] Bug#785187: xen-hypervisor-4.5-amd64: Option ucode=scan is not working

[Atom2]

Am 14.05.15 um 10:41 schrieb Ian Campbell:
> Thanks Atom2, thanks for the refs, I've added the Debian bug and the
> submitter back to the CC.
Unfortunately those recipients originally seem to have escaped my eye 
... but they are included now.
> On Wed, 2015-05-13 at 22:11 +0200, Atom2 wrote:
>> Am 13.05.15 um 15:41 schrieb Ian Campbell:
>>> I think I remember some discussion of something in this area not too
>>> long ago on xen-devel. CC-s added.
>> I assume you refer to this discussion which happend to be on the
>> xen-users mailing list:
>> http://lists.xen.org/archives/html/xen-users/2014-05/msg00052.html
>>
>> Especially look at the first answer
>> (http://lists.xen.org/archives/html/xen-users/2014-05/msg00053.html).
> This says "not 'cpio -o c' as some information on the internet
> suggests", do you have a link? Is it to something the xenproject
> controls and could update (i.e. our wiki and/or in tree docs?)
>
> Cheers,
> Ian.
Ian, I am unable to find any of those links that I had read back then 
when I wrote the "not 'cpio ..." part in my answer to the list referred 
to above.

I now have only been able to come up with 
http://xenbits.xen.org/docs/unstable/misc/amd-ucode-container.txt, which 
is dated _after_ my referred mail (both the original and the amended 
version) and clearly also states the "-H newc" option. This document BTW 
contains a pretty good recipe for making this happen and also seems to 
be in line with what I had suggested earlier. So in a nutshell, 
xenproject seems to have things correct.

Appologies for not being able to be more helpful.

Regards Atom2