%define upstream_version 2.1-18

%define intel_ucode_version 20201027

%define caveat_dir %{_datarootdir}/microcode_ctl/ucode_with_caveats

%define microcode_ctl_libexec %{_libexecdir}/microcode_ctl

%define update_ucode %{microcode_ctl_libexec}/update_ucode

%define check_caveats %{microcode_ctl_libexec}/check_caveats

%define reload_microcode %{microcode_ctl_libexec}/reload_microcode

%define dracutlibdir %{_prefix}/lib/dracut

%define i_m2u_man intel-microcode2ucode.8

# In microcode_ctl, documentation directory is unversioned historically.

# In RHEL 8 spec, %{_pkgdocdir} is used as installation destination; however,

# it is unversioned only since Fedora 20, per #986871,

# and not in Fedora 18/19-based RHEL 7.

%define _pkgdocdir %{_docdir}/%{name}

Summary:        Tool to transform and deploy CPU microcode update for x86.

Name:           microcode_ctl

Version:        2.1

Release:        73.2%{?dist}

Epoch:          2

Group:          System Environment/Base

License:        GPLv2+ and Redistributable, no modification permitted

URL:            https://pagure.io/microcode_ctl

Source0:        https://releases.pagure.org/microcode_ctl/%{name}-%{upstream_version}.tar.xz

#Source1:        https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/archive/microcode-%{intel_ucode_version}.tar.gz

Source1:        microcode-%{intel_ucode_version}.tar.gz

# (Pre-MDS) revision 0x714 of 06-2d-07 microcode

Source2:        https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/raw/microcode-20190514/intel-ucode/06-2d-07

# (Pre-20191112) revision 0x2000064 of 06-55-04 microcode

Source3:        https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/raw/microcode-20190918/intel-ucode/06-55-04

# (Pre-20200609) revision 0xd6 of 06-4e-03/06-5e-03 microcode

Source4:        https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/raw/microcode-20200520/intel-ucode/06-4e-03

Source5:        https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/raw/microcode-20200520/intel-ucode/06-5e-03

# systemd unit

Source10:       microcode.service

# dracut-related stuff

Source20:       01-microcode.conf

Source21:       99-microcode-override.conf

Source22:       dracut_99microcode_ctl-fw_dir_override_module_init.sh

# libexec

Source30:       update_ucode

Source31:       check_caveats

Source32:       reload_microcode

# docs

Source40:       %{i_m2u_man}.in

Source41:       README.caveats

Source42:       README

## Caveats

# BDW EP/EX

# https://bugzilla.redhat.com/show_bug.cgi?id=1622180

# https://bugzilla.redhat.com/show_bug.cgi?id=1623630

# https://bugzilla.redhat.com/show_bug.cgi?id=1646383

Source100:      06-4f-01_readme

Source101:      06-4f-01_config

Source102:      06-4f-01_disclaimer

# Unsafe early MC update inside VM:

# https://bugzilla.redhat.com/show_bug.cgi?id=1596627

Source110:      intel_readme

Source111:      intel_config

Source112:      intel_disclaimer

# SNB-EP (CPUID 0x206d7) post-MDS hangs

# https://bugzilla.redhat.com/show_bug.cgi?id=1758382

# https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/15

Source120:      06-2d-07_readme

Source121:      06-2d-07_config

Source122:      06-2d-07_disclaimer

# SKL-SP/W/X (CPUID 0x50654) post-20191112 hangs

# https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/21

Source130:      06-55-04_readme

Source131:      06-55-04_config

Source132:      06-55-04_disclaimer

# SKL-U/Y (CPUID 0x406e3) post-20200609 hangs

# https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31

Source140:      06-4e-03_readme

Source141:      06-4e-03_config

Source142:      06-4e-03_disclaimer

# SKL-H/S/Xeon E3 v5 (CPUID 0x506e3) post-20200609 possible hangs

# https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31#issuecomment-644885826

Source150:      06-5e-03_readme

Source151:      06-5e-03_config

Source152:      06-5e-03_disclaimer

# "Provides:" RPM tags generator

Source200:      gen_provides.sh

Source201:      codenames.list

Source202:      gen_updates2.py

Patch1:         microcode_ctl-do-not-merge-ucode-with-caveats.patch

Patch2:         microcode_ctl-revert-intel-microcode2ucode-removal.patch

Patch3:         microcode_ctl-use-microcode-%{intel_ucode_version}-tgz.patch

Patch4:         microcode_ctl-do-not-install-intel-ucode.patch

Patch5:         microcode_ctl-intel-microcode2ucode-buf-handling.patch

Patch6:         microcode_ctl-ignore-first-directory-level-in-archive.patch

Buildroot:      %{_tmppath}/%{name}-%{version}-root

ExclusiveArch:  %{ix86} x86_64

BuildRequires:  systemd-units

# hexdump is used in gen_provides.sh

BuildRequires:  coreutils util-linux python

Requires:       coreutils

Requires(post): systemd coreutils

Requires(preun): systemd coreutils

Requires(postun): systemd coreutils

Requires(posttrans): dracut coreutils

%global _use_internal_dependency_generator 0

%define __find_provides "%{SOURCE200}" "%{SOURCE201}"

%description

The microcode_ctl utility is a companion to the microcode driver written

by Tigran Aivazian <tigran@aivazian.fsnet.co.uk>.

The microcode update is volatile and needs to be uploaded on each system

boot i.e. it doesn't reflash your cpu permanently, reboot and it reverts

back to the old microcode.

%prep

%setup -q -n %{name}-%{upstream_version}

tar xf "%{SOURCE1}" --wildcards --strip-components=1 \

	\*/intel-ucode-with-caveats \

	\*/license \*/releasenote.md \*/README.md \*/security.md

%patch1 -p1

%patch2 -p1

# Use the latest archive instead of microcode-20180703.tgz bundled

# with upstream microcode_ctl-2.1-18.

cp "%{SOURCE1}" .

%patch3 -p1

# We install ucode files manually into "intel" caveat directory

%patch4 -p1

%patch5 -p1

# The archive published on github has an additional top-level directory,

# strip it.

%patch6 -p1

%build

make CFLAGS="$RPM_OPT_FLAGS" %{?_smp_mflags}

# We do not populate any intel-ucode files into /lib/firmware directly due to

# early microcode load inside VM issue:

#   https://bugzilla.redhat.com/show_bug.cgi?id=1596627

#   https://bugzilla.redhat.com/show_bug.cgi?id=1607899

#find intel-ucode -type f | sed 's/^/%%ghost \/lib\/firmware\//' > ghost_list

touch ghost_list

# replacing SNB-EP (CPUID 0x206d7) microcode with pre-MDS version

mv intel-ucode/06-2d-07 intel-ucode-with-caveats/

cp "%{SOURCE2}" intel-ucode/

# replacing SKL-SP/W/X (CPUID 0x50654) microcode with pre-20191112 version

mv intel-ucode/06-55-04 intel-ucode-with-caveats/

cp "%{SOURCE3}" intel-ucode/

# replacing SKL-U/Y (CPUID 0x4063e) microcode with pre-20200609 version

mv intel-ucode/06-4e-03 intel-ucode-with-caveats/

cp "%{SOURCE4}" intel-ucode/

# replacing SKL-H/S/Xeon E3 v5 (CPUID 0x5063e) microcode with pre-20200609 version

mv intel-ucode/06-5e-03 intel-ucode-with-caveats/

cp "%{SOURCE5}" intel-ucode/

# man page

sed "%{SOURCE40}" \

	-e "s/@DATE@/2019-05-09/g" \

	-e "s/@VERSION@/%{version}-%{release}/g" \

	-e "s|@MICROCODE_URL@|https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files|g" > "%{i_m2u_man}"

%install

rm -rf %{buildroot}

make DESTDIR=%{buildroot} PREFIX=%{_prefix} INSDIR=/usr/sbin MICDIR=/usr/share/microcode_ctl install clean

install -m 755 -d \

	"%{buildroot}/%{_datarootdir}/microcode_ctl/intel-ucode" \

	"%{buildroot}/%{caveat_dir}/" \

	"%{buildroot}/etc/microcode_ctl/ucode_with_caveats/"

# systemd unit

install -m 755 -d "%{buildroot}/%{_unitdir}"

install -m 644 "%{SOURCE10}" -t "%{buildroot}/%{_unitdir}/"

# dracut

%define dracut_mod_dir "%{buildroot}/%{dracutlibdir}/modules.d/99microcode_ctl-fw_dir_override"

install -m 755 -d \

	"%{dracut_mod_dir}" \

	"%{buildroot}/%{dracutlibdir}/dracut.conf.d/"

install -m 644 "%{SOURCE20}" "%{SOURCE21}" \

	-t "%{buildroot}/%{dracutlibdir}/dracut.conf.d/"

install -m 755 "%{SOURCE22}" "%{dracut_mod_dir}/module-setup.sh"

# Internal helper scripts

install -m 755 -d "%{buildroot}/%{microcode_ctl_libexec}"

install "%{SOURCE30}" "%{SOURCE31}" "%{SOURCE32}" \

	-m 755 -t "%{buildroot}/%{microcode_ctl_libexec}"

## Documentation

install -m 755 -d "%{buildroot}/%{_pkgdocdir}/caveats"

# caveats readme

install "%{SOURCE41}"  "%{SOURCE42}" \

	-m 644 -t "%{buildroot}/%{_pkgdocdir}/"

# Provide Intel microcode license, as it requires so

install -m 644 license \

	"%{buildroot}/%{_pkgdocdir}/LICENSE.intel-ucode"

# Provide release notes, README and security for Intel microcode

install -m 644 README.md \

	"%{buildroot}/%{_pkgdocdir}/README.intel-ucode"

install -m 644 security.md \

	"%{buildroot}/%{_pkgdocdir}/SECURITY.intel-ucode"

install -m 644 releasenote.md \

	"%{buildroot}/%{_pkgdocdir}/RELEASE_NOTES.intel-ucode"

# caveats

install -m 644 "%{SOURCE100}" "%{SOURCE110}" "%{SOURCE120}" "%{SOURCE130}" \

	       "%{SOURCE140}" "%{SOURCE150}" \

	-t "%{buildroot}/%{_pkgdocdir}/caveats/"

# Man page

install -m 755 -d %{buildroot}/%{_mandir}/man8/

install -m 644 "%{i_m2u_man}" -t %{buildroot}/%{_mandir}/man8/

## Caveat data

# BDW caveat

%define bdw_inst_dir %{buildroot}/%{caveat_dir}/intel-06-4f-01/

install -m 755 -d "%{bdw_inst_dir}/intel-ucode"

install -m 644 intel-ucode-with-caveats/06-4f-01 -t "%{bdw_inst_dir}/intel-ucode/"

install -m 644 "%{SOURCE100}" "%{bdw_inst_dir}/readme"

install -m 644 "%{SOURCE101}" "%{bdw_inst_dir}/config"

install -m 644 "%{SOURCE102}" "%{bdw_inst_dir}/disclaimer"

# Early update caveat

%define intel_inst_dir %{buildroot}/%{caveat_dir}/intel/

install -m 755 -d "%{intel_inst_dir}/intel-ucode"

install -m 644 intel-ucode/* -t "%{intel_inst_dir}/intel-ucode/"

install -m 644 "%{SOURCE110}" "%{intel_inst_dir}/readme"

install -m 644 "%{SOURCE111}" "%{intel_inst_dir}/config"

install -m 644 "%{SOURCE112}" "%{intel_inst_dir}/disclaimer"

# SNB caveat

%define snb_inst_dir %{buildroot}/%{caveat_dir}/intel-06-2d-07/

install -m 755 -d "%{snb_inst_dir}/intel-ucode"

install -m 644 intel-ucode-with-caveats/06-2d-07 -t "%{snb_inst_dir}/intel-ucode/"

install -m 644 "%{SOURCE120}" "%{snb_inst_dir}/readme"

install -m 644 "%{SOURCE121}" "%{snb_inst_dir}/config"

install -m 644 "%{SOURCE122}" "%{snb_inst_dir}/disclaimer"

# SKL-SP caveat

%define skl_sp_inst_dir %{buildroot}/%{caveat_dir}/intel-06-55-04/

install -m 755 -d "%{skl_sp_inst_dir}/intel-ucode"

install -m 644 intel-ucode-with-caveats/06-55-04 -t "%{skl_sp_inst_dir}/intel-ucode/"

install -m 644 "%{SOURCE130}" "%{skl_sp_inst_dir}/readme"

install -m 644 "%{SOURCE131}" "%{skl_sp_inst_dir}/config"

install -m 644 "%{SOURCE132}" "%{skl_sp_inst_dir}/disclaimer"

# SKL-U/Y caveat

%define skl_uy_inst_dir %{buildroot}/%{caveat_dir}/intel-06-4e-03/

install -m 755 -d "%{skl_uy_inst_dir}/intel-ucode"

install -m 644 intel-ucode-with-caveats/06-4e-03 -t "%{skl_uy_inst_dir}/intel-ucode/"

install -m 644 "%{SOURCE140}" "%{skl_uy_inst_dir}/readme"

install -m 644 "%{SOURCE141}" "%{skl_uy_inst_dir}/config"

install -m 644 "%{SOURCE142}" "%{skl_uy_inst_dir}/disclaimer"

# SKL-H/S/Xeoon E3 v5 caveat

%define skl_hs_inst_dir %{buildroot}/%{caveat_dir}/intel-06-5e-03/

install -m 755 -d "%{skl_hs_inst_dir}/intel-ucode"

install -m 644 intel-ucode-with-caveats/06-5e-03 -t "%{skl_hs_inst_dir}/intel-ucode/"

install -m 644 "%{SOURCE150}" "%{skl_hs_inst_dir}/readme"

install -m 644 "%{SOURCE151}" "%{skl_hs_inst_dir}/config"

install -m 644 "%{SOURCE152}" "%{skl_hs_inst_dir}/disclaimer"

# SUMMARY.intel-ucode generation

# It is to be done only after file population, so, it is here,

# at the end of the install stage

/usr/bin/python "%{SOURCE202}" -C "%{SOURCE201}" \

	summary -A "%{buildroot}" \

	> "%{buildroot}/%{_pkgdocdir}/SUMMARY.intel-ucode"

# Cleanup

rm -f intel-ucode-with-caveats/06-2d-07

rm -f intel-ucode-with-caveats/06-4e-03

rm -f intel-ucode-with-caveats/06-4f-01

rm -f intel-ucode-with-caveats/06-55-04

rm -f intel-ucode-with-caveats/06-5e-03

rmdir intel-ucode-with-caveats

rm -rf intel-ucode

%post

%systemd_post microcode.service

%{update_ucode}

%{reload_microcode}

# send the message to syslog, so it gets recorded on /var/log

if [ -e /usr/bin/logger ]; then

	%{check_caveats} -m -d | /usr/bin/logger -p syslog.notice -t DISCLAIMER

fi

# also paste it over dmesg (some customers drop dmesg messages while

# others keep them into /var/log for the later case, we'll have the

# disclaimer recorded twice into system logs.

%{check_caveats} -m -d > /dev/kmsg

exit 0

%posttrans

# We only want to regenerate the initramfs for a fully booted

# system; if this package happened to e.g. be pulled in as a build

# dependency, it is pointless at best to regenerate the initramfs,

# and also does not work with rpm-ostree:

# https://bugzilla.redhat.com/show_bug.cgi?id=1199582

# https://bugzilla.redhat.com/show_bug.cgi?id=1530400

[ -d /run/systemd/system ] || exit 0

# We can't simply update all initramfs images, since "dracut --regenerate-all"

# generates initramfs even for removed kernels and if dracut generates botched

# initramfs image, that results in unbootable system, even with older kernels

# that can't be used as a fallback:

# https://bugzilla.redhat.com/show_bug.cgi?id=1420180

# https://access.redhat.com/support/cases/#/case/01779274

# https://access.redhat.com/support/cases/#/case/01814106

#

# ...and we can't simply limit ourselves to updating only the currently

# running kernel, as this doesn't work well with cases where kernel

# is installed before the updated microcode, or in the same transaction.

# And we can't rely on late update either, due to issues like this:

# https://bugzilla.redhat.com/show_bug.cgi?id=1710445

#

# ...and there are also issues with setups with increased "installonly_limit"

# in /etc/yum.conf, which could lead to unacceptably long package installation

# times.

#

# So, in the end, we try to grab no more than 2 most recently installed kernels

# that are installed after the currently running one (with the currently running

# kernel that makes up to 3 in total, the default "installonly_limit" value)

# as a kernel package selection heuristic that tries to accomodate both the need

# to put the latest microcode in freshly installed kernels and also addresses

# existing concerns.

#

# For RPM selection, kernel flavours (like "debug" or "kdump" or "zfcp",

# with only the former being relevant to x86 architecture) are a part or RPM

# name; it's also a part of uname, with different separator used in RHEL 6/7

# and RHEL 8.  RT kernel, however, is special, as "rt" is another part

# of RPM name and it has its own versioning scheme both in NVR and uname.

# And there's the kernel package split in RHEL 8, so one should look for *-core

# and not the main package.

pkgs="kernel kernel-debug kernel-rt kernel-rt-debug"

qf='%%{NAME} %%{VERSION}-%%{RELEASE}.%%{ARCH} %%{installtime}\n'

: "${MICROCODE_RPM_KVER_LIMIT=2}"

rpm -qa --qf "${qf}" ${pkgs} | sort -r -n -k'3,3' | {

	kver_cnt=0

	processed=""

	skipped=""

	skip=0

	while read -r pkgname vra install_ts; do

		flavour=''

		# For x86, only "debug" flavour exists in RHEL 8

		[ "x${pkgname%*-debug}" = "x${pkgname}" ] \

			|| flavour='.debug'

		kver_cnt="$((kver_cnt + 1))"

		kver_uname="${vra}${flavour}"

		# Also check that the kernel is actually installed:

		# https://bugzilla.redhat.com/show_bug.cgi?id=1591664

		# We use the presence of symvers file as an indicator, the check

		# similar to what weak-modules script does.

		#

		# XXX: Not sure if this check is still needed, since we now

		# iterate over the rpm output.

		[ -e "/boot/symvers-${kver_uname}.gz" ] || continue

		# Check that modules.dep for the kernel is present as well,

		# otherwise dracut complains with "/lib/modules/.../modules.dep

		# is missing. Did you run depmod?".

		[ -e "/lib/modules/${kver_uname}/modules.dep" ] || continue

		# We update the kernels with the same uname as the running kernel

		# regardless of the selected limit

		if [ "x$(uname -r)" = "x${kver_uname}" \

		     -o \( "${kver_cnt}" -le "${MICROCODE_RPM_KVER_LIMIT}" \

		           -a "${skip}" = 0 \) ]

		then

			dracut -f --kver "${kver_uname}"

			processed="${processed} ${pkgname}-${vra}"

		else

			skipped="${skipped} ${pkgname}-${vra}"

		fi

		# The packages are processed until a package with the same uname

		# as the running kernel is hit (since they are sorted

		# in the descending installation time stamp older).

		[ "x$(uname -r)" != "x${kver_uname}" ] || skip=1

	done

	if [ -n "${skipped}" ]; then

		skip_msg="After installation of a new version of microcode_ctl package,

initramfs hasn't been re-generated for all the installed kernel packages.

The following kernel packages have been skipped:${skipped}.

Please re-generate initramfs manually for these kernel packages with the

\"dracut -f --kver KERNEL_VERSION\" command in order to get the latest

Intel CPU microcode included into early initramfs image for it, if needed."

		if [ -e /usr/bin/logger ]; then

			echo "${skip_msg}" |

				/usr/bin/logger -p syslog.notice -t microcode_ctl

		fi

		if [ -e /dev/kmsg ]; then

			echo "${skip_msg}" > /dev/kmsg

		fi

	fi

}

exit 0

%global rpm_state_dir %{_localstatedir}/lib/rpm-state

%preun

%systemd_preun microcode.service

# Storing ucode list before uninstall

ls /usr/share/microcode_ctl/intel-ucode |

	sort > "%{rpm_state_dir}/microcode_ctl_un_intel-ucode"

ls /usr/share/microcode_ctl/ucode_with_caveats |

	sort > "%{rpm_state_dir}/microcode_ctl_un_ucode_caveats"

%{update_ucode} --action list --skip-common |

	sort > "%{rpm_state_dir}/microcode_ctl_un_file_list"

%postun

%systemd_postun microcode.service

ls /usr/share/microcode_ctl/intel-ucode 2> /dev/null |

	sort > "%{rpm_state_dir}/microcode_ctl_un_intel-ucode_after"

comm -23 \

	"%{rpm_state_dir}/microcode_ctl_un_intel-ucode" \

	"%{rpm_state_dir}/microcode_ctl_un_intel-ucode_after" \

	> "%{rpm_state_dir}/microcode_ctl_un_intel-ucode_diff"

if [ -e "%{update_ucode}" ]; then

	ls /usr/share/microcode_ctl/ucode_with_caveats 2> /dev/null |

		sort > "%{rpm_state_dir}/microcode_ctl_un_ucode_caveats_after"

	comm -23 \

		"%{rpm_state_dir}/microcode_ctl_un_ucode_caveats" \

		"%{rpm_state_dir}/microcode_ctl_un_ucode_caveats_after" \

		> "%{rpm_state_dir}/microcode_ctl_un_ucode_caveats_diff"

	%{update_ucode} --action remove --cleanup \

		"%{rpm_state_dir}/microcode_ctl_un_intel-ucode_diff" \

		"%{rpm_state_dir}/microcode_ctl_un_ucode_caveats_diff" || :

	rm -f "%{rpm_state_dir}/microcode_ctl_un_ucode_caveats_after"

	rm -f "%{rpm_state_dir}/microcode_ctl_un_ucode_caveats_diff"

else

	while read -r f; do

		[ -L "/lib/firmware/intel-ucode/$f" ] || continue

		rm -f "/lib/firmware/intel-ucode/$f"

	done < "%{rpm_state_dir}/microcode_ctl_un_intel-ucode_diff"

	rmdir "/lib/firmware/intel-ucode" 2>/dev/null || :

	# We presume that if we don't have update_ucode script, we can remove

	# all the caveats-related files.

	while read -r f; do

		if [ -L "$f" ] || [ "${f%%readme-*}" != "$f" ]; then

			rm -f "$f"

			rmdir -p $(dirname "$f") 2>/dev/null || :

		fi

	done < "%{rpm_state_dir}/microcode_ctl_un_file_list"

fi

rm -f "%{rpm_state_dir}/microcode_ctl_un_intel-ucode"

rm -f "%{rpm_state_dir}/microcode_ctl_un_intel-ucode_after"

rm -f "%{rpm_state_dir}/microcode_ctl_un_intel-ucode_diff"

rm -f "%{rpm_state_dir}/microcode_ctl_un_ucode_caveats"

rm -f "%{rpm_state_dir}/microcode_ctl_un_file_list"

exit 0

%triggerin -- kernel, kernel-debug, kernel-rt, kernel-rt-debug

%{update_ucode}

%triggerpostun -- kernel, kernel-debug, kernel-rt, kernel-rt-debug

%{update_ucode}

%clean

rm -rf %{buildroot}

%files -f ghost_list

%ghost %attr(0755, root, root) /lib/firmware/intel-ucode/

/usr/sbin/intel-microcode2ucode

%{microcode_ctl_libexec}

/usr/share/microcode_ctl

%{dracutlibdir}/modules.d/*

%config(noreplace) %{dracutlibdir}/dracut.conf.d/*

%{_unitdir}/microcode.service

%doc %{_pkgdocdir}

%{_mandir}/man8/*

%changelog

* Fri Oct 30 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2

- Update Intel CPU microcode to microcode-20201027 release, addresses

  CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698

  (#1893261, #1893249, #1893229):

  - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;

  - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;

  - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;

  - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;

  - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;

  - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision

    0xe0;

  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in

    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;

  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in

    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up

    to 0x2006a08;

  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in

    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;

  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up

    to 0xde;

  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up

    to 0xde;

  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up

    to 0xe0;

  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up

    to 0xde;

  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)

    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from

    revision 0xd6 up to 0xde;

  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up

    to 0xde;

  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up

    to 0xde;

  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up

    to 0xde;

  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up

    to 0xde;

  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in

    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up

    to 0xde;

  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode

    from revision 0x43 up to 0x44;

  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157

    up to 0x1000159;

  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01

    up to 0x4003003;

  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision

    0x5002f01 up to 0x5003003;

  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up

    to 0x40;

  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up

    to 0x1e;

  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up

    to 0x18;

  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78

    up to 0xa0;

  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca

    up to 0xe0.

* Fri Oct 30 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1

- Add README file to the documentation directory.

- Add publicly-sourced codenames list to supply to gen_provides.sh; update

  the latter to handle the somewhat different format.

- Add SUMMARY.intel-ucode file containing metadata information from

  the microcode file headers.

* Mon Jun 15 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73

- Update Intel CPU microcode to microcode-20200609 release (#1826589):

  - Fixed a typo in the release note file.

* Mon Jun 15 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-72

- Enable 06-2d-07 (SNB-E/EN/EP) caveat by default (#1846023).

* Mon Jun 15 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-71

- Enable 06-55-04 (SKL-X/W) caveat by default.

* Sun Jun 14 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-70

- Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision

  0xdc, use 0xd6 by default (#1846133).

* Thu Jun 04 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-69

- Avoid temporary file creation, used for here-documents in check_caveats.

* Wed Jun 03 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-68

- Update Intel CPU microcode to microcode-20200602 release, addresses

  CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795352, #1795355, #1827190):

  - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;

  - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e

    up to 0x2f;

  - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25

    up to 0x26;

  - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;

  - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21

    up to 0x22;

  - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6

    up to 0xdc;

  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151

    up to 0x1000157;

  - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode

    (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065

    up to 0x2006906;

  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c

    up to 0x4002f01;

  - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c

    up to 0x5002f01;

  - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6

    up to 0xdc;

  - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca

    up to 0xd6;

  - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca

    up to 0xd6;

  - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca

    up to 0xd6;

  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca

    up to 0xd6;

  - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode

    from revision 0xca up to 0xd6;

  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision

    0xca up to 0xd6;

  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca

    up to 0xd6;

  - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;

  - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca

    up to 0xd6;

  - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.

* Fri May 22 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-67

- Update Intel CPU microcode to microcode-20200520 release (#1783103):

  - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f

    up to 0x621;

  - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718

    up to 0x71a.

* Thu May 14 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-66

- Update Intel CPU microcode to microcode-20200508 release (#1835549):

  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46

    up to 0x78.

- Change the URL in the intel-microcode2ucode.8 to point to the GitHub

  repository since the microcode download section at Intel Download Center

  does not exist anymore.

* Thu May 07 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-65

- Narrow down SKL-SP/W/X blacklist to exclude Server/FPGA/Fabric segment

  models (#1833037).

* Wed Apr 29 2020 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-64

- Re-generate initramfs not only for the currently running kernel,

  but for several recently installed kernels as well (#1773347).

* Mon Dec 09 2019 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-63

- Avoid find being SIGPIPE'd on early "grep -q" exit in the dracut script

  (#1781332).

* Mon Dec 09 2019 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-62

- Update stale posttrans dependency, add triggers for proper handling

  of the debug kernel flavour along with kernel-rt (#1780257).

* Wed Nov 20 2019 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-61

- Do not update 06-55-04 (SKL-SP/W/X) to revision 0x2000065, use 0x2000064

  by default (#1774329).

* Sat Nov 16 2019 Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-60

- Update Intel CPU microcode to microcode-20191115 release:

  - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;

  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4

    up to 0xd6;

  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;

  - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;

  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;

  - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;

  - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision

    0xc6 up to 0xca;

  - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6

    up to 0xca;

  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;