[PATCH] dracut: add support for updating the CPU microcode

[PATCH] dracut: add support for updating the CPU microcode

[Guido Trentalancia]

This is the initial version of a new "microcode" dracut module
that can be used to update the microcode on Intel(R) CPUs.

Signed-off-by: Guido Trentalancia <guido-D1bseh+SzQhuxeB9wqlrNw@public.gmane.org>
---
 modules.d/00microcode/module-setup.sh |   26 ++++++++++++++++++++++++++
 modules.d/99base/init.sh              |    9 +++++++++
 2 files changed, 35 insertions(+)

diff -pruN dracut-git/modules.d/00microcode/module-setup.sh dracut-git-microcode-update/modules.d/00microcode/module-setup.sh
--- dracut-git/modules.d/00microcode/module-setup.sh	1970-01-01 01:00:00.000000000 +0100
+++ dracut-git-microcode-update/modules.d/00microcode/module-setup.sh	2016-04-16 01:11:20.719287468 +0200
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Dracut module to update the microcode on Intel(R) CPUs
+# Copyright 2016 Guido Trentalancia <guido-D1bseh+SzQhuxeB9wqlrNw@public.gmane.org>
+
+# called by dracut
+check() {
+    [[ "$mount_needs" ]] && return 1
+
+    require_binaries microcode_ctl || return 1
+
+    return 0
+}
+
+# called by dracut
+depends() {
+    return 0
+}
+
+# called by dracut
+install() {
+    inst microcode_ctl
+
+    inst_dir /lib/firmware
+    inst /lib/firmware/microcode.dat
+}
diff -pruN dracut-git/modules.d/99base/init.sh dracut-git-microcode-update/modules.d/99base/init.sh
--- dracut-git/modules.d/99base/init.sh	2016-04-14 22:21:22.681548895 +0200
+++ dracut-git-microcode-update/modules.d/99base/init.sh	2016-04-16 01:09:58.517080944 +0200
@@ -62,6 +62,15 @@ if ! ismounted /dev/shm; then
     mount -t tmpfs -o mode=1777,noexec,nosuid,nodev,strictatime tmpfs /dev/shm >/dev/null
 fi
 
+# Update CPU microcode
+if [ -x /usr/sbin/microcode_ctl ]; then
+    MICROCODE_CTL=/usr/sbin/microcode_ctl
+elif [ -x /sbin/microcode_ctl ]; then
+    MICROCODE_CTL=/sbin/microcode_ctl
+fi
+[ $MICROCODE_CTL ] && [ ! -e /dev/cpu/microcode ] && echo "Creating microcode update device..." && mknod /dev/cpu/microcode c 10 184
+[ $MICROCODE_CTL ] && [ -e /lib/firmware/microcode.dat ] && $MICROCODE_CTL -u
+
 if ! ismounted /run; then
     mkdir -m 0755 /newrun
     if ! str_starts "$(readlink -f /bin/sh)" "/run/"; then

Re: [PATCH] dracut: add support for updating the CPU microcode

[Andrei Borzenkov]

16.04.2016 02:18, Guido Trentalancia пишет:
> This is the initial version of a new "microcode" dracut module
> that can be used to update the microcode on Intel(R) CPUs.
> 

??? dracut already supports early microcode loading, why it is not
enough and what problem this patch solves?

> Signed-off-by: Guido Trentalancia <guido-D1bseh+SzQhuxeB9wqlrNw@public.gmane.org>
> ---
>  modules.d/00microcode/module-setup.sh |   26 ++++++++++++++++++++++++++
>  modules.d/99base/init.sh              |    9 +++++++++
>  2 files changed, 35 insertions(+)
> 
> diff -pruN dracut-git/modules.d/00microcode/module-setup.sh dracut-git-microcode-update/modules.d/00microcode/module-setup.sh
> --- dracut-git/modules.d/00microcode/module-setup.sh	1970-01-01 01:00:00.000000000 +0100
> +++ dracut-git-microcode-update/modules.d/00microcode/module-setup.sh	2016-04-16 01:11:20.719287468 +0200
> @@ -0,0 +1,26 @@
> +#!/bin/bash
> +
> +# Dracut module to update the microcode on Intel(R) CPUs
> +# Copyright 2016 Guido Trentalancia <guido-D1bseh+SzQhuxeB9wqlrNw@public.gmane.org>
> +
> +# called by dracut
> +check() {
> +    [[ "$mount_needs" ]] && return 1
> +
> +    require_binaries microcode_ctl || return 1
> +
> +    return 0
> +}
> +
> +# called by dracut
> +depends() {
> +    return 0
> +}
> +
> +# called by dracut
> +install() {
> +    inst microcode_ctl
> +
> +    inst_dir /lib/firmware
> +    inst /lib/firmware/microcode.dat
> +}
> diff -pruN dracut-git/modules.d/99base/init.sh dracut-git-microcode-update/modules.d/99base/init.sh
> --- dracut-git/modules.d/99base/init.sh	2016-04-14 22:21:22.681548895 +0200
> +++ dracut-git-microcode-update/modules.d/99base/init.sh	2016-04-16 01:09:58.517080944 +0200
> @@ -62,6 +62,15 @@ if ! ismounted /dev/shm; then
>      mount -t tmpfs -o mode=1777,noexec,nosuid,nodev,strictatime tmpfs /dev/shm >/dev/null
>  fi
>  
> +# Update CPU microcode
> +if [ -x /usr/sbin/microcode_ctl ]; then
> +    MICROCODE_CTL=/usr/sbin/microcode_ctl
> +elif [ -x /sbin/microcode_ctl ]; then
> +    MICROCODE_CTL=/sbin/microcode_ctl
> +fi
> +[ $MICROCODE_CTL ] && [ ! -e /dev/cpu/microcode ] && echo "Creating microcode update device..." && mknod /dev/cpu/microcode c 10 184
> +[ $MICROCODE_CTL ] && [ -e /lib/firmware/microcode.dat ] && $MICROCODE_CTL -u
> +
>  if ! ismounted /run; then
>      mkdir -m 0755 /newrun
>      if ! str_starts "$(readlink -f /bin/sh)" "/run/"; then
> --
> To unsubscribe from this list: send the line "unsubscribe initramfs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: [PATCH] dracut: add support for updating the CPU microcode

[Guido Trentalancia]

Hello Andrei,

thanks for getting back on this...

On Sat, 16/04/2016 at 09.01 +0300, Andrei Borzenkov wrote:
> 16.04.2016 02:18, Guido Trentalancia пишет:
> > This is the initial version of a new "microcode" dracut module
> > that can be used to update the microcode on Intel(R) CPUs.
> > 
> 
> ??? dracut already supports early microcode loading, why it is not
> enough and what problem this patch solves?

To be honest, I didn't notice it. I was expecting such support, if
available, to be a module and I couldn't find it, so I wrote it.

However, I have noticed it is much simpler than the actual
implementation. It doesn't differentiate between Intel and AMD (why it
should ?), it just loads the microcode in the standard location as
defined by the microcode update utility.

> > Signed-off-by: Guido Trentalancia <guido-D1bseh+SzQhuxeB9wqlrNw@public.gmane.org>
> > ---
> >  modules.d/00microcode/module-setup.sh |   26
> > ++++++++++++++++++++++++++
> >  modules.d/99base/init.sh              |    9 +++++++++
> >  2 files changed, 35 insertions(+)
> > 
> > diff -pruN dracut-git/modules.d/00microcode/module-setup.sh dracut-
> > git-microcode-update/modules.d/00microcode/module-setup.sh
> > --- dracut-git/modules.d/00microcode/module-setup.sh	1970-
> > 01-01 01:00:00.000000000 +0100
> > +++ dracut-git-microcode-update/modules.d/00microcode/module-
> > setup.sh	2016-04-16 01:11:20.719287468 +0200
> > @@ -0,0 +1,26 @@
> > +#!/bin/bash
> > +
> > +# Dracut module to update the microcode on Intel(R) CPUs
> > +# Copyright 2016 Guido Trentalancia <guido-D1bseh+SzQhuxeB9wqlrNw@public.gmane.org>
> > +
> > +# called by dracut
> > +check() {
> > +    [[ "$mount_needs" ]] && return 1
> > +
> > +    require_binaries microcode_ctl || return 1
> > +
> > +    return 0
> > +}
> > +
> > +# called by dracut
> > +depends() {
> > +    return 0
> > +}
> > +
> > +# called by dracut
> > +install() {
> > +    inst microcode_ctl
> > +
> > +    inst_dir /lib/firmware
> > +    inst /lib/firmware/microcode.dat
> > +}
> > diff -pruN dracut-git/modules.d/99base/init.sh dracut-git-
> > microcode-update/modules.d/99base/init.sh
> > --- dracut-git/modules.d/99base/init.sh	2016-04-14
> > 22:21:22.681548895 +0200
> > +++ dracut-git-microcode-update/modules.d/99base/init.sh	201
> > 6-04-16 01:09:58.517080944 +0200
> > @@ -62,6 +62,15 @@ if ! ismounted /dev/shm; then
> >      mount -t tmpfs -o mode=1777,noexec,nosuid,nodev,strictatime
> > tmpfs /dev/shm >/dev/null
> >  fi
> >  
> > +# Update CPU microcode
> > +if [ -x /usr/sbin/microcode_ctl ]; then
> > +    MICROCODE_CTL=/usr/sbin/microcode_ctl
> > +elif [ -x /sbin/microcode_ctl ]; then
> > +    MICROCODE_CTL=/sbin/microcode_ctl
> > +fi
> > +[ $MICROCODE_CTL ] && [ ! -e /dev/cpu/microcode ] && echo
> > "Creating microcode update device..." && mknod /dev/cpu/microcode c
> > 10 184
> > +[ $MICROCODE_CTL ] && [ -e /lib/firmware/microcode.dat ] &&
> > $MICROCODE_CTL -u
> > +
> >  if ! ismounted /run; then
> >      mkdir -m 0755 /newrun
> >      if ! str_starts "$(readlink -f /bin/sh)" "/run/"; then

Re: [PATCH] dracut: add support for updating the CPU microcode

[Alexander E. Patrakov]

16.04.2016 18:54, Guido Trentalancia пишет:
> Hello Andrei,
>
> thanks for getting back on this...
>
> On Sat, 16/04/2016 at 09.01 +0300, Andrei Borzenkov wrote:
>> 16.04.2016 02:18, Guido Trentalancia пишет:
>>> This is the initial version of a new "microcode" dracut module
>>> that can be used to update the microcode on Intel(R) CPUs.
>>>
>>
>> ??? dracut already supports early microcode loading, why it is not
>> enough and what problem this patch solves?
>
> To be honest, I didn't notice it. I was expecting such support, if
> available, to be a module and I couldn't find it, so I wrote it.
>
> However, I have noticed it is much simpler than the actual
> implementation. It doesn't differentiate between Intel and AMD (why it
> should ?), it just loads the microcode in the standard location as
> defined by the microcode update utility.

The microcode update utility stopped working when a Haswell microcode 
update got released that makes some CPU instructions illegal (because 
they didn't work properly in the first place). Please see 
http://bugs.debian.org/762195

Sure, glibc no longer uses these instructions, but now (exactly to avoid 
repetition of this bug) the only supported way to update the microcode 
is to place it in the initcpio so that "early microcode update" in the 
kernel loader notices it.

-- 
Alexander E. Patrakov

Re: [PATCH] dracut: add support for updating the CPU microcode

[Guido Trentalancia]

On Sat, 2016-04-16 at 20:20 +0500, Alexander E. Patrakov wrote:
> 16.04.2016 18:54, Guido Trentalancia пишет:
> > Hello Andrei,
> > 
> > thanks for getting back on this...
> > 
> > On Sat, 16/04/2016 at 09.01 +0300, Andrei Borzenkov wrote:
> > > 16.04.2016 02:18, Guido Trentalancia пишет:
> > > > This is the initial version of a new "microcode" dracut module
> > > > that can be used to update the microcode on Intel(R) CPUs.
> > > > 
> > > 
> > > ??? dracut already supports early microcode loading, why it is
> > > not
> > > enough and what problem this patch solves?
> > 
> > To be honest, I didn't notice it. I was expecting such support, if
> > available, to be a module and I couldn't find it, so I wrote it.
> > 
> > However, I have noticed it is much simpler than the actual
> > implementation. It doesn't differentiate between Intel and AMD (why
> > it
> > should ?), it just loads the microcode in the standard location as
> > defined by the microcode update utility.
> 
> The microcode update utility stopped working when a Haswell
> microcode 
> update got released that makes some CPU instructions illegal
> (because 
> they didn't work properly in the first place). Please see 
> http://bugs.debian.org/762195
> 
> Sure, glibc no longer uses these instructions, but now (exactly to
> avoid 
> repetition of this bug) the only supported way to update the
> microcode 
> is to place it in the initcpio so that "early microcode update" in
> the 
> kernel loader notices it.

If glibc has been fixed to avoid using those instructions, then I
suppose no initramfs process will crash, independently of whether the
microcode is loaded earlier or not.

However, if the support already exist, it is working well, is stable
and doesn't require a lot of maintenance, I do not want to insist on
adding a new module, although it's easier to use and avoids complexity.

Regards,

Guido