projects/linux·blob master · refs

1042 lines · 26.7 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Intel CPU Microcode Update Driver for Linux
4 *
5 * Copyright (C) 2000-2006 Tigran Aivazian <[email protected]>
6 * 2006 Shaohua Li <[email protected]>
7 *
8 * Intel CPU microcode early update for Linux
9 *
10 * Copyright (C) 2012 Fenghua Yu <[email protected]>
11 * H Peter Anvin" <[email protected]>
12 */
13#define pr_fmt(fmt) "microcode: " fmt
14#include <linux/earlycpio.h>
15#include <linux/firmware.h>
16#include <linux/pci_ids.h>
17#include <linux/uaccess.h>
18#include <linux/initrd.h>
19#include <linux/kernel.h>
20#include <linux/delay.h>
21#include <linux/slab.h>
22#include <linux/cpu.h>
23#include <linux/uio.h>
24#include <linux/io.h>
25#include <linux/mm.h>
26
27#include <asm/cpu_device_id.h>
28#include <asm/cpuid/api.h>
29#include <asm/processor.h>
30#include <asm/tlbflush.h>
31#include <asm/setup.h>
32#include <asm/msr.h>
33
34#include "internal.h"
35
36static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin";
37
38#define UCODE_BSP_LOADED ((struct microcode_intel *)0x1UL)
39
40/* Defines for the microcode staging mailbox interface */
41#define MBOX_REG_NUM 4
42#define MBOX_REG_SIZE sizeof(u32)
43
44#define MBOX_CONTROL_OFFSET 0x0
45#define MBOX_STATUS_OFFSET 0x4
46#define MBOX_WRDATA_OFFSET 0x8
47#define MBOX_RDDATA_OFFSET 0xc
48
49#define MASK_MBOX_CTRL_ABORT BIT(0)
50#define MASK_MBOX_CTRL_GO BIT(31)
51
52#define MASK_MBOX_STATUS_ERROR BIT(2)
53#define MASK_MBOX_STATUS_READY BIT(31)
54
55#define MASK_MBOX_RESP_SUCCESS BIT(0)
56#define MASK_MBOX_RESP_PROGRESS BIT(1)
57#define MASK_MBOX_RESP_ERROR BIT(2)
58
59#define MBOX_CMD_LOAD 0x3
60#define MBOX_OBJ_STAGING 0xb
61#define MBOX_HEADER(size) ((PCI_VENDOR_ID_INTEL) | \
62 (MBOX_OBJ_STAGING << 16) | \
63 ((u64)((size) / sizeof(u32)) << 32))
64
65/* The size of each mailbox header */
66#define MBOX_HEADER_SIZE sizeof(u64)
67/* The size of staging hardware response */
68#define MBOX_RESPONSE_SIZE sizeof(u64)
69
70#define MBOX_XACTION_TIMEOUT_MS (10 * MSEC_PER_SEC)
71
72/* Current microcode patch used in early patching on the APs. */
73static struct microcode_intel *ucode_patch_va __read_mostly;
74static struct microcode_intel *ucode_patch_late __read_mostly;
75
76/* last level cache size per core */
77static unsigned int llc_size_per_core __ro_after_init;
78
79/* microcode format is extended from prescott processors */
80struct extended_signature {
81 unsigned int sig;
82 unsigned int pf;
83 unsigned int cksum;
84};
85
86struct extended_sigtable {
87 unsigned int count;
88 unsigned int cksum;
89 unsigned int reserved[3];
90 struct extended_signature sigs[];
91};
92
93/**
94 * struct staging_state - Track the current staging process state
95 *
96 * @mmio_base: MMIO base address for staging
97 * @ucode_len: Total size of the microcode image
98 * @chunk_size: Size of each data piece
99 * @bytes_sent: Total bytes transmitted so far
100 * @offset: Current offset in the microcode image
101 */
102struct staging_state {
103 void __iomem *mmio_base;
104 unsigned int ucode_len;
105 unsigned int chunk_size;
106 unsigned int bytes_sent;
107 unsigned int offset;
108};
109
110#define DEFAULT_UCODE_TOTALSIZE (DEFAULT_UCODE_DATASIZE + MC_HEADER_SIZE)
111#define EXT_HEADER_SIZE (sizeof(struct extended_sigtable))
112#define EXT_SIGNATURE_SIZE (sizeof(struct extended_signature))
113
114static inline unsigned int get_totalsize(struct microcode_header_intel *hdr)
115{
116 return hdr->datasize ? hdr->totalsize : DEFAULT_UCODE_TOTALSIZE;
117}
118
119static inline unsigned int exttable_size(struct extended_sigtable *et)
120{
121 return et->count * EXT_SIGNATURE_SIZE + EXT_HEADER_SIZE;
122}
123
124void intel_collect_cpu_info(struct cpu_signature *sig)
125{
126 sig->sig = cpuid_eax(1);
127 sig->rev = intel_get_microcode_revision();
128 sig->pf = 1 << intel_get_platform_id();
129}
130EXPORT_SYMBOL_GPL(intel_collect_cpu_info);
131
132static inline bool cpu_signatures_match(struct cpu_signature *s1, unsigned int sig2,
133 unsigned int pf2)
134{
135 if (s1->sig != sig2)
136 return false;
137
138 /*
139 * Consider an empty mask to match everything. This
140 * should only occur for one CPU model, the PII.
141 */
142 if (!pf2)
143 return true;
144
145 /* Is the CPU's platform ID in the signature mask? */
146 return s1->pf & pf2;
147}
148
149bool intel_find_matching_signature(void *mc, struct cpu_signature *sig)
150{
151 struct microcode_header_intel *mc_hdr = mc;
152 struct extended_signature *ext_sig;
153 struct extended_sigtable *ext_hdr;
154 int i;
155
156 if (cpu_signatures_match(sig, mc_hdr->sig, mc_hdr->pf))
157 return true;
158
159 /* Look for ext. headers: */
160 if (get_totalsize(mc_hdr) <= intel_microcode_get_datasize(mc_hdr) + MC_HEADER_SIZE)
161 return false;
162
163 ext_hdr = mc + intel_microcode_get_datasize(mc_hdr) + MC_HEADER_SIZE;
164 ext_sig = (void *)ext_hdr + EXT_HEADER_SIZE;
165
166 for (i = 0; i < ext_hdr->count; i++) {
167 if (cpu_signatures_match(sig, ext_sig->sig, ext_sig->pf))
168 return true;
169 ext_sig++;
170 }
171 return 0;
172}
173EXPORT_SYMBOL_GPL(intel_find_matching_signature);
174
175/**
176 * intel_microcode_sanity_check() - Sanity check microcode file.
177 * @mc: Pointer to the microcode file contents.
178 * @print_err: Display failure reason if true, silent if false.
179 * @hdr_type: Type of file, i.e. normal microcode file or In Field Scan file.
180 * Validate if the microcode header type matches with the type
181 * specified here.
182 *
183 * Validate certain header fields and verify if computed checksum matches
184 * with the one specified in the header.
185 *
186 * Return: 0 if the file passes all the checks, -EINVAL if any of the checks
187 * fail.
188 */
189int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type)
190{
191 unsigned long total_size, data_size, ext_table_size;
192 struct microcode_header_intel *mc_header = mc;
193 struct extended_sigtable *ext_header = NULL;
194 u32 sum, orig_sum, ext_sigcount = 0, i;
195 struct extended_signature *ext_sig;
196
197 total_size = get_totalsize(mc_header);
198 data_size = intel_microcode_get_datasize(mc_header);
199
200 if (data_size + MC_HEADER_SIZE > total_size) {
201 if (print_err)
202 pr_err("Error: bad microcode data file size.\n");
203 return -EINVAL;
204 }
205
206 if (mc_header->ldrver != 1 || mc_header->hdrver != hdr_type) {
207 if (print_err)
208 pr_err("Error: invalid/unknown microcode update format. Header type %d\n",
209 mc_header->hdrver);
210 return -EINVAL;
211 }
212
213 ext_table_size = total_size - (MC_HEADER_SIZE + data_size);
214 if (ext_table_size) {
215 u32 ext_table_sum = 0;
216 u32 *ext_tablep;
217
218 if (ext_table_size < EXT_HEADER_SIZE ||
219 ((ext_table_size - EXT_HEADER_SIZE) % EXT_SIGNATURE_SIZE)) {
220 if (print_err)
221 pr_err("Error: truncated extended signature table.\n");
222 return -EINVAL;
223 }
224
225 ext_header = mc + MC_HEADER_SIZE + data_size;
226 if (ext_table_size != exttable_size(ext_header)) {
227 if (print_err)
228 pr_err("Error: extended signature table size mismatch.\n");
229 return -EFAULT;
230 }
231
232 ext_sigcount = ext_header->count;
233
234 /*
235 * Check extended table checksum: the sum of all dwords that
236 * comprise a valid table must be 0.
237 */
238 ext_tablep = (u32 *)ext_header;
239
240 i = ext_table_size / sizeof(u32);
241 while (i--)
242 ext_table_sum += ext_tablep[i];
243
244 if (ext_table_sum) {
245 if (print_err)
246 pr_warn("Bad extended signature table checksum, aborting.\n");
247 return -EINVAL;
248 }
249 }
250
251 /*
252 * Calculate the checksum of update data and header. The checksum of
253 * valid update data and header including the extended signature table
254 * must be 0.
255 */
256 orig_sum = 0;
257 i = (MC_HEADER_SIZE + data_size) / sizeof(u32);
258 while (i--)
259 orig_sum += ((u32 *)mc)[i];
260
261 if (orig_sum) {
262 if (print_err)
263 pr_err("Bad microcode data checksum, aborting.\n");
264 return -EINVAL;
265 }
266
267 if (!ext_table_size)
268 return 0;
269
270 /*
271 * Check extended signature checksum: 0 => valid.
272 */
273 for (i = 0; i < ext_sigcount; i++) {
274 ext_sig = (void *)ext_header + EXT_HEADER_SIZE +
275 EXT_SIGNATURE_SIZE * i;
276
277 sum = (mc_header->sig + mc_header->pf + mc_header->cksum) -
278 (ext_sig->sig + ext_sig->pf + ext_sig->cksum);
279 if (sum) {
280 if (print_err)
281 pr_err("Bad extended signature checksum, aborting.\n");
282 return -EINVAL;
283 }
284 }
285 return 0;
286}
287EXPORT_SYMBOL_GPL(intel_microcode_sanity_check);
288
289static void update_ucode_pointer(struct microcode_intel *mc)
290{
291 kvfree(ucode_patch_va);
292
293 /*
294 * Save the virtual address for early loading and for eventual free
295 * on late loading.
296 */
297 ucode_patch_va = mc;
298}
299
300static void save_microcode_patch(struct microcode_intel *patch)
301{
302 unsigned int size = get_totalsize(&patch->hdr);
303 struct microcode_intel *mc;
304
305 mc = kvmemdup(patch, size, GFP_KERNEL);
306 if (mc)
307 update_ucode_pointer(mc);
308 else
309 pr_err("Unable to allocate microcode memory size: %u\n", size);
310}
311
312static bool revision_is_safe(struct cpu_signature *sig, u32 rev)
313{
314 u32 vfm = IFM(x86_family(sig->sig), x86_model(sig->sig));
315
316 /*
317 * Erratum GNR98 can cause #MCs if "jumping over" revision 0x1000405.
318 * Avoid the jumps.
319 */
320 if (vfm == INTEL_GRANITERAPIDS_X &&
321 x86_stepping(sig->sig) == 1 &&
322 sig->pf & 0x95 &&
323 sig->rev < 0x1000405 &&
324 rev > 0x1000405) {
325 pr_err_once("Erratum GNR98: skipping revision 0x%x.\n", rev);
326 return false;
327 }
328
329 return true;
330}
331
332/* Scan blob for microcode matching the boot CPUs family, model, stepping */
333static __init struct microcode_intel *scan_microcode(void *data, size_t size,
334 struct ucode_cpu_info *uci,
335 bool save)
336{
337 struct microcode_header_intel *mc_header;
338 struct microcode_intel *patch = NULL;
339 u32 cur_rev = uci->cpu_sig.rev;
340 unsigned int mc_size;
341
342 for (; size >= sizeof(struct microcode_header_intel); size -= mc_size, data += mc_size) {
343 mc_header = (struct microcode_header_intel *)data;
344
345 mc_size = get_totalsize(mc_header);
346 if (!mc_size || mc_size > size ||
347 intel_microcode_sanity_check(data, false, MC_HEADER_TYPE_MICROCODE) < 0)
348 break;
349
350 if (!intel_find_matching_signature(data, &uci->cpu_sig))
351 continue;
352
353 if (!revision_is_safe(&uci->cpu_sig, mc_header->rev))
354 continue;
355
356 /*
357 * For saving the early microcode, find the matching revision which
358 * was loaded on the BSP.
359 *
360 * On the BSP during early boot, find a newer revision than
361 * actually loaded in the CPU.
362 */
363 if (save) {
364 if (cur_rev != mc_header->rev)
365 continue;
366 } else if (cur_rev >= mc_header->rev) {
367 continue;
368 }
369
370 patch = data;
371 cur_rev = mc_header->rev;
372 }
373
374 return size ? NULL : patch;
375}
376
377static inline u32 read_mbox_dword(void __iomem *mmio_base)
378{
379 u32 dword = readl(mmio_base + MBOX_RDDATA_OFFSET);
380
381 /* Acknowledge read completion to the staging hardware */
382 writel(0, mmio_base + MBOX_RDDATA_OFFSET);
383 return dword;
384}
385
386static inline void write_mbox_dword(void __iomem *mmio_base, u32 dword)
387{
388 writel(dword, mmio_base + MBOX_WRDATA_OFFSET);
389}
390
391static inline u64 read_mbox_header(void __iomem *mmio_base)
392{
393 u32 high, low;
394
395 low = read_mbox_dword(mmio_base);
396 high = read_mbox_dword(mmio_base);
397
398 return ((u64)high << 32) | low;
399}
400
401static inline void write_mbox_header(void __iomem *mmio_base, u64 value)
402{
403 write_mbox_dword(mmio_base, value);
404 write_mbox_dword(mmio_base, value >> 32);
405}
406
407static void write_mbox_data(void __iomem *mmio_base, u32 *chunk, unsigned int chunk_bytes)
408{
409 int i;
410
411 /*
412 * The MMIO space is mapped as Uncached (UC). Each write arrives
413 * at the device as an individual transaction in program order.
414 * The device can then reassemble the sequence accordingly.
415 */
416 for (i = 0; i < chunk_bytes / sizeof(u32); i++)
417 write_mbox_dword(mmio_base, chunk[i]);
418}
419
420/*
421 * Prepare for a new microcode transfer: reset hardware and record the
422 * image size.
423 */
424static void init_stage(struct staging_state *ss)
425{
426 ss->ucode_len = get_totalsize(&ucode_patch_late->hdr);
427
428 /*
429 * Abort any ongoing process, effectively resetting the device.
430 * Unlike regular mailbox data processing requests, this
431 * operation does not require a status check.
432 */
433 writel(MASK_MBOX_CTRL_ABORT, ss->mmio_base + MBOX_CONTROL_OFFSET);
434}
435
436/*
437 * Update the chunk size and decide whether another chunk can be sent.
438 * This accounts for remaining data and retry limits.
439 */
440static bool can_send_next_chunk(struct staging_state *ss, int *err)
441{
442 /* A page size or remaining bytes if this is the final chunk */
443 ss->chunk_size = min(PAGE_SIZE, ss->ucode_len - ss->offset);
444
445 /*
446 * Each microcode image is divided into chunks, each at most
447 * one page size. A 10-chunk image would typically require 10
448 * transactions.
449 *
450 * However, the hardware managing the mailbox has limited
451 * resources and may not cache the entire image, potentially
452 * requesting the same chunk multiple times.
453 *
454 * To tolerate this behavior, allow up to twice the expected
455 * number of transactions (i.e., a 10-chunk image can take up to
456 * 20 attempts).
457 *
458 * If the number of attempts exceeds this limit, treat it as
459 * exceeding the maximum allowed transfer size.
460 */
461 if (ss->bytes_sent + ss->chunk_size > ss->ucode_len * 2) {
462 *err = -EMSGSIZE;
463 return false;
464 }
465
466 *err = 0;
467 return true;
468}
469
470/*
471 * The hardware indicates completion by returning a sentinel end offset.
472 */
473static inline bool is_end_offset(u32 offset)
474{
475 return offset == UINT_MAX;
476}
477
478/*
479 * Determine whether staging is complete: either the hardware signaled
480 * the end offset, or no more transactions are permitted (retry limit
481 * reached).
482 */
483static inline bool staging_is_complete(struct staging_state *ss, int *err)
484{
485 return is_end_offset(ss->offset) || !can_send_next_chunk(ss, err);
486}
487
488/*
489 * Wait for the hardware to complete a transaction.
490 * Return 0 on success, or an error code on failure.
491 */
492static int wait_for_transaction(struct staging_state *ss)
493{
494 u32 timeout, status;
495
496 /* Allow time for hardware to complete the operation: */
497 for (timeout = 0; timeout < MBOX_XACTION_TIMEOUT_MS; timeout++) {
498 msleep(1);
499
500 status = readl(ss->mmio_base + MBOX_STATUS_OFFSET);
501 /* Break out early if the hardware is ready: */
502 if (status & MASK_MBOX_STATUS_READY)
503 break;
504 }
505
506 /* Check for explicit error response */
507 if (status & MASK_MBOX_STATUS_ERROR)
508 return -EIO;
509
510 /*
511 * Hardware has neither responded to the action nor signaled any
512 * error. Treat this as a timeout.
513 */
514 if (!(status & MASK_MBOX_STATUS_READY))
515 return -ETIMEDOUT;
516
517 return 0;
518}
519
520/*
521 * Transmit a chunk of the microcode image to the hardware.
522 * Return 0 on success, or an error code on failure.
523 */
524static int send_data_chunk(struct staging_state *ss, void *ucode_ptr)
525{
526 u32 *src_chunk = ucode_ptr + ss->offset;
527 u16 mbox_size;
528
529 /*
530 * Write a 'request' mailbox object in this order:
531 * 1. Mailbox header includes total size
532 * 2. Command header specifies the load operation
533 * 3. Data section contains a microcode chunk
534 *
535 * Thus, the mailbox size is two headers plus the chunk size.
536 */
537 mbox_size = MBOX_HEADER_SIZE * 2 + ss->chunk_size;
538 write_mbox_header(ss->mmio_base, MBOX_HEADER(mbox_size));
539 write_mbox_header(ss->mmio_base, MBOX_CMD_LOAD);
540 write_mbox_data(ss->mmio_base, src_chunk, ss->chunk_size);
541 ss->bytes_sent += ss->chunk_size;
542
543 /* Notify the hardware that the mailbox is ready for processing. */
544 writel(MASK_MBOX_CTRL_GO, ss->mmio_base + MBOX_CONTROL_OFFSET);
545
546 return wait_for_transaction(ss);
547}
548
549/*
550 * Retrieve the next offset from the hardware response.
551 * Return 0 on success, or an error code on failure.
552 */
553static int fetch_next_offset(struct staging_state *ss)
554{
555 const u64 expected_header = MBOX_HEADER(MBOX_HEADER_SIZE + MBOX_RESPONSE_SIZE);
556 u32 offset, status;
557 u64 header;
558
559 /*
560 * The 'response' mailbox returns three fields, in order:
561 * 1. Header
562 * 2. Next offset in the microcode image
563 * 3. Status flags
564 */
565 header = read_mbox_header(ss->mmio_base);
566 offset = read_mbox_dword(ss->mmio_base);
567 status = read_mbox_dword(ss->mmio_base);
568
569 /* All valid responses must start with the expected header. */
570 if (header != expected_header) {
571 pr_err_once("staging: invalid response header (0x%llx)\n", header);
572 return -EBADR;
573 }
574
575 /*
576 * Verify the offset: If not at the end marker, it must not
577 * exceed the microcode image length.
578 */
579 if (!is_end_offset(offset) && offset > ss->ucode_len) {
580 pr_err_once("staging: invalid offset (%u) past the image end (%u)\n",
581 offset, ss->ucode_len);
582 return -EINVAL;
583 }
584
585 /* Hardware may report errors explicitly in the status field */
586 if (status & MASK_MBOX_RESP_ERROR)
587 return -EPROTO;
588
589 ss->offset = offset;
590 return 0;
591}
592
593/*
594 * Handle the staging process using the mailbox MMIO interface. The
595 * microcode image is transferred in chunks until completion.
596 * Return 0 on success or an error code on failure.
597 */
598static int do_stage(u64 mmio_pa)
599{
600 struct staging_state ss = {};
601 int err;
602
603 ss.mmio_base = ioremap(mmio_pa, MBOX_REG_NUM * MBOX_REG_SIZE);
604 if (WARN_ON_ONCE(!ss.mmio_base))
605 return -EADDRNOTAVAIL;
606
607 init_stage(&ss);
608
609 /* Perform the staging process while within the retry limit */
610 while (!staging_is_complete(&ss, &err)) {
611 /* Send a chunk of microcode each time: */
612 err = send_data_chunk(&ss, ucode_patch_late);
613 if (err)
614 break;
615 /*
616 * Then, ask the hardware which piece of the image it
617 * needs next. The same piece may be sent more than once.
618 */
619 err = fetch_next_offset(&ss);
620 if (err)
621 break;
622 }
623
624 iounmap(ss.mmio_base);
625
626 return err;
627}
628
629static void stage_microcode(void)
630{
631 unsigned int pkg_id = UINT_MAX;
632 int cpu, err;
633 u64 mmio_pa;
634
635 if (!IS_ALIGNED(get_totalsize(&ucode_patch_late->hdr), sizeof(u32))) {
636 pr_err("Microcode image 32-bit misaligned (0x%x), staging failed.\n",
637 get_totalsize(&ucode_patch_late->hdr));
638 return;
639 }
640
641 lockdep_assert_cpus_held();
642
643 /*
644 * The MMIO address is unique per package, and all the SMT
645 * primary threads are online here. Find each MMIO space by
646 * their package IDs to avoid duplicate staging.
647 */
648 for_each_cpu(cpu, cpu_primary_thread_mask) {
649 if (topology_logical_package_id(cpu) == pkg_id)
650 continue;
651
652 pkg_id = topology_logical_package_id(cpu);
653
654 err = rdmsrq_on_cpu(cpu, MSR_IA32_MCU_STAGING_MBOX_ADDR, &mmio_pa);
655 if (WARN_ON_ONCE(err))
656 return;
657
658 err = do_stage(mmio_pa);
659 if (err) {
660 pr_err("Error: staging failed (%d) for CPU%d at package %u.\n",
661 err, cpu, pkg_id);
662 return;
663 }
664 }
665
666 pr_info("Staging of patch revision 0x%x succeeded.\n", ucode_patch_late->hdr.rev);
667}
668
669static enum ucode_state __apply_microcode(struct ucode_cpu_info *uci,
670 struct microcode_intel *mc,
671 u32 *cur_rev)
672{
673 u32 rev;
674
675 if (!mc)
676 return UCODE_NFOUND;
677
678 /*
679 * Save us the MSR write below - which is a particular expensive
680 * operation - when the other hyperthread has updated the microcode
681 * already.
682 */
683 *cur_rev = intel_get_microcode_revision();
684 if (*cur_rev >= mc->hdr.rev) {
685 uci->cpu_sig.rev = *cur_rev;
686 return UCODE_OK;
687 }
688
689 /* write microcode via MSR 0x79 */
690 native_wrmsrq(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits);
691
692 rev = intel_get_microcode_revision();
693 if (rev != mc->hdr.rev)
694 return UCODE_ERROR;
695
696 uci->cpu_sig.rev = rev;
697 return UCODE_UPDATED;
698}
699
700static enum ucode_state apply_microcode_early(struct ucode_cpu_info *uci)
701{
702 struct microcode_intel *mc = uci->mc;
703 u32 cur_rev;
704
705 return __apply_microcode(uci, mc, &cur_rev);
706}
707
708static __init bool load_builtin_intel_microcode(struct cpio_data *cp)
709{
710 unsigned int eax = 1, ebx, ecx = 0, edx;
711 struct firmware fw;
712 char name[30];
713
714 if (IS_ENABLED(CONFIG_X86_32))
715 return false;
716
717 native_cpuid(&eax, &ebx, &ecx, &edx);
718
719 sprintf(name, "intel-ucode/%02x-%02x-%02x",
720 x86_family(eax), x86_model(eax), x86_stepping(eax));
721
722 if (firmware_request_builtin(&fw, name)) {
723 cp->size = fw.size;
724 cp->data = (void *)fw.data;
725 return true;
726 }
727 return false;
728}
729
730static __init struct microcode_intel *get_microcode_blob(struct ucode_cpu_info *uci, bool save)
731{
732 struct cpio_data cp;
733
734 intel_collect_cpu_info(&uci->cpu_sig);
735
736 if (!load_builtin_intel_microcode(&cp))
737 cp = find_microcode_in_initrd(ucode_path);
738
739 if (!(cp.data && cp.size))
740 return NULL;
741
742 return scan_microcode(cp.data, cp.size, uci, save);
743}
744
745/*
746 * Invoked from an early init call to save the microcode blob which was
747 * selected during early boot when mm was not usable. The microcode must be
748 * saved because initrd is going away. It's an early init call so the APs
749 * just can use the pointer and do not have to scan initrd/builtin firmware
750 * again.
751 */
752static int __init save_builtin_microcode(void)
753{
754 struct ucode_cpu_info uci;
755
756 if (xchg(&ucode_patch_va, NULL) != UCODE_BSP_LOADED)
757 return 0;
758
759 if (microcode_loader_disabled() || boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
760 return 0;
761
762 uci.mc = get_microcode_blob(&uci, true);
763 if (uci.mc)
764 save_microcode_patch(uci.mc);
765 return 0;
766}
767early_initcall(save_builtin_microcode);
768
769/* Load microcode on BSP from initrd or builtin blobs */
770void __init load_ucode_intel_bsp(struct early_load_data *ed)
771{
772 struct ucode_cpu_info uci;
773
774 uci.mc = get_microcode_blob(&uci, false);
775 ed->old_rev = uci.cpu_sig.rev;
776
777 if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED) {
778 ucode_patch_va = UCODE_BSP_LOADED;
779 ed->new_rev = uci.cpu_sig.rev;
780 }
781}
782
783void load_ucode_intel_ap(void)
784{
785 struct ucode_cpu_info uci;
786
787 uci.mc = ucode_patch_va;
788 if (uci.mc)
789 apply_microcode_early(&uci);
790}
791
792/* Reload microcode on resume */
793void reload_ucode_intel(void)
794{
795 struct ucode_cpu_info uci = { .mc = ucode_patch_va, };
796
797 if (uci.mc)
798 apply_microcode_early(&uci);
799}
800
801static int collect_cpu_info(int cpu_num, struct cpu_signature *csig)
802{
803 intel_collect_cpu_info(csig);
804 return 0;
805}
806
807static enum ucode_state apply_microcode_late(int cpu)
808{
809 struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
810 struct microcode_intel *mc = ucode_patch_late;
811 enum ucode_state ret;
812 u32 cur_rev;
813
814 if (WARN_ON_ONCE(smp_processor_id() != cpu))
815 return UCODE_ERROR;
816
817 ret = __apply_microcode(uci, mc, &cur_rev);
818 if (ret != UCODE_UPDATED && ret != UCODE_OK)
819 return ret;
820
821 cpu_data(cpu).microcode = uci->cpu_sig.rev;
822 if (!cpu)
823 boot_cpu_data.microcode = uci->cpu_sig.rev;
824
825 return ret;
826}
827
828static bool ucode_validate_minrev(struct microcode_header_intel *mc_header)
829{
830 int cur_rev = boot_cpu_data.microcode;
831
832 /*
833 * When late-loading, ensure the header declares a minimum revision
834 * required to perform a late-load. The previously reserved field
835 * is 0 in older microcode blobs.
836 */
837 if (!mc_header->min_req_ver) {
838 pr_info("Unsafe microcode update: Microcode header does not specify a required min version\n");
839 return false;
840 }
841
842 /*
843 * Check whether the current revision is either greater or equal to
844 * to the minimum revision specified in the header.
845 */
846 if (cur_rev < mc_header->min_req_ver) {
847 pr_info("Unsafe microcode update: Current revision 0x%x too old\n", cur_rev);
848 pr_info("Current should be at 0x%x or higher. Use early loading instead\n", mc_header->min_req_ver);
849 return false;
850 }
851 return true;
852}
853
854static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter)
855{
856 struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
857 bool is_safe, new_is_safe = false;
858 int cur_rev = uci->cpu_sig.rev;
859 unsigned int curr_mc_size = 0;
860 u8 *new_mc = NULL, *mc = NULL;
861
862 while (iov_iter_count(iter)) {
863 struct microcode_header_intel mc_header;
864 unsigned int mc_size, data_size;
865 u8 *data;
866
867 if (!copy_from_iter_full(&mc_header, sizeof(mc_header), iter)) {
868 pr_err("error! Truncated or inaccessible header in microcode data file\n");
869 goto fail;
870 }
871
872 mc_size = get_totalsize(&mc_header);
873 if (mc_size < sizeof(mc_header)) {
874 pr_err("error! Bad data in microcode data file (totalsize too small)\n");
875 goto fail;
876 }
877 data_size = mc_size - sizeof(mc_header);
878 if (data_size > iov_iter_count(iter)) {
879 pr_err("error! Bad data in microcode data file (truncated file?)\n");
880 goto fail;
881 }
882
883 /* For performance reasons, reuse mc area when possible */
884 if (!mc || mc_size > curr_mc_size) {
885 kvfree(mc);
886 mc = kvmalloc(mc_size, GFP_KERNEL);
887 if (!mc)
888 goto fail;
889 curr_mc_size = mc_size;
890 }
891
892 memcpy(mc, &mc_header, sizeof(mc_header));
893 data = mc + sizeof(mc_header);
894 if (!copy_from_iter_full(data, data_size, iter) ||
895 intel_microcode_sanity_check(mc, true, MC_HEADER_TYPE_MICROCODE) < 0)
896 goto fail;
897
898 if (cur_rev >= mc_header.rev)
899 continue;
900
901 if (!intel_find_matching_signature(mc, &uci->cpu_sig))
902 continue;
903
904 if (!revision_is_safe(&uci->cpu_sig, mc_header.rev))
905 continue;
906
907 is_safe = ucode_validate_minrev(&mc_header);
908 if (force_minrev && !is_safe)
909 continue;
910
911 kvfree(new_mc);
912 cur_rev = mc_header.rev;
913 new_mc = mc;
914 new_is_safe = is_safe;
915 mc = NULL;
916 }
917
918 if (iov_iter_count(iter))
919 goto fail;
920
921 kvfree(mc);
922 if (!new_mc)
923 return UCODE_NFOUND;
924
925 ucode_patch_late = (struct microcode_intel *)new_mc;
926 return new_is_safe ? UCODE_NEW_SAFE : UCODE_NEW;
927
928fail:
929 kvfree(mc);
930 kvfree(new_mc);
931 return UCODE_ERROR;
932}
933
934static bool is_blacklisted(unsigned int cpu)
935{
936 struct cpuinfo_x86 *c = &cpu_data(cpu);
937
938 /*
939 * Late loading on model 79 with microcode revision less than 0x0b000021
940 * and LLC size per core bigger than 2.5MB may result in a system hang.
941 * This behavior is documented in item BDX90, #334165 (Intel Xeon
942 * Processor E7-8800/4800 v4 Product Family).
943 */
944 if (c->x86_vfm == INTEL_BROADWELL_X &&
945 c->x86_stepping == 0x01 &&
946 llc_size_per_core > 2621440 &&
947 c->microcode < 0x0b000021) {
948 pr_err_once("Erratum BDX90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
949 pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
950 return true;
951 }
952
953 return false;
954}
955
956static enum ucode_state request_microcode_fw(int cpu, struct device *device)
957{
958 struct cpuinfo_x86 *c = &cpu_data(cpu);
959 const struct firmware *firmware;
960 struct iov_iter iter;
961 enum ucode_state ret;
962 struct kvec kvec;
963 char name[30];
964
965 if (is_blacklisted(cpu))
966 return UCODE_NFOUND;
967
968 sprintf(name, "intel-ucode/%02x-%02x-%02x",
969 c->x86, c->x86_model, c->x86_stepping);
970
971 if (request_firmware_direct(&firmware, name, device)) {
972 pr_debug("data file %s load failed\n", name);
973 return UCODE_NFOUND;
974 }
975
976 kvec.iov_base = (void *)firmware->data;
977 kvec.iov_len = firmware->size;
978 iov_iter_kvec(&iter, ITER_SOURCE, &kvec, 1, firmware->size);
979 ret = parse_microcode_blobs(cpu, &iter);
980
981 release_firmware(firmware);
982
983 return ret;
984}
985
986static void finalize_late_load(int result)
987{
988 if (!result)
989 update_ucode_pointer(ucode_patch_late);
990 else
991 kvfree(ucode_patch_late);
992 ucode_patch_late = NULL;
993}
994
995static struct microcode_ops microcode_intel_ops = {
996 .request_microcode_fw = request_microcode_fw,
997 .collect_cpu_info = collect_cpu_info,
998 .apply_microcode = apply_microcode_late,
999 .finalize_late_load = finalize_late_load,
1000 .stage_microcode = stage_microcode,
1001 .use_nmi = IS_ENABLED(CONFIG_X86_64),
1002};
1003
1004static __init void calc_llc_size_per_core(struct cpuinfo_x86 *c)
1005{
1006 u64 llc_size = c->x86_cache_size * 1024ULL;
1007
1008 do_div(llc_size, topology_num_cores_per_package());
1009 llc_size_per_core = (unsigned int)llc_size;
1010}
1011
1012static __init bool staging_available(void)
1013{
1014 u64 val;
1015
1016 val = x86_read_arch_cap_msr();
1017 if (!(val & ARCH_CAP_MCU_ENUM))
1018 return false;
1019
1020 rdmsrq(MSR_IA32_MCU_ENUMERATION, val);
1021 return !!(val & MCU_STAGING);
1022}
1023
1024struct microcode_ops * __init init_intel_microcode(void)
1025{
1026 struct cpuinfo_x86 *c = &boot_cpu_data;
1027
1028 if (c->x86_vendor != X86_VENDOR_INTEL || c->x86 < 6 ||
1029 cpu_has(c, X86_FEATURE_IA64)) {
1030 pr_err("Intel CPU family 0x%x not supported\n", c->x86);
1031 return NULL;
1032 }
1033
1034 if (staging_available()) {
1035 microcode_intel_ops.use_staging = true;
1036 pr_info("Enabled staging feature.\n");
1037 }
1038
1039 calc_llc_size_per_core(c);
1040
1041 return &microcode_intel_ops;
1042}