14907 Update intel CPU Microcode to 20220809

Reviewed by: Robert Mustacchi <rm+illumos@fingolfin.org>
Reviewed by: Toomas Soome <tsoome@me.com>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>

14 files changed, 60 insertions, 38 deletions

diff --git a/usr/src/data/ucode/intel/00050653-01 b/usr/src/data/ucode/intel/00050653-01
index f7acec8415..91b8a8fb71 100644
--- a/usr/src/data/ucode/intel/00050653-01
+++ b/usr/src/data/ucode/intel/00050653-01
diff --git a/usr/src/data/ucode/intel/00050654-01 b/usr/src/data/ucode/intel/00050654-01
index f0399b2a76..07e2ac4f25 100644
--- a/usr/src/data/ucode/intel/00050654-01
+++ b/usr/src/data/ucode/intel/00050654-01
diff --git a/usr/src/data/ucode/intel/000606A6-01 b/usr/src/data/ucode/intel/000606A6-01
index 253220ce12..fc4e3aa78c 100644
--- a/usr/src/data/ucode/intel/000606A6-01
+++ b/usr/src/data/ucode/intel/000606A6-01
diff --git a/usr/src/data/ucode/intel/000706A1-01 b/usr/src/data/ucode/intel/000706A1-01
index 920c9946e1..e69a6c8271 100644
--- a/usr/src/data/ucode/intel/000706A1-01
+++ b/usr/src/data/ucode/intel/000706A1-01
diff --git a/usr/src/data/ucode/intel/000706A8-01 b/usr/src/data/ucode/intel/000706A8-01
index 204ab8cc4c..8d5811bb74 100644
--- a/usr/src/data/ucode/intel/000706A8-01
+++ b/usr/src/data/ucode/intel/000706A8-01
diff --git a/usr/src/data/ucode/intel/000706E5-80 b/usr/src/data/ucode/intel/000706E5-80
index c881a2939f..b1bc1dea11 100644
--- a/usr/src/data/ucode/intel/000706E5-80
+++ b/usr/src/data/ucode/intel/000706E5-80
diff --git a/usr/src/data/ucode/intel/000806C2-02 b/usr/src/data/ucode/intel/000806C2-02
index bdeed295f7..4e8fcd664c 100644
--- a/usr/src/data/ucode/intel/000806C2-02
+++ b/usr/src/data/ucode/intel/000806C2-02
diff --git a/usr/src/data/ucode/intel/000806D1-02 b/usr/src/data/ucode/intel/000806D1-02
index 566ee74855..1fd5d47fae 100644
--- a/usr/src/data/ucode/intel/000806D1-02
+++ b/usr/src/data/ucode/intel/000806D1-02
diff --git a/usr/src/data/ucode/intel/00090672-01 b/usr/src/data/ucode/intel/00090672-01
index c22db7cd4d..97b353539b 100644
--- a/usr/src/data/ucode/intel/00090672-01
+++ b/usr/src/data/ucode/intel/00090672-01
diff --git a/usr/src/data/ucode/intel/000906A3-80 b/usr/src/data/ucode/intel/000906A3-80
index e4406ad346..521ef9459d 100644
--- a/usr/src/data/ucode/intel/000906A3-80
+++ b/usr/src/data/ucode/intel/000906A3-80
diff --git a/usr/src/data/ucode/intel/000A0671-02 b/usr/src/data/ucode/intel/000A0671-02
index c5ff93d49a..7ab8509bdd 100644
--- a/usr/src/data/ucode/intel/000A0671-02
+++ b/usr/src/data/ucode/intel/000A0671-02
diff --git a/usr/src/data/ucode/update.amd b/usr/src/data/ucode/update.amd
index 55a2894211..59b0edee08 100755
--- a/usr/src/data/ucode/update.amd
+++ b/usr/src/data/ucode/update.amd
@@ -28,6 +28,11 @@ typeset -a GPGKEYS=(
 	0x916A770823A7B27AADE01565A5E8DBC98C0108B4
 )
 
+function errexit {
+	echo "$@" >&2
+	exit 1
+}
+
 FW=platform/i86pc/ucode/AuthenticAMD
 
 export LC_ALL=C.UTF-8
@@ -36,10 +41,7 @@ set -e
 set -o pipefail
 
 mf=../../pkg/manifests/system-microcode-amd.p5m
-[[ -f $mf ]] || {
-	echo "Run from usr/src/data/ucode" 2>&1
-	exit 1
-}
+[[ -f $mf ]] || errexit "Run from usr/src/data/ucode"
 
 function find_cmd {
 	typeset cmd="$1"
@@ -47,8 +49,7 @@ function find_cmd {
 	typeset -n path="$var"
 	path=$(whence -fp "$cmd")
 	if (($? != 0)) || [ ! -x "$path" ]; then
-		echo "Cannot find executable '$cmd' in PATH"
-		exit 1
+		errexit "Cannot find executable '$cmd' in PATH"
 	fi
 }
 
@@ -64,11 +65,8 @@ find_cmd stat
 find_cmd ucodeadm
 
 tmp=$(mktemp -d)
-mkdir -p $tmp/out || {
-	echo "Failed to create temporary directory" 2>&1
-	exit 1
-}
-
+[[ -n "$tmp" && -d "$tmp" ]]
+mkdir $tmp/out || errexit "Failed to create temporary directory"
 trap 'rm -rf $tmp' EXIT
 
 echo "** Adding AMD GPG signing keys to temporary keyring"
@@ -101,10 +99,7 @@ for f in $tmp/ucode/amd-ucode/*.bin; do
 	bf=${f##*/}
 	bf=${bf#microcode_}
 	bf=${bf%.bin}
-	[[ $bf = amd* ]] || {
-		echo "$f does not look like a firmware file"
-		exit 1
-	}
+	[[ $bf = amd* ]] || errexit "$f does not look like a firmware file"
 	echo "Converting $bf"
 	mkdir $tmp/out/$bf
 	cp $f $tmp/amd-fw
diff --git a/usr/src/data/ucode/update.intel b/usr/src/data/ucode/update.intel
index 8f690486cb..e949922d5f 100755
--- a/usr/src/data/ucode/update.intel
+++ b/usr/src/data/ucode/update.intel
@@ -9,52 +9,78 @@
 # source. A copy of the CDDL is also available via the Internet at
 # http://www.illumos.org/license/CDDL.
 
-# Copyright 2019 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2022 OmniOS Community Edition (OmniOSce) Association.
 # Copyright 2019 Joyent, Inc.
 
 # A simple update script that extracts an Intel microcode download file
 # into the intel/ directory, and updates the hardlinks in the
 # system/kernel/platform manifest.
 
-set -e
-set -o pipefail
-
-[[ -z "$1" ]] || [[ ! -f "$1" ]] && {
-	echo "Syntax: $0 <path to microcode tar>" >&2
+function errexit {
+	echo "$@" >&2
 	exit 1
 }
 
+[[ -n "$1" && -f "$1" ]] || errexit "Syntax: $0 <path to microcode tar>"
+
 ucodetar="$1"
 
+FW=platform/i86pc/ucode/GenuineIntel
+
+export LC_ALL=C.UTF-8
+
+set -e
+set -o pipefail
+
 mf=../../pkg/manifests/system-microcode-intel.p5m
-[[ -f $mf ]] || {
-	echo "Run from usr/src/data/ucode" 2>&1
-	exit 1
+[[ -f $mf ]] || errexit "Run from usr/src/data/ucode"
+
+function find_cmd {
+	typeset cmd="$1"
+	typeset var=$(echo $cmd | tr '[:lower:]' '[:upper:]')
+	typeset -n path="$var"
+	path=$(whence -fp "$cmd")
+	if (($? != 0)) || [ ! -x "$path" ]; then
+		errexit "Cannot find executable '$cmd' in PATH"
+	fi
 }
 
-fw=platform/i86pc/ucode/GenuineIntel
+# This script uses a few commands which are not part of illumos and are
+# expected to be available in the path.
+find_cmd gtar
+find_cmd pkgfmt
+# Search for 'ucodeadm'. If you need to use an updated ucodeadm to handle this
+# firmware update, as is occasionally necessary, ensure it occurs earlier in
+# the path than /usr/sbin.
+find_cmd ucodeadm
 
 tmp=$(mktemp -d)
-mkdir $tmp/out
+[[ -n "$tmp" && -d "$tmp" ]]
+mkdir $tmp/out || errexit "Failed to create temporary directory"
+trap 'rm -rf $tmp' EXIT
+
+# The distributed microcode archive uses GNU extensions
+$GTAR -C $tmp -xvf "$ucodetar"
 
-gtar -C $tmp -xvf "$ucodetar"
+path=$({ cd $tmp; echo Intel-Linux-Processor-Microcode-Data*; })
+ver=${path##*-}
+echo "** Updating to microcode version $ver"
 
-find $tmp/Intel-Linux-Processor-Microcode-Data*/intel-ucode*/ -type f \
-    | while read f; do
+find $tmp/$path/intel-ucode*/ -type f | while read f; do
 	echo "Converting $(basename $f)"
 	cp $f $tmp/intel-fw
-	ucodeadm -i -R $tmp/out $tmp/intel-fw
+	$UCODEADM -i -R $tmp/out $tmp/intel-fw
 	rm -f $tmp/intel-fw
 done
 
-pkgfmt -u $mf
+$PKGFMT -u $mf
 mv $mf $mf.tmp
-egrep -v "(file|hardlink) path=$fw" $mf.tmp > $mf
+egrep -v "(file|hardlink) path=$FW" $mf.tmp > $mf
 rm -f $mf.tmp
 
 rm -f intel/*
 
-cp $tmp/Intel-Linux-Processor-Microcode-Data*/license intel/THIRDPARTYLICENSE
+cp $tmp/$path/license intel/THIRDPARTYLICENSE
 echo Intel Processor Microcode Data Files > intel/THIRDPARTYLICENSE.descrip
 
 rm -f Makefile.links
@@ -79,7 +105,7 @@ done
 for f in intel/*; do
 	bf=$(basename $f)
 	[[ $bf = THIRDPARTYLICENSE* ]] && continue
-	echo "file path=$fw/$bf group=sys mode=0444 reboot-needed=true" >> $mf
+	echo "file path=$FW/$bf group=sys mode=0444 reboot-needed=true" >> $mf
 done
 
 (
@@ -92,7 +118,7 @@ done
 ) > Makefile.links
 
 for i in "${!links[@]}"; do
-	echo "hardlink path=$fw/$i target=${links[$i]}" >> $mf
+	echo "hardlink path=$FW/$i target=${links[$i]}" >> $mf
 	cat << EOM >> Makefile.links
 \$(ROOTINTELDIR)/$i: \$(ROOTINTELDIR)/${links[$i]}
 	\$(RM) \$@; \$(LN) \$^ \$@
@@ -100,6 +126,7 @@ for i in "${!links[@]}"; do
 EOM
 done
 
-pkgfmt -fv2 $mf
+sed -i "/pkg.fmri.*microcode\/intel@/s/@[0-9]*/@$ver/" $mf
+
+$PKGFMT -fv2 $mf
 
-rm -rf $tmp
diff --git a/usr/src/pkg/manifests/system-microcode-intel.p5m b/usr/src/pkg/manifests/system-microcode-intel.p5m
index 128bb630a1..5c5591159d 100644
--- a/usr/src/pkg/manifests/system-microcode-intel.p5m
+++ b/usr/src/pkg/manifests/system-microcode-intel.p5m
@@ -36,7 +36,7 @@
 #
 <include global_zone_only_component>
 set name=pkg.fmri \
-    value=pkg:/system/microcode/intel@20220510,$(PKGVERS_BUILTON)-$(PKGVERS_BRANCH)
+    value=pkg:/system/microcode/intel@20220809,$(PKGVERS_BUILTON)-$(PKGVERS_BRANCH)
 set name=pkg.summary value="Microcode for Intel CPUs"
 set name=pkg.description value="Microcode for Intel CPUs"
 set name=info.classification value=org.opensolaris.category.2008:System/Core