kernel: microcode in every initramfs through mkinitcpio's microcode hook (issue 1977)

Declares amd-ucode and intel-ucode, the drop-in /etc/mkinitcpio.conf.d/mesh-microcode.conf, the
initramfs script and mesh-kernel-initramfs.service; kernel_boot answers the running revision and
whether the images were built with the drop-in. Tests: 1977/AC1-AC5.

Builds: L1, L2, L3, L4, L5 (issue 1977 note 2)

modules/kernel/files/initramfs.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# The initramfs images as the mesh builds them (module kernel, novox/hq issue 1977). Run by
+# mesh-kernel-initramfs.service:
+#
+#   initramfs apply [<the microcode drop-in> [<this module's state> [<mkinitcpio file>]]]
+#
+# `apply` builds every image again (mkinitcpio -P) when the drop-in differs from the one the images were last built
+# with, kept in the state as `initramfs-built`, and records the drop-in only after mkinitcpio succeeded. Later
+# kernel upgrades build the images through the distribution's own hook, with the drop-in in place. The arguments
+# are only for the module's tests.
+set -eu
+
+dropin=/etc/mkinitcpio.conf.d/mesh-microcode.conf
+state='${dir:state}'
+[ $# -ge 2 ] && dropin=$2
+[ $# -ge 3 ] && state=$3
+
+[ $# -ge 1 ] && [ "$1" = apply ] || {
+	echo "usage: initramfs apply [<drop-in> [<state directory>]]" >&2
+	exit 2
+}
+[ -f "$dropin" ] || {
+	echo "initramfs: $dropin is not there, so the images cannot be built with the microcode hook" >&2
+	exit 1
+}
+if [ -f "$state/initramfs-built" ] && cmp -s "$dropin" "$state/initramfs-built"; then
+	echo "initramfs: the images were built with this drop-in, as it was"
+	exit 0
+fi
+if ! mkinitcpio -P; then
+	echo "initramfs: mkinitcpio failed; nothing recorded, the next start tries again" >&2
+	exit 1
+fi
+cp "$dropin" "$state/initramfs-built.new"
+mv "$state/initramfs-built.new" "$state/initramfs-built"
+echo "initramfs: the images are built with the microcode drop-in"