[ISSUE] Support intel-ucode when using mkinitcpio

[ISSUE] Support intel-ucode when using mkinitcpio

[basploeger]

[-- Attachment #1: Type: text/plain, Size: 1503 bytes --]

New issue by basploeger on void-packages repository

https://github.com/void-linux/void-packages/issues/48145

Description:
### Is this a new report?

Yes

### System Info

Void 6.6.10_1 x86_64 GenuineIntel uptodate rrrmFFFFFF

### Package(s) Affected

intel-ucode-20231114_1, mkinitcpio-37_3

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

No. But [this information](https://wiki.archlinux.org/title/microcode#Initrd_images) from Arch Linux is useful for reference.

Arch's intel-ucode package generates the necessary `/boot/intel-ucode.img` [here](https://gitlab.archlinux.org/archlinux/packaging/packages/intel-ucode/-/blob/main/PKGBUILD?ref_type=heads#L22). 

### Expected behaviour

Intel microcode gets loaded in early boot before loading the initramfs produced by mkinitcpio.

### Actual behaviour

Intel microcode does not get loaded as testified by the following console error messages before initramfs gets loaded:

```
TSC_DEADLINE disabled due to Errata; please update microcode to version: 0x52 (or later)
RETBleed: WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!
```

These error messages disappear when loading an initramfs produced by dracut, as the intel-ucode package supports dracut already.

### Steps to reproduce

1. Install intel-ucode.
2. [Switch](https://docs.voidlinux.org/config/kernel.html#changing-the-default-initramfs-generator) from dracut to mkinitcpio
3. Reboot

Re: Support intel-ucode when using mkinitcpio

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 500 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1884486750

Comment:
The arch page you link says 

> However, Arch Linux defaults to using mkinitcpio to generate its initial ramdisk (initramfs), which does not support this.

but i agree it'd be nice to have a mechanism for other initrams to load microcode (e.g. booster, tinyramfs).
in the intel case, it could be stripped first (otherwise it's huge) and placed somewhere.

Re: Support intel-ucode when using mkinitcpio

[basploeger]

[-- Attachment #1: Type: text/plain, Size: 518 bytes --]

New comment by basploeger on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1884729338

Comment:
Right, mkinitcpio does not support loading microcode natively, unlike dracut. So we have to load microcode from the boot loader as explained further down on that page: generate /boot/intel-ucode.img and instruct the boot loader to load that image before loading the initramfs. For example, `grub-mkconfig` should auto-detect that image file and add it to the grub config.

Re: Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 220 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1884947646

Comment:
iirc you can also `cat` the two images into one combined ucode + initrd

Re: Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 226 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1884947646

Comment:
iirc you can also `cat` the two images into one combined ucode + initrd image

Re: Support intel-ucode when using mkinitcpio

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 436 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1885180971

Comment:
right, most bootloaders should support that, e.g. for efistub by append an initrd= option as `initrd=\ucode.img initrd=\initramfs-linux.img`

this tool https://github.com/anatol/ucode-image-gen seems capable of generating host specific images.
then one could edit our efibootmgr hook i guess?

Re: Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 230 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1885204741

Comment:
if you're using ukis and efibootmgr, microcode is already supported by mkinitcpio

Re: Support intel-ucode when using mkinitcpio

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 234 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1885341701

Comment:
on a side note, should our intel-ucode pkg do the same as arch or alpine do with iucode_tool?

Re: Support intel-ucode when using mkinitcpio

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 249 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1885353142

Comment:
maybe something like https://github.com/jirutka/efi-mkuki could be used, if one wants smth initram-agnostic.

Re: Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 282 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1894158557

Comment:
a solution is in progress in concert with upstream: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/merge_requests/291

Re: Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 282 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-1928092604

Comment:
microcode support has now been added on mkinitcpio's master branch and will be released with version 38 probably sometime this month.

Re: Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 448 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/48145#issuecomment-2002043065

Comment:
as of mkinitcpio 38, the microcode hook has been released. install the relevant microcode package (`intel-ucode` or `linux-firmware-amd`) and add `microcode` to the `HOOKS` array in `/etc/mkinitcpio.conf`. if the hook is placed after `autodetect`, only microcode for the your host cpu will be added.

Re: [ISSUE] [CLOSED] Support intel-ucode when using mkinitcpio

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 1506 bytes --]

Closed issue by basploeger on void-packages repository

https://github.com/void-linux/void-packages/issues/48145

Description:
### Is this a new report?

Yes

### System Info

Void 6.6.10_1 x86_64 GenuineIntel uptodate rrrmFFFFFF

### Package(s) Affected

intel-ucode-20231114_1, mkinitcpio-37_3

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

No. But [this information](https://wiki.archlinux.org/title/microcode#Initrd_images) from Arch Linux is useful for reference.

Arch's intel-ucode package generates the necessary `/boot/intel-ucode.img` [here](https://gitlab.archlinux.org/archlinux/packaging/packages/intel-ucode/-/blob/main/PKGBUILD?ref_type=heads#L22). 

### Expected behaviour

Intel microcode gets loaded in early boot before loading the initramfs produced by mkinitcpio.

### Actual behaviour

Intel microcode does not get loaded as testified by the following console error messages before initramfs gets loaded:

```
TSC_DEADLINE disabled due to Errata; please update microcode to version: 0x52 (or later)
RETBleed: WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!
```

These error messages disappear when loading an initramfs produced by dracut, as the intel-ucode package supports dracut already.

### Steps to reproduce

1. Install intel-ucode.
2. [Switch](https://docs.voidlinux.org/config/kernel.html#changing-the-default-initramfs-generator) from dracut to mkinitcpio
3. Reboot