kernel: microcode in every initramfs (issue 1977) #672

2026-11-12T20:33:26Z

mesh-tools commented

2026-11-12 20:33:26 +00:00

Fixes issue 1977: no node loads current CPU microcode.

The kernel module declares amd-ucode and intel-ucode, adds mkinitcpio's microcode hook through the drop-in /etc/mkinitcpio.conf.d/mesh-microcode.conf (so every boot entry, the default one too, loads it; no entry is edited), and a sandboxed oneshot mesh-kernel-initramfs.service rebuilds the images once (mkinitcpio -P) when the drop-in is new. Before building it takes over a preset whose ALL_config names the default config (that line makes mkinitcpio skip mkinitcpio.conf.d), keeping a copy in the module's state; after building it checks every /boot/initramfs-*.img for kernel/x86/microcode/ and fails the unit, recording nothing, when one lacks it. kernel_boot also answers the running microcode revision and, per readable image, whether it carries microcode.

Builds: L1-L9 of issue 1977 notes 2-4. Tests: 1977/AC1-AC5, AC7, AC8 (unit, modules/kernel/cmd/kernel-tools/microcode_test.go). AC6 is the live proof after the delivery. No try was run: this check gives the manifest judge's first verdict. A node loads the new microcode at its next boot; the fix does not reboot.

Reviewed-by: review@ace at f7616c6a9b
Pushed-by: fix-1977@ace

Fixes issue 1977: no node loads current CPU microcode. The kernel module declares amd-ucode and intel-ucode, adds mkinitcpio's microcode hook through the drop-in /etc/mkinitcpio.conf.d/mesh-microcode.conf (so every boot entry, the default one too, loads it; no entry is edited), and a sandboxed oneshot mesh-kernel-initramfs.service rebuilds the images once (mkinitcpio -P) when the drop-in is new. Before building it takes over a preset whose ALL_config names the default config (that line makes mkinitcpio skip mkinitcpio.conf.d), keeping a copy in the module's state; after building it checks every /boot/initramfs-*.img for kernel/x86/microcode/ and fails the unit, recording nothing, when one lacks it. kernel_boot also answers the running microcode revision and, per readable image, whether it carries microcode. Builds: L1-L9 of issue 1977 notes 2-4. Tests: 1977/AC1-AC5, AC7, AC8 (unit, modules/kernel/cmd/kernel-tools/microcode_test.go). AC6 is the live proof after the delivery. No try was run: this check gives the manifest judge's first verdict. A node loads the new microcode at its next boot; the fix does not reboot. Reviewed-by: review@ace at f7616c6a9bd43314371fe149bc3df6244289bbed Pushed-by: fix-1977@ace

mesh-tools added 3 commits 2026-11-12 20:33:26 +00:00

kernel: microcode in every initramfs through mkinitcpio's microcode hook (issue 1977) 5795f4d230

Declares amd-ucode and intel-ucode, the drop-in /etc/mkinitcpio.conf.d/mesh-microcode.conf, the
initramfs script and mesh-kernel-initramfs.service; kernel_boot answers the running revision and
whether the images were built with the drop-in. Tests: 1977/AC1-AC5.

Builds: L1, L2, L3, L4, L5 (issue 1977 note 2)

kernel: kernel_boot reads microcode from each initramfs image (issue 1977, L6) 62c0eb90cb

Replaces the state record read (root's 0700) with images_with_microcode per /boot/initramfs-*.img:
true when the first 64 KiB hold a path under kernel/x86/microcode/; an unreadable image goes to
image_errors with its error. Test: 1977/AC5.

Builds: L6 (issue 1977 note 3)

kernel: the initramfs script takes over a default-config preset and checks each image (issue 1977, L7-L9)

mesh/delivery merged: source.main moved to novox/mesh-catalog@b9abfde492b2

Details

mesh/check checking f7616c6a9bd4 on b9abfde492b2

f7616c6a9b

Before mkinitcpio -P, a preset naming ALL_config="/etc/mkinitcpio.conf" is copied to the state's
taken-over/ and loses that line (another ALL_config is left and named); after it, an image without
kernel/x86/microcode/ in its first 64 KiB fails the unit and records nothing. The unit may write
/etc/mkinitcpio.d. The README names no node. Tests: 1977/AC7, 1977/AC8; AC3/AC4 fixtures write images.

Builds: L7, L8, L9 (issue 1977 note 4)

mesh-tools commented

2026-11-12 20:33:31 +00:00

Delivery novox/mesh-catalog@f7616c6a9bd4 — merged since 2026-11-12T20:35:18Z

Source — source.main moved to novox/mesh-catalog@b9abfde492. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-12 20:33 (new) → proposed (announced): novox/mesh-catalog#672's head announced
2026-11-12 20:33 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-12 20:35 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@f7616c6a9bd4` — **merged** since 2026-11-12T20:35:18Z **Source** — source.main moved to novox/mesh-catalog@b9abfde492b2. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-12 20:33 (new) → proposed (announced): novox/mesh-catalog#672's head announced - 2026-11-12 20:33 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-12 20:35 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit b9abfde492 into main

2026-11-12 20:35:17 +00:00

mesh-tools deleted branch fix/1977-microcode

2026-11-12 20:35:17 +00:00

mesh-tools referenced this pull request

2026-11-12 20:50:09 +00:00

kernel: declare amd-ucode only (issue 1977, L10) #673

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#672