1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Intel CPU Microcode Update Driver for Linux 4 * 5 * Copyright (C) 2000-2006 Tigran Aivazian <aivazian.tigran@gmail.com> 6 * 2006 Shaohua Li <shaohua.li@intel.com> 7 * 8 * Intel CPU microcode early update for Linux 9 * 10 * Copyright (C) 2012 Fenghua Yu <fenghua.yu@intel.com> 11 * H Peter Anvin" <hpa@zytor.com> 12 */ 13 #define pr_fmt(fmt) "microcode: " fmt 14 #include <linux/earlycpio.h> 15 #include <linux/firmware.h> 16 #include <linux/pci_ids.h> 17 #include <linux/uaccess.h> 18 #include <linux/initrd.h> 19 #include <linux/kernel.h> 20 #include <linux/delay.h> 21 #include <linux/slab.h> 22 #include <linux/cpu.h> 23 #include <linux/uio.h> 24 #include <linux/io.h> 25 #include <linux/mm.h> 26 27 #include <asm/cpu_device_id.h> 28 #include <asm/cpuid/api.h> 29 #include <asm/processor.h> 30 #include <asm/tlbflush.h> 31 #include <asm/setup.h> 32 #include <asm/msr.h> 33 34 #include "internal.h" 35 36 static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin"; 37 38 #define UCODE_BSP_LOADED ((struct microcode_intel *)0x1UL) 39 40 /* Defines for the microcode staging mailbox interface */ 41 #define MBOX_REG_NUM 4 42 #define MBOX_REG_SIZE sizeof(u32) 43 44 #define MBOX_CONTROL_OFFSET 0x0 45 #define MBOX_STATUS_OFFSET 0x4 46 #define MBOX_WRDATA_OFFSET 0x8 47 #define MBOX_RDDATA_OFFSET 0xc 48 49 #define MASK_MBOX_CTRL_ABORT BIT(0) 50 #define MASK_MBOX_CTRL_GO BIT(31) 51 52 #define MASK_MBOX_STATUS_ERROR BIT(2) 53 #define MASK_MBOX_STATUS_READY BIT(31) 54 55 #define MASK_MBOX_RESP_SUCCESS BIT(0) 56 #define MASK_MBOX_RESP_PROGRESS BIT(1) 57 #define MASK_MBOX_RESP_ERROR BIT(2) 58 59 #define MBOX_CMD_LOAD 0x3 60 #define MBOX_OBJ_STAGING 0xb 61 #define MBOX_HEADER(size) ((PCI_VENDOR_ID_INTEL) | \ 62 (MBOX_OBJ_STAGING << 16) | \ 63 ((u64)((size) / sizeof(u32)) << 32)) 64 65 /* The size of each mailbox header */ 66 #define MBOX_HEADER_SIZE sizeof(u64) 67 /* The size of staging hardware response */ 68 #define MBOX_RESPONSE_SIZE sizeof(u64) 69 70 #define MBOX_XACTION_TIMEOUT_MS (10 * MSEC_PER_SEC) 71 72 /* Current microcode patch used in early patching on the APs. */ 73 static struct microcode_intel *ucode_patch_va __read_mostly; 74 static struct microcode_intel *ucode_patch_late __read_mostly; 75 76 /* last level cache size per core */ 77 static unsigned int llc_size_per_core __ro_after_init; 78 79 /* microcode format is extended from prescott processors */ 80 struct extended_signature { 81 unsigned int sig; 82 unsigned int pf; 83 unsigned int cksum; 84 }; 85 86 struct extended_sigtable { 87 unsigned int count; 88 unsigned int cksum; 89 unsigned int reserved[3]; 90 struct extended_signature sigs[]; 91 }; 92 93 /** 94 * struct staging_state - Track the current staging process state 95 * 96 * @mmio_base: MMIO base address for staging 97 * @ucode_len: Total size of the microcode image 98 * @chunk_size: Size of each data piece 99 * @bytes_sent: Total bytes transmitted so far 100 * @offset: Current offset in the microcode image 101 */ 102 struct staging_state { 103 void __iomem *mmio_base; 104 unsigned int ucode_len; 105 unsigned int chunk_size; 106 unsigned int bytes_sent; 107 unsigned int offset; 108 }; 109 110 #define DEFAULT_UCODE_TOTALSIZE (DEFAULT_UCODE_DATASIZE + MC_HEADER_SIZE) 111 #define EXT_HEADER_SIZE (sizeof(struct extended_sigtable)) 112 #define EXT_SIGNATURE_SIZE (sizeof(struct extended_signature)) 113 114 static inline unsigned int get_totalsize(struct microcode_header_intel *hdr) 115 { 116 return hdr->datasize ? hdr->totalsize : DEFAULT_UCODE_TOTALSIZE; 117 } 118 119 static inline unsigned int exttable_size(struct extended_sigtable *et) 120 { 121 return et->count * EXT_SIGNATURE_SIZE + EXT_HEADER_SIZE; 122 } 123 124 void intel_collect_cpu_info(struct cpu_signature *sig) 125 { 126 sig->sig = cpuid_eax(1); 127 sig->rev = intel_get_microcode_revision(); 128 sig->pf = 1 << intel_get_platform_id(); 129 } 130 EXPORT_SYMBOL_GPL(intel_collect_cpu_info); 131 132 static inline bool cpu_signatures_match(struct cpu_signature *s1, unsigned int sig2, 133 unsigned int pf2) 134 { 135 if (s1->sig != sig2) 136 return false; 137 138 /* 139 * Consider an empty mask to match everything. This 140 * should only occur for one CPU model, the PII. 141 */ 142 if (!pf2) 143 return true; 144 145 /* Is the CPU's platform ID in the signature mask? */ 146 return s1->pf & pf2; 147 } 148 149 bool intel_find_matching_signature(void *mc, struct cpu_signature *sig) 150 { 151 struct microcode_header_intel *mc_hdr = mc; 152 struct extended_signature *ext_sig; 153 struct extended_sigtable *ext_hdr; 154 int i; 155 156 if (cpu_signatures_match(sig, mc_hdr->sig, mc_hdr->pf)) 157 return true; 158 159 /* Look for ext. headers: */ 160 if (get_totalsize(mc_hdr) <= intel_microcode_get_datasize(mc_hdr) + MC_HEADER_SIZE) 161 return false; 162 163 ext_hdr = mc + intel_microcode_get_datasize(mc_hdr) + MC_HEADER_SIZE; 164 ext_sig = (void *)ext_hdr + EXT_HEADER_SIZE; 165 166 for (i = 0; i < ext_hdr->count; i++) { 167 if (cpu_signatures_match(sig, ext_sig->sig, ext_sig->pf)) 168 return true; 169 ext_sig++; 170 } 171 return 0; 172 } 173 EXPORT_SYMBOL_GPL(intel_find_matching_signature); 174 175 /** 176 * intel_microcode_sanity_check() - Sanity check microcode file. 177 * @mc: Pointer to the microcode file contents. 178 * @print_err: Display failure reason if true, silent if false. 179 * @hdr_type: Type of file, i.e. normal microcode file or In Field Scan file. 180 * Validate if the microcode header type matches with the type 181 * specified here. 182 * 183 * Validate certain header fields and verify if computed checksum matches 184 * with the one specified in the header. 185 * 186 * Return: 0 if the file passes all the checks, -EINVAL if any of the checks 187 * fail. 188 */ 189 int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type) 190 { 191 unsigned long total_size, data_size, ext_table_size; 192 struct microcode_header_intel *mc_header = mc; 193 struct extended_sigtable *ext_header = NULL; 194 u32 sum, orig_sum, ext_sigcount = 0, i; 195 struct extended_signature *ext_sig; 196 197 total_size = get_totalsize(mc_header); 198 data_size = intel_microcode_get_datasize(mc_header); 199 200 if (data_size + MC_HEADER_SIZE > total_size) { 201 if (print_err) 202 pr_err("Error: bad microcode data file size.\n"); 203 return -EINVAL; 204 } 205 206 if (mc_header->ldrver != 1 || mc_header->hdrver != hdr_type) { 207 if (print_err) 208 pr_err("Error: invalid/unknown microcode update format. Header type %d\n", 209 mc_header->hdrver); 210 return -EINVAL; 211 } 212 213 ext_table_size = total_size - (MC_HEADER_SIZE + data_size); 214 if (ext_table_size) { 215 u32 ext_table_sum = 0; 216 u32 *ext_tablep; 217 218 if (ext_table_size < EXT_HEADER_SIZE || 219 ((ext_table_size - EXT_HEADER_SIZE) % EXT_SIGNATURE_SIZE)) { 220 if (print_err) 221 pr_err("Error: truncated extended signature table.\n"); 222 return -EINVAL; 223 } 224 225 ext_header = mc + MC_HEADER_SIZE + data_size; 226 if (ext_table_size != exttable_size(ext_header)) { 227 if (print_err) 228 pr_err("Error: extended signature table size mismatch.\n"); 229 return -EFAULT; 230 } 231 232 ext_sigcount = ext_header->count; 233 234 /* 235 * Check extended table checksum: the sum of all dwords that 236 * comprise a valid table must be 0. 237 */ 238 ext_tablep = (u32 *)ext_header; 239 240 i = ext_table_size / sizeof(u32); 241 while (i--) 242 ext_table_sum += ext_tablep[i]; 243 244 if (ext_table_sum) { 245 if (print_err) 246 pr_warn("Bad extended signature table checksum, aborting.\n"); 247 return -EINVAL; 248 } 249 } 250 251 /* 252 * Calculate the checksum of update data and header. The checksum of 253 * valid update data and header including the extended signature table 254 * must be 0. 255 */ 256 orig_sum = 0; 257 i = (MC_HEADER_SIZE + data_size) / sizeof(u32); 258 while (i--) 259 orig_sum += ((u32 *)mc)[i]; 260 261 if (orig_sum) { 262 if (print_err) 263 pr_err("Bad microcode data checksum, aborting.\n"); 264 return -EINVAL; 265 } 266 267 if (!ext_table_size) 268 return 0; 269 270 /* 271 * Check extended signature checksum: 0 => valid. 272 */ 273 for (i = 0; i < ext_sigcount; i++) { 274 ext_sig = (void *)ext_header + EXT_HEADER_SIZE + 275 EXT_SIGNATURE_SIZE * i; 276 277 sum = (mc_header->sig + mc_header->pf + mc_header->cksum) - 278 (ext_sig->sig + ext_sig->pf + ext_sig->cksum); 279 if (sum) { 280 if (print_err) 281 pr_err("Bad extended signature checksum, aborting.\n"); 282 return -EINVAL; 283 } 284 } 285 return 0; 286 } 287 EXPORT_SYMBOL_GPL(intel_microcode_sanity_check); 288 289 static void update_ucode_pointer(struct microcode_intel *mc) 290 { 291 kvfree(ucode_patch_va); 292 293 /* 294 * Save the virtual address for early loading and for eventual free 295 * on late loading. 296 */ 297 ucode_patch_va = mc; 298 } 299 300 static void save_microcode_patch(struct microcode_intel *patch) 301 { 302 unsigned int size = get_totalsize(&patch->hdr); 303 struct microcode_intel *mc; 304 305 mc = kvmemdup(patch, size, GFP_KERNEL); 306 if (mc) 307 update_ucode_pointer(mc); 308 else 309 pr_err("Unable to allocate microcode memory size: %u\n", size); 310 } 311 312 static bool revision_is_safe(struct cpu_signature *sig, u32 rev) 313 { 314 u32 vfm = IFM(x86_family(sig->sig), x86_model(sig->sig)); 315 316 /* 317 * Erratum GNR98 can cause #MCs if "jumping over" revision 0x1000405. 318 * Avoid the jumps. 319 */ 320 if (vfm == INTEL_GRANITERAPIDS_X && 321 x86_stepping(sig->sig) == 1 && 322 sig->pf & 0x95 && 323 sig->rev < 0x1000405 && 324 rev > 0x1000405) { 325 pr_err_once("Erratum GNR98: skipping revision 0x%x.\n", rev); 326 return false; 327 } 328 329 return true; 330 } 331 332 /* Scan blob for microcode matching the boot CPUs family, model, stepping */ 333 static __init struct microcode_intel *scan_microcode(void *data, size_t size, 334 struct ucode_cpu_info *uci, 335 bool save) 336 { 337 struct microcode_header_intel *mc_header; 338 struct microcode_intel *patch = NULL; 339 u32 cur_rev = uci->cpu_sig.rev; 340 unsigned int mc_size; 341 342 for (; size >= sizeof(struct microcode_header_intel); size -= mc_size, data += mc_size) { 343 mc_header = (struct microcode_header_intel *)data; 344 345 mc_size = get_totalsize(mc_header); 346 if (!mc_size || mc_size > size || 347 intel_microcode_sanity_check(data, false, MC_HEADER_TYPE_MICROCODE) < 0) 348 break; 349 350 if (!intel_find_matching_signature(data, &uci->cpu_sig)) 351 continue; 352 353 if (!revision_is_safe(&uci->cpu_sig, mc_header->rev)) 354 continue; 355 356 /* 357 * For saving the early microcode, find the matching revision which 358 * was loaded on the BSP. 359 * 360 * On the BSP during early boot, find a newer revision than 361 * actually loaded in the CPU. 362 */ 363 if (save) { 364 if (cur_rev != mc_header->rev) 365 continue; 366 } else if (cur_rev >= mc_header->rev) { 367 continue; 368 } 369 370 patch = data; 371 cur_rev = mc_header->rev; 372 } 373 374 return size ? NULL : patch; 375 } 376 377 static inline u32 read_mbox_dword(void __iomem *mmio_base) 378 { 379 u32 dword = readl(mmio_base + MBOX_RDDATA_OFFSET); 380 381 /* Acknowledge read completion to the staging hardware */ 382 writel(0, mmio_base + MBOX_RDDATA_OFFSET); 383 return dword; 384 } 385 386 static inline void write_mbox_dword(void __iomem *mmio_base, u32 dword) 387 { 388 writel(dword, mmio_base + MBOX_WRDATA_OFFSET); 389 } 390 391 static inline u64 read_mbox_header(void __iomem *mmio_base) 392 { 393 u32 high, low; 394 395 low = read_mbox_dword(mmio_base); 396 high = read_mbox_dword(mmio_base); 397 398 return ((u64)high << 32) | low; 399 } 400 401 static inline void write_mbox_header(void __iomem *mmio_base, u64 value) 402 { 403 write_mbox_dword(mmio_base, value); 404 write_mbox_dword(mmio_base, value >> 32); 405 } 406 407 static void write_mbox_data(void __iomem *mmio_base, u32 *chunk, unsigned int chunk_bytes) 408 { 409 int i; 410 411 /* 412 * The MMIO space is mapped as Uncached (UC). Each write arrives 413 * at the device as an individual transaction in program order. 414 * The device can then reassemble the sequence accordingly. 415 */ 416 for (i = 0; i < chunk_bytes / sizeof(u32); i++) 417 write_mbox_dword(mmio_base, chunk[i]); 418 } 419 420 /* 421 * Prepare for a new microcode transfer: reset hardware and record the 422 * image size. 423 */ 424 static void init_stage(struct staging_state *ss) 425 { 426 ss->ucode_len = get_totalsize(&ucode_patch_late->hdr); 427 428 /* 429 * Abort any ongoing process, effectively resetting the device. 430 * Unlike regular mailbox data processing requests, this 431 * operation does not require a status check. 432 */ 433 writel(MASK_MBOX_CTRL_ABORT, ss->mmio_base + MBOX_CONTROL_OFFSET); 434 } 435 436 /* 437 * Update the chunk size and decide whether another chunk can be sent. 438 * This accounts for remaining data and retry limits. 439 */ 440 static bool can_send_next_chunk(struct staging_state *ss, int *err) 441 { 442 /* A page size or remaining bytes if this is the final chunk */ 443 ss->chunk_size = min(PAGE_SIZE, ss->ucode_len - ss->offset); 444 445 /* 446 * Each microcode image is divided into chunks, each at most 447 * one page size. A 10-chunk image would typically require 10 448 * transactions. 449 * 450 * However, the hardware managing the mailbox has limited 451 * resources and may not cache the entire image, potentially 452 * requesting the same chunk multiple times. 453 * 454 * To tolerate this behavior, allow up to twice the expected 455 * number of transactions (i.e., a 10-chunk image can take up to 456 * 20 attempts). 457 * 458 * If the number of attempts exceeds this limit, treat it as 459 * exceeding the maximum allowed transfer size. 460 */ 461 if (ss->bytes_sent + ss->chunk_size > ss->ucode_len * 2) { 462 *err = -EMSGSIZE; 463 return false; 464 } 465 466 *err = 0; 467 return true; 468 } 469 470 /* 471 * The hardware indicates completion by returning a sentinel end offset. 472 */ 473 static inline bool is_end_offset(u32 offset) 474 { 475 return offset == UINT_MAX; 476 } 477 478 /* 479 * Determine whether staging is complete: either the hardware signaled 480 * the end offset, or no more transactions are permitted (retry limit 481 * reached). 482 */ 483 static inline bool staging_is_complete(struct staging_state *ss, int *err) 484 { 485 return is_end_offset(ss->offset) || !can_send_next_chunk(ss, err); 486 } 487 488 /* 489 * Wait for the hardware to complete a transaction. 490 * Return 0 on success, or an error code on failure. 491 */ 492 static int wait_for_transaction(struct staging_state *ss) 493 { 494 u32 timeout, status; 495 496 /* Allow time for hardware to complete the operation: */ 497 for (timeout = 0; timeout < MBOX_XACTION_TIMEOUT_MS; timeout++) { 498 msleep(1); 499 500 status = readl(ss->mmio_base + MBOX_STATUS_OFFSET); 501 /* Break out early if the hardware is ready: */ 502 if (status & MASK_MBOX_STATUS_READY) 503 break; 504 } 505 506 /* Check for explicit error response */ 507 if (status & MASK_MBOX_STATUS_ERROR) 508 return -EIO; 509 510 /* 511 * Hardware has neither responded to the action nor signaled any 512 * error. Treat this as a timeout. 513 */ 514 if (!(status & MASK_MBOX_STATUS_READY)) 515 return -ETIMEDOUT; 516 517 return 0; 518 } 519 520 /* 521 * Transmit a chunk of the microcode image to the hardware. 522 * Return 0 on success, or an error code on failure. 523 */ 524 static int send_data_chunk(struct staging_state *ss, void *ucode_ptr) 525 { 526 u32 *src_chunk = ucode_ptr + ss->offset; 527 u16 mbox_size; 528 529 /* 530 * Write a 'request' mailbox object in this order: 531 * 1. Mailbox header includes total size 532 * 2. Command header specifies the load operation 533 * 3. Data section contains a microcode chunk 534 * 535 * Thus, the mailbox size is two headers plus the chunk size. 536 */ 537 mbox_size = MBOX_HEADER_SIZE * 2 + ss->chunk_size; 538 write_mbox_header(ss->mmio_base, MBOX_HEADER(mbox_size)); 539 write_mbox_header(ss->mmio_base, MBOX_CMD_LOAD); 540 write_mbox_data(ss->mmio_base, src_chunk, ss->chunk_size); 541 ss->bytes_sent += ss->chunk_size; 542 543 /* Notify the hardware that the mailbox is ready for processing. */ 544 writel(MASK_MBOX_CTRL_GO, ss->mmio_base + MBOX_CONTROL_OFFSET); 545 546 return wait_for_transaction(ss); 547 } 548 549 /* 550 * Retrieve the next offset from the hardware response. 551 * Return 0 on success, or an error code on failure. 552 */ 553 static int fetch_next_offset(struct staging_state *ss) 554 { 555 const u64 expected_header = MBOX_HEADER(MBOX_HEADER_SIZE + MBOX_RESPONSE_SIZE); 556 u32 offset, status; 557 u64 header; 558 559 /* 560 * The 'response' mailbox returns three fields, in order: 561 * 1. Header 562 * 2. Next offset in the microcode image 563 * 3. Status flags 564 */ 565 header = read_mbox_header(ss->mmio_base); 566 offset = read_mbox_dword(ss->mmio_base); 567 status = read_mbox_dword(ss->mmio_base); 568 569 /* All valid responses must start with the expected header. */ 570 if (header != expected_header) { 571 pr_err_once("staging: invalid response header (0x%llx)\n", header); 572 return -EBADR; 573 } 574 575 /* 576 * Verify the offset: If not at the end marker, it must not 577 * exceed the microcode image length. 578 */ 579 if (!is_end_offset(offset) && offset > ss->ucode_len) { 580 pr_err_once("staging: invalid offset (%u) past the image end (%u)\n", 581 offset, ss->ucode_len); 582 return -EINVAL; 583 } 584 585 /* Hardware may report errors explicitly in the status field */ 586 if (status & MASK_MBOX_RESP_ERROR) 587 return -EPROTO; 588 589 ss->offset = offset; 590 return 0; 591 } 592 593 /* 594 * Handle the staging process using the mailbox MMIO interface. The 595 * microcode image is transferred in chunks until completion. 596 * Return 0 on success or an error code on failure. 597 */ 598 static int do_stage(u64 mmio_pa) 599 { 600 struct staging_state ss = {}; 601 int err; 602 603 ss.mmio_base = ioremap(mmio_pa, MBOX_REG_NUM * MBOX_REG_SIZE); 604 if (WARN_ON_ONCE(!ss.mmio_base)) 605 return -EADDRNOTAVAIL; 606 607 init_stage(&ss); 608 609 /* Perform the staging process while within the retry limit */ 610 while (!staging_is_complete(&ss, &err)) { 611 /* Send a chunk of microcode each time: */ 612 err = send_data_chunk(&ss, ucode_patch_late); 613 if (err) 614 break; 615 /* 616 * Then, ask the hardware which piece of the image it 617 * needs next. The same piece may be sent more than once. 618 */ 619 err = fetch_next_offset(&ss); 620 if (err) 621 break; 622 } 623 624 iounmap(ss.mmio_base); 625 626 return err; 627 } 628 629 static void stage_microcode(void) 630 { 631 unsigned int pkg_id = UINT_MAX; 632 int cpu, err; 633 u64 mmio_pa; 634 635 if (!IS_ALIGNED(get_totalsize(&ucode_patch_late->hdr), sizeof(u32))) { 636 pr_err("Microcode image 32-bit misaligned (0x%x), staging failed.\n", 637 get_totalsize(&ucode_patch_late->hdr)); 638 return; 639 } 640 641 lockdep_assert_cpus_held(); 642 643 /* 644 * The MMIO address is unique per package, and all the SMT 645 * primary threads are online here. Find each MMIO space by 646 * their package IDs to avoid duplicate staging. 647 */ 648 for_each_cpu(cpu, cpu_primary_thread_mask) { 649 if (topology_logical_package_id(cpu) == pkg_id) 650 continue; 651 652 pkg_id = topology_logical_package_id(cpu); 653 654 err = rdmsrq_on_cpu(cpu, MSR_IA32_MCU_STAGING_MBOX_ADDR, &mmio_pa); 655 if (WARN_ON_ONCE(err)) 656 return; 657 658 err = do_stage(mmio_pa); 659 if (err) { 660 pr_err("Error: staging failed (%d) for CPU%d at package %u.\n", 661 err, cpu, pkg_id); 662 return; 663 } 664 } 665 666 pr_info("Staging of patch revision 0x%x succeeded.\n", ucode_patch_late->hdr.rev); 667 } 668 669 static enum ucode_state __apply_microcode(struct ucode_cpu_info *uci, 670 struct microcode_intel *mc, 671 u32 *cur_rev) 672 { 673 u32 rev; 674 675 if (!mc) 676 return UCODE_NFOUND; 677 678 /* 679 * Save us the MSR write below - which is a particular expensive 680 * operation - when the other hyperthread has updated the microcode 681 * already. 682 */ 683 *cur_rev = intel_get_microcode_revision(); 684 if (*cur_rev >= mc->hdr.rev) { 685 uci->cpu_sig.rev = *cur_rev; 686 return UCODE_OK; 687 } 688 689 /* write microcode via MSR 0x79 */ 690 native_wrmsrq(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); 691 692 rev = intel_get_microcode_revision(); 693 if (rev != mc->hdr.rev) 694 return UCODE_ERROR; 695 696 uci->cpu_sig.rev = rev; 697 return UCODE_UPDATED; 698 } 699 700 static enum ucode_state apply_microcode_early(struct ucode_cpu_info *uci) 701 { 702 struct microcode_intel *mc = uci->mc; 703 u32 cur_rev; 704 705 return __apply_microcode(uci, mc, &cur_rev); 706 } 707 708 static __init bool load_builtin_intel_microcode(struct cpio_data *cp) 709 { 710 unsigned int eax = 1, ebx, ecx = 0, edx; 711 struct firmware fw; 712 char name[30]; 713 714 if (IS_ENABLED(CONFIG_X86_32)) 715 return false; 716 717 native_cpuid(&eax, &ebx, &ecx, &edx); 718 719 sprintf(name, "intel-ucode/%02x-%02x-%02x", 720 x86_family(eax), x86_model(eax), x86_stepping(eax)); 721 722 if (firmware_request_builtin(&fw, name)) { 723 cp->size = fw.size; 724 cp->data = (void *)fw.data; 725 return true; 726 } 727 return false; 728 } 729 730 static __init struct microcode_intel *get_microcode_blob(struct ucode_cpu_info *uci, bool save) 731 { 732 struct cpio_data cp; 733 734 intel_collect_cpu_info(&uci->cpu_sig); 735 736 if (!load_builtin_intel_microcode(&cp)) 737 cp = find_microcode_in_initrd(ucode_path); 738 739 if (!(cp.data && cp.size)) 740 return NULL; 741 742 return scan_microcode(cp.data, cp.size, uci, save); 743 } 744 745 /* 746 * Invoked from an early init call to save the microcode blob which was 747 * selected during early boot when mm was not usable. The microcode must be 748 * saved because initrd is going away. It's an early init call so the APs 749 * just can use the pointer and do not have to scan initrd/builtin firmware 750 * again. 751 */ 752 static int __init save_builtin_microcode(void) 753 { 754 struct ucode_cpu_info uci; 755 756 if (xchg(&ucode_patch_va, NULL) != UCODE_BSP_LOADED) 757 return 0; 758 759 if (microcode_loader_disabled() || boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) 760 return 0; 761 762 uci.mc = get_microcode_blob(&uci, true); 763 if (uci.mc) 764 save_microcode_patch(uci.mc); 765 return 0; 766 } 767 early_initcall(save_builtin_microcode); 768 769 /* Load microcode on BSP from initrd or builtin blobs */ 770 void __init load_ucode_intel_bsp(struct early_load_data *ed) 771 { 772 struct ucode_cpu_info uci; 773 774 uci.mc = get_microcode_blob(&uci, false); 775 ed->old_rev = uci.cpu_sig.rev; 776 777 if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED) { 778 ucode_patch_va = UCODE_BSP_LOADED; 779 ed->new_rev = uci.cpu_sig.rev; 780 } 781 } 782 783 void load_ucode_intel_ap(void) 784 { 785 struct ucode_cpu_info uci; 786 787 uci.mc = ucode_patch_va; 788 if (uci.mc) 789 apply_microcode_early(&uci); 790 } 791 792 /* Reload microcode on resume */ 793 void reload_ucode_intel(void) 794 { 795 struct ucode_cpu_info uci = { .mc = ucode_patch_va, }; 796 797 if (uci.mc) 798 apply_microcode_early(&uci); 799 } 800 801 static int collect_cpu_info(int cpu_num, struct cpu_signature *csig) 802 { 803 intel_collect_cpu_info(csig); 804 return 0; 805 } 806 807 static enum ucode_state apply_microcode_late(int cpu) 808 { 809 struct ucode_cpu_info *uci = ucode_cpu_info + cpu; 810 struct microcode_intel *mc = ucode_patch_late; 811 enum ucode_state ret; 812 u32 cur_rev; 813 814 if (WARN_ON_ONCE(smp_processor_id() != cpu)) 815 return UCODE_ERROR; 816 817 ret = __apply_microcode(uci, mc, &cur_rev); 818 if (ret != UCODE_UPDATED && ret != UCODE_OK) 819 return ret; 820 821 cpu_data(cpu).microcode = uci->cpu_sig.rev; 822 if (!cpu) 823 boot_cpu_data.microcode = uci->cpu_sig.rev; 824 825 return ret; 826 } 827 828 static bool ucode_validate_minrev(struct microcode_header_intel *mc_header) 829 { 830 int cur_rev = boot_cpu_data.microcode; 831 832 /* 833 * When late-loading, ensure the header declares a minimum revision 834 * required to perform a late-load. The previously reserved field 835 * is 0 in older microcode blobs. 836 */ 837 if (!mc_header->min_req_ver) { 838 pr_info("Unsafe microcode update: Microcode header does not specify a required min version\n"); 839 return false; 840 } 841 842 /* 843 * Check whether the current revision is either greater or equal to 844 * to the minimum revision specified in the header. 845 */ 846 if (cur_rev < mc_header->min_req_ver) { 847 pr_info("Unsafe microcode update: Current revision 0x%x too old\n", cur_rev); 848 pr_info("Current should be at 0x%x or higher. Use early loading instead\n", mc_header->min_req_ver); 849 return false; 850 } 851 return true; 852 } 853 854 static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) 855 { 856 struct ucode_cpu_info *uci = ucode_cpu_info + cpu; 857 bool is_safe, new_is_safe = false; 858 int cur_rev = uci->cpu_sig.rev; 859 unsigned int curr_mc_size = 0; 860 u8 *new_mc = NULL, *mc = NULL; 861 862 while (iov_iter_count(iter)) { 863 struct microcode_header_intel mc_header; 864 unsigned int mc_size, data_size; 865 u8 *data; 866 867 if (!copy_from_iter_full(&mc_header, sizeof(mc_header), iter)) { 868 pr_err("error! Truncated or inaccessible header in microcode data file\n"); 869 goto fail; 870 } 871 872 mc_size = get_totalsize(&mc_header); 873 if (mc_size < sizeof(mc_header)) { 874 pr_err("error! Bad data in microcode data file (totalsize too small)\n"); 875 goto fail; 876 } 877 data_size = mc_size - sizeof(mc_header); 878 if (data_size > iov_iter_count(iter)) { 879 pr_err("error! Bad data in microcode data file (truncated file?)\n"); 880 goto fail; 881 } 882 883 /* For performance reasons, reuse mc area when possible */ 884 if (!mc || mc_size > curr_mc_size) { 885 kvfree(mc); 886 mc = kvmalloc(mc_size, GFP_KERNEL); 887 if (!mc) 888 goto fail; 889 curr_mc_size = mc_size; 890 } 891 892 memcpy(mc, &mc_header, sizeof(mc_header)); 893 data = mc + sizeof(mc_header); 894 if (!copy_from_iter_full(data, data_size, iter) || 895 intel_microcode_sanity_check(mc, true, MC_HEADER_TYPE_MICROCODE) < 0) 896 goto fail; 897 898 if (cur_rev >= mc_header.rev) 899 continue; 900 901 if (!intel_find_matching_signature(mc, &uci->cpu_sig)) 902 continue; 903 904 if (!revision_is_safe(&uci->cpu_sig, mc_header.rev)) 905 continue; 906 907 is_safe = ucode_validate_minrev(&mc_header); 908 if (force_minrev && !is_safe) 909 continue; 910 911 kvfree(new_mc); 912 cur_rev = mc_header.rev; 913 new_mc = mc; 914 new_is_safe = is_safe; 915 mc = NULL; 916 } 917 918 if (iov_iter_count(iter)) 919 goto fail; 920 921 kvfree(mc); 922 if (!new_mc) 923 return UCODE_NFOUND; 924 925 ucode_patch_late = (struct microcode_intel *)new_mc; 926 return new_is_safe ? UCODE_NEW_SAFE : UCODE_NEW; 927 928 fail: 929 kvfree(mc); 930 kvfree(new_mc); 931 return UCODE_ERROR; 932 } 933 934 static bool is_blacklisted(unsigned int cpu) 935 { 936 struct cpuinfo_x86 *c = &cpu_data(cpu); 937 938 /* 939 * Late loading on model 79 with microcode revision less than 0x0b000021 940 * and LLC size per core bigger than 2.5MB may result in a system hang. 941 * This behavior is documented in item BDX90, #334165 (Intel Xeon 942 * Processor E7-8800/4800 v4 Product Family). 943 */ 944 if (c->x86_vfm == INTEL_BROADWELL_X && 945 c->x86_stepping == 0x01 && 946 llc_size_per_core > 2621440 && 947 c->microcode < 0x0b000021) { 948 pr_err_once("Erratum BDX90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode); 949 pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); 950 return true; 951 } 952 953 return false; 954 } 955 956 static enum ucode_state request_microcode_fw(int cpu, struct device *device) 957 { 958 struct cpuinfo_x86 *c = &cpu_data(cpu); 959 const struct firmware *firmware; 960 struct iov_iter iter; 961 enum ucode_state ret; 962 struct kvec kvec; 963 char name[30]; 964 965 if (is_blacklisted(cpu)) 966 return UCODE_NFOUND; 967 968 sprintf(name, "intel-ucode/%02x-%02x-%02x", 969 c->x86, c->x86_model, c->x86_stepping); 970 971 if (request_firmware_direct(&firmware, name, device)) { 972 pr_debug("data file %s load failed\n", name); 973 return UCODE_NFOUND; 974 } 975 976 kvec.iov_base = (void *)firmware->data; 977 kvec.iov_len = firmware->size; 978 iov_iter_kvec(&iter, ITER_SOURCE, &kvec, 1, firmware->size); 979 ret = parse_microcode_blobs(cpu, &iter); 980 981 release_firmware(firmware); 982 983 return ret; 984 } 985 986 static void finalize_late_load(int result) 987 { 988 if (!result) 989 update_ucode_pointer(ucode_patch_late); 990 else 991 kvfree(ucode_patch_late); 992 ucode_patch_late = NULL; 993 } 994 995 static struct microcode_ops microcode_intel_ops = { 996 .request_microcode_fw = request_microcode_fw, 997 .collect_cpu_info = collect_cpu_info, 998 .apply_microcode = apply_microcode_late, 999 .finalize_late_load = finalize_late_load, 1000 .stage_microcode = stage_microcode, 1001 .use_nmi = IS_ENABLED(CONFIG_X86_64), 1002 }; 1003 1004 static __init void calc_llc_size_per_core(struct cpuinfo_x86 *c) 1005 { 1006 u64 llc_size = c->x86_cache_size * 1024ULL; 1007 1008 do_div(llc_size, topology_num_cores_per_package()); 1009 llc_size_per_core = (unsigned int)llc_size; 1010 } 1011 1012 static __init bool staging_available(void) 1013 { 1014 u64 val; 1015 1016 val = x86_read_arch_cap_msr(); 1017 if (!(val & ARCH_CAP_MCU_ENUM)) 1018 return false; 1019 1020 rdmsrq(MSR_IA32_MCU_ENUMERATION, val); 1021 return !!(val & MCU_STAGING); 1022 } 1023 1024 struct microcode_ops * __init init_intel_microcode(void) 1025 { 1026 struct cpuinfo_x86 *c = &boot_cpu_data; 1027 1028 if (c->x86_vendor != X86_VENDOR_INTEL || c->x86 < 6 || 1029 cpu_has(c, X86_FEATURE_IA64)) { 1030 pr_err("Intel CPU family 0x%x not supported\n", c->x86); 1031 return NULL; 1032 } 1033 1034 if (staging_available()) { 1035 microcode_intel_ops.use_staging = true; 1036 pr_info("Enabled staging feature.\n"); 1037 } 1038 1039 calc_llc_size_per_core(c); 1040 1041 return µcode_intel_ops; 1042 } 1043