[Pkg-xen-devel] Microcode update for Xen in Wheezy (Was: Re: ANNOUNCEMENT: Intel/AMD x86 CPU microcode update system in non-free)

[Ian Campbell]

Dropping users and adding pkg-xen-devel and debian-kernel.

On Tue, 2012-11-06 at 15:43 +0100, Stephan Seitz wrote:
> On Mon, Nov 05, 2012 at 06:12:53PM -0200, Henrique de Moraes Holschuh wrote:
> >I would like to bring to your attention the improved support for system
> >processor (CPU) microcode updates, for x86/i686/x86-64/amd64 systems
> >that was recently added to [non-free] Wheezy.
> 
> Alas, this will not work for XEN users because I can’t update the 
> microcode in Dom0 with xen-hypervisor 4.1.

I think it would be useful to have this recorded as a (wishlist) bug.

>  There exist kernel patches 
> (over a year old), but according to the xen-devel ML they are not good 
> enough to be included in the kernel.

Basically the kernel guys have decided that microcode loading should be
done earlier (pre kernel) and so aren't willing to take the Xen patches
to integrate with the old mechanism. Which is frustrating but fair
enough.

> With XEN 4.2 the hypervisor can load the CPU microcode. Would this be 
> a reason to include XEN 4.2 in Wheezy?

I don't think upgrading to 4.2 would be consistent with the freeze.

I think there are basically two options here, first is to backport the
patches to 4.1[0]. It's quite a big set of changes but it seems to be
mostly contained to the microcode files (I'm not an expert in this area
though). 

Second would be to take the kernel patches as an interim measure for
Wheezy with the understanding that the inevitable upgrade to 4.2+ in
Jessie will cause them to go away.

Although the kernel patches are not in upstream they are pretty long
standing (the same code is in the Squeeze kernel's xen flavour for
example) and well tested compared with any proposed new backport of the
Xen feature. With the kernel change there's also no need for surrounding
tools changes (e.g. teaching update-grub about this stuff) for Wheezy,
which is a can-o-worms in itself. So I'd be inclined to recommend going
the kernel patch route for Wheezy.

Ian.

[0] I think the relevant set of backports would be:
24315:3e5683b6b37f x86/microcode: enable boot time (pre-Dom0) loading
24390:77528dbced3e x86/microcode: Allow "ucode=" argument to be negative
24411:ca5f588bd203 x86/ucode: fix for AMD Fam15 CPUs

[1] 9 files changed, 230 insertions(+), 63 deletions(-)