[PATCH] scripts/x86/intel: keep the highest microcode revision

[PATCH] scripts/x86/intel: keep the highest microcode revision

[Hamdy Abou El Anein]

From: Hamdy Abou El Anein <hamdy.aea@protonmail.com>

Ucode equality ignores the revision, so adding entries to a set keeps
the first revision seen for a CPU identity and platform mask. When
multiple input files contain different revisions of the same microcode,
the generated old-microcode thresholds depend on their order.

For example, passing the 06-8f-08 blobs from microcode-20250512 before
microcode-20250812 keeps 0x2b000639 and 0x2c0003f7 instead of the newer
0x2b000643 and 0x2c000401. Reversing the inputs selects the newer values.

Keep entries in a dictionary keyed by the same CPU identity and platform
mask, and replace an entry when a higher revision is found. Preserve
the existing output ordering and debug-revision rejection.

Tested with iucode_tool 2.3.1 and both official Intel release blobs in
both orders and with repeated inputs. Nine regression tests also cover
equal revisions, distinct identities, malformed listings and tool errors.

AI assistance: ChatGPT/Codex identified the issue and prepared the
change, commit message and executable regression tests.

Fixes: 00e05495c572 ("scripts/x86/intel: Add a script to update the old microcode list")
Signed-off-by: Hamdy Abou El Anein <hamdy.aea@protonmail.com>
---
The real-file regression uses intel-ucode/06-8f-08 from the official
Intel microcode-20250512 and microcode-20250812 tags. It verifies that
combined input produces the same output as the newer release alone.

 scripts/update-intel-ucode-defs.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/update-intel-ucode-defs.py b/scripts/update-intel-ucode-defs.py
index 9d6cc2c60..60f5ae329 100755
--- a/scripts/update-intel-ucode-defs.py
+++ b/scripts/update-intel-ucode-defs.py
@@ -95,7 +95,7 @@ def main():
             print(result.stderr, file=sys.stderr, end='')
         sys.exit(1)
 
-    ucodes = set()
+    ucodes = {}
 
     # Parse the output of iucode-tool
     for line in result.stdout.splitlines():
@@ -114,7 +114,10 @@ def main():
             print("Error: Debug ucode file found, exiting", file=sys.stderr)
             sys.exit(1)
 
-        ucodes.add(Ucode(sig, pfm, rev))
+        ucode = Ucode(sig, pfm, rev)
+        existing = ucodes.get(ucode.key)
+        if existing is None or ucode.rev > existing.rev:
+            ucodes[ucode.key] = ucode
 
     if not ucodes:
         print("Error: No valid microcode files found, exiting", file=sys.stderr)
@@ -123,7 +126,7 @@ def main():
     # Sort and print the microcode entries
     print("/* SPDX-License-Identifier: GPL-2.0 */")
     print("/* Auto-generated by scripts/update-intel-ucode-defs.py */")
-    for u in sorted(ucodes, key=lambda x: x.key):
+    for u in sorted(ucodes.values(), key=lambda x: x.key):
         print(u)
 
 if __name__ == "__main__":

base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
-- 
2.56.0

Re: [PATCH] scripts/x86/intel: keep the highest microcode revision

[Sohil Mehta]

On 11/7/2026 11:13 AM, Hamdy Abou El Anein wrote:
> From: Hamdy Abou El Anein <hamdy.aea@protonmail.com>
> 
> Ucode equality ignores the revision, so adding entries to a set keeps
> the first revision seen for a CPU identity and platform mask. When
> multiple input files contain different revisions of the same microcode,
> the generated old-microcode thresholds depend on their order.
> 

This is by design. The current script assumes only a single release is
used for generating the output.

https://lore.kernel.org/all/5e3dc792-c5aa-4024-b2a3-32db49da8132@intel.com/

Do you have a need where multiple directories need to be combined?

Also, sometimes newer releases remove entries or roll them back (in
exceptional cases like microcode-20260812). So combining releases to get
the highest value isn't always desirable.


> For example, passing the 06-8f-08 blobs from microcode-20250512 before
> microcode-20250812 keeps 0x2b000639 and 0x2c0003f7 instead of the newer
> 0x2b000643 and 0x2c000401. Reversing the inputs selects the newer values.
> 

> Keep entries in a dictionary keyed by the same CPU identity and platform
> mask, and replace an entry when a higher revision is found. Preserve
> the existing output ordering and debug-revision rejection.
>