linux-kernel - Re: [PATCH v4] scripts/x86/intel: Add a script to update the old microcode list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <98b13199-f427-4054-8f37-15b2219c1fa3@citrix.com>
Date: Fri, 30 Jan 2026 22:00:38 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: Sohil Mehta <sohil.mehta@...el.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>, Borislav Petkov <bp@...en8.de>,
 x86@...nel.org
Cc: Andrew Cooper <andrew.cooper3@...rix.com>,
 Thomas Gleixner <tglx@...nel.org>, Ingo Molnar <mingo@...hat.com>,
 "H . Peter Anvin" <hpa@...or.com>, Peter Zijlstra <peterz@...radead.org>,
 Josh Poimboeuf <jpoimboe@...nel.org>,
 Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
 Dave Hansen <dave.hansen@...el.com>, Nikolay Borisov <nik.borisov@...e.com>,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] scripts/x86/intel: Add a script to update the old
 microcode list

On 30/01/2026 7:47 pm, Sohil Mehta wrote:
> diff --git a/scripts/update-intel-ucode-defs.py b/scripts/update-intel-ucode-defs.py
> new file mode 100755
> index 000000000000..50ec47cea1c5
> --- /dev/null
> +++ b/scripts/update-intel-ucode-defs.py
> @@ -0,0 +1,128 @@
> +#!/usr/bin/python3
> +# SPDX-License-Identifier: GPL-2.0
> +import argparse
> +import re
> +import shutil
> +import subprocess
> +import sys
> +import os
> +
> +script = os.path.relpath(__file__)
> +
> +DESCRIPTION = f"""
> +For Intel CPUs, update the microcode revisions that determine
> +X86_BUG_OLD_MICROCODE.
> +
> +This script is intended to be run in response to releases of the
> +official Intel microcode GitHub repository:
> +https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files.git
> +
> +It takes the Intel microcode files as input and uses iucode-tool to
> +extract the revision information. It prints the output in the format
> +expected by intel-ucode-defs.h.
> +
> +Usage:
> +    ./{script} /path/to/microcode/files > /path/to/intel-ucode-defs.h
> +
> +Typically, someone at Intel would see a new public release, wait for at
> +least three months to ensure the update is stable, run this script to
> +refresh the intel-ucode-defs.h file, and send a patch upstream to update
> +the mainline and stable versions.
> +
> +As always, there can be exceptions to the above process which should be
> +supported by appropriate justification.
> +"""
> +
> +parser = argparse.ArgumentParser(description=DESCRIPTION,
> +                                 formatter_class=argparse.RawDescriptionHelpFormatter)
> +parser.add_argument('ucode_files', nargs='+', help='Path(s) to the microcode files')
> +
> +args = parser.parse_args()
> +
> +# Process the microcode files using iucode-tool
> +if shutil.which("iucode-tool") is None:
> +    print("Error: iucode-tool not found, please install it", file=sys.stderr)
> +    sys.exit(1)
> +
> +cmd = ['iucode-tool', '--list-all' ]
> +cmd.extend(args.ucode_files)
> +
> +process = subprocess.Popen(cmd, stdout=subprocess.PIPE, universal_newlines=True)
> +process.wait()
> +if process.returncode != 0:
> +    print("Error: iucode-tool ran into an error, exiting", file=sys.stderr)
> +    sys.exit(1)
> +
> +# Functions to extract family, model, and stepping
> +def bits(val, bottom, top):
> +    mask = (1 << (top + 1 - bottom)) - 1
> +    mask = mask << bottom
> +    return (val & mask) >> bottom

return (val >> bottom) & mask


> +
> +def family(sig):
> +    if bits(sig, 8, 11) == 0xf:
> +        return bits(sig, 8, 11) + bits(sig, 20, 27)
> +    return bits(sig, 8, 11)
> +
> +def model(sig):
> +    return bits(sig, 4, 7)  | (bits(sig, 16, 19) << 4)
> +
> +def step(sig):
> +    return bits(sig, 0, 3)
> +
> +# Parse the output of iucode-tool
> +ucode_list = []
> +for line in process.stdout:
> +    if line.find(" sig ") == -1:
> +        continue
> +    sig = re.search('sig (0x[0-9a-fA-F]+)', line).group(1)
> +    rev = re.search('rev (0x[0-9a-fA-F]+)', line).group(1)
> +    pfm = re.search('pf_mask (0x[0-9a-fA-F]+)', line).group(1)
> +    sig = int(sig, 16)
> +    rev = int(rev, 16)
> +    pfm = int(pfm, 16)
> +    debug_rev = bits(rev, 31, 31)
> +    if debug_rev != 0:
> +        print("Error: Debug ucode file found, exiting", file=sys.stderr)
> +        sys.exit(1)
> +
> +    ucrev = {}
> +    ucrev['sig']       = sig
> +    ucrev['platforms'] = pfm
> +    ucrev['rev']       = rev
> +    ucode_list.append(ucrev)
> +
> +# Remove duplicates, if any
> +ucode_dict = {}
> +for rev in ucode_list:
> +    ucode_key = (rev['sig'], rev['platforms'])
> +    existing = ucode_dict.get(ucode_key)
> +    if existing is not None:
> +        # If the existing one is newer, just move on:
> +        if existing['rev'] > rev['rev']:
> +            continue
> +    ucode_dict[ucode_key] = rev
> +
> +# Prepare the microcode entries
> +ucode_entries = []
> +for ucode_key in ucode_dict:
> +    rev = ucode_dict[ucode_key]
> +    sig = rev['sig']
> +    ucode_entries.append({
> +        'family': family(sig),
> +        'model': model(sig),
> +        'steppings': 1 << step(sig),
> +        'platforms': rev['platforms'],
> +        'rev': rev['rev'],
> +        'sig': sig
> +    })

This is crying out for a small class, and for the use of set()

Try the attached version, which is rather more pythonic.

~Andrew
View attachment "update-intel-ucode-defs.py" of type "text/x-python" (3703 bytes)