sys-firmware/intel-microcode: Add "minimal" USE flag

Due to previous change (commit eb9036f6f998c91c6bc021f73bc10ca1b5240ae7),
this package can become very large (or the resulting initramfs).

While the already introduced environment variable "MICROCODE_SIGNATURES" is
allowing you to set iucode_tool's "--scan-system" parameter to only
install ucode(s) supported by the currently available (=online) processor(s),
this doesn't work for binary package user(s).

The now added "minimal" USE flag (enabled by default) will set "--scan-system"
parameter for you. This will still allow you to select/blacklist ucode(s)
for all your hosts on your central build host using the "MICROCODE_SIGNATURES"
variable like before while giving each host the opportunity to only install
really supported ucode(s) which will reduces the file size of the resulting
initramfs.

Bug: https://bugs.gentoo.org/654638
Package-Manager: Portage-2.3.40, Repoman-2.3.9

2 files changed, 55 insertions, 4 deletions

diff --git a/sys-firmware/intel-microcode/intel-microcode-20180426-r1.ebuild b/sys-firmware/intel-microcode/intel-microcode-20180426-r2.ebuild
index 29a6958681db..b39f2be9bd87 100644
--- a/sys-firmware/intel-microcode/intel-microcode-20180426-r1.ebuild
+++ b/sys-firmware/intel-microcode/intel-microcode-20180426-r2.ebuild
@@ -19,11 +19,14 @@ SRC_URI="https://downloadmirror.intel.com/${NUM}/eng/microcode-${INTEL_SNAPSHOT}
 LICENSE="intel-ucode"
 SLOT="0"
 KEYWORDS=""
-IUSE="initramfs +split-ucode vanilla"
+IUSE="initramfs +minimal +split-ucode vanilla"
 REQUIRED_USE="|| ( initramfs split-ucode )"
 
 DEPEND="sys-apps/iucode_tool"
-RDEPEND="!<sys-apps/microcode-ctl-1.17-r2" #268586
+
+# !<sys-apps/microcode-ctl-1.17-r2 due to bug #268586
+RDEPEND="!<sys-apps/microcode-ctl-1.17-r2
+	minimal? ( sys-apps/iucode_tool )"
 
 S=${WORKDIR}
 
@@ -96,8 +99,9 @@ src_install() {
 	# The earlyfw cpio needs to be in /boot because it must be loaded before
 	# rootfs is mounted.
 	use initramfs && dodir /boot && opts+=( --write-earlyfw="${ED%/}"/boot/intel-uc.img )
-	# split location:
-	use split-ucode && dodir /lib/firmware/intel-ucode && opts+=( --write-firmware="${ED%/}"/lib/firmware/intel-ucode )
+	# split location (we use a temporary location so that we are able
+	# to re-run iucode_tool in pkg_preinst):
+	dodir /tmp/intel-ucode && opts+=( --write-firmware="${ED%/}"/tmp/intel-ucode )
 
 	iucode_tool \
 		"${opts[@]}" \
@@ -109,6 +113,45 @@ src_install() {
 
 pkg_preinst() {
 	use initramfs && mount-boot_pkg_preinst
+
+	if use minimal; then
+		einfo "Removing ucode(s) not supported by any currently available (=online) processor(s) due to USE=minimal ..."
+		opts=(
+			--scan-system
+			# be strict about what we are doing
+			--overwrite
+			--strict-checks
+			--no-ignore-broken
+			# we want to install latest version
+			--no-downgrade
+			# show everything we find
+			--list-all
+			# show what we selected
+			--list
+		)
+
+		# The earlyfw cpio needs to be in /boot because it must be loaded before
+		# rootfs is mounted.
+		use initramfs && opts+=( --write-earlyfw="${ED%/}"/boot/intel-uc.img )
+		# split location:
+		use split-ucode && dodir /lib/firmware/intel-ucode && opts+=( --write-firmware="${ED%/}"/lib/firmware/intel-ucode )
+
+		iucode_tool \
+			"${opts[@]}" \
+			"${ED%/}"/tmp/intel-ucode \
+			|| die "iucode_tool ${opts[@]} ${ED%/}/tmp/intel-ucode"
+
+	else
+		if use split-ucode; then
+			# Temporary /tmp/intel-ucode will become final /lib/firmware/intel-ucode ...
+			dodir /lib/firmware/intel-ucode
+			mv "${ED%/}"/tmp/intel-ucode "${ED%/}"/lib/firmware/intel-ucode || die "Failed to install splitted ucodes!"
+		fi
+	fi
+
+	# Cleanup any temporary leftovers so that we don't merge any
+	# unneeded files on disk
+	rm -r "${ED%/}"/tmp || die "Failed to cleanup '"${ED%/}"/tmp'"
 }
 
 pkg_prerm() {
@@ -122,6 +165,13 @@ pkg_postrm() {
 pkg_postinst() {
 	use initramfs && mount-boot_pkg_postinst
 
+	if use minimal; then
+		elog "You only installed ucodes for all currently available (=online)"
+		elog "processor(s). Remember to re-emerge this package whenever you"
+		elog "change the system's processor model."
+		elog ""
+	fi
+
 	# We cannot give detailed information if user is affected or not:
 	# If MICROCODE_BLACKLIST wasn't modified, user can still use MICROCODE_SIGNATURES
 	# to to force a specific, otherwise blacklisted, microcode. So we
diff --git a/sys-firmware/intel-microcode/metadata.xml b/sys-firmware/intel-microcode/metadata.xml
index 2d96b231657b..593b3a921234 100644
--- a/sys-firmware/intel-microcode/metadata.xml
+++ b/sys-firmware/intel-microcode/metadata.xml
@@ -7,6 +7,7 @@
 </maintainer>
 <use>
 	<flag name="initramfs">install a small initramfs for use with CONFIG_MICROCODE_EARLY</flag>
+	<flag name="minimal">only install ucode(s) supported by currently available (=online) processor(s)</flag>
 	<flag name="monolithic">install the large text microcode.dat (used by older kernels via microcode_ctl)</flag>
 	<flag name="split-ucode">install the split binary ucode files (used by the kernel directly)</flag>
 	<flag name="vanilla">install only microcode updates from Intel's official microcode tarball</flag>