microcode: Install Debian microcode packages and add ucode=scan

We are no longer using the frozen-in-amber microcode from 2015.  Now
we use current microcode from Debian (or hopefully in future via other
distros).

Empirically this fixes the XSA-308 test on rimava1, which was failing
and producing very strange symptoms.

We think this will help unblock pushes from xen.git#staging.

Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com> (for both)

diff --git a/ts-host-install b/ts-host-install
index 4bfa2f5e0ba6ca720928edbe31add43939cfa8aa..7a72a8670a01bcd485d0d305ffe453c0a1f58603 100755 (executable)
--- a/ts-host-install
+++ b/ts-host-install
@@ -139,6 +139,12 @@ END
     target_cmd_root($ho, "chmod 2775 /root");
 
     target_install_packages($ho, qw(ed));
+    if ($ho->{Arch} =~ m/^(?:i386|amd64)$/) {
+       # We don't necessarily know the CPU vendor, but the Debian
+       # packaged microcode doesn't mind us installing both.
+       target_install_packages_nonfree_nonconcurrent($ho,
+            qw(amd64-microcode intel-microcode));
+    }
 
     my $ntpserver = get_target_property($ho, 'NtpServer');
     if ($ntpserver) {

diff --git a/ts-xen-install b/ts-xen-install
index 9113f3180dab3efdafe280d31b9a92a6570d289b..08b4ea23977fa239a663856a4425317f9a429f60 100755 (executable)
--- a/ts-xen-install
+++ b/ts-xen-install
@@ -209,6 +209,8 @@ sub setupboot () {
         my $mem = $r{'dom0_mem'} // 512;
         $xenhopt .= " dom0_mem=${mem}M,max:${mem}M";
     }
+    $xenhopt .= " ucode=scan";
+
     my $append= $r{xen_boot_append};
     $xenhopt .= " $append" if defined $append;
     $append = get_host_property($ho, 'xen-commandline-append', undef);