// SPDX-License-Identifier: GPL-2.0-or-later/* * CPU Microcode Update Driver for Linux * * Copyright (C) 2000-2006 Tigran Aivazian <aivazian.tigran@gmail.com> * 2006 Shaohua Li <shaohua.li@intel.com> * 2013-2016 Borislav Petkov <bp@alien8.de> * * X86 CPU microcode early update for Linux: * * Copyright (C) 2012 Fenghua Yu <fenghua.yu@intel.com> * H Peter Anvin" <hpa@zytor.com> * (C) 2015 Borislav Petkov <bp@alien8.de> * * This driver allows to upgrade microcode on x86 processors. */ #define pr_fmt(fmt) "microcode: " fmt #include <linux/platform_device.h>#include <linux/stop_machine.h>#include <linux/syscore_ops.h>#include <linux/miscdevice.h>#include <linux/capability.h>#include <linux/firmware.h>#include <linux/kernel.h>#include <linux/delay.h>#include <linux/mutex.h>#include <linux/cpu.h>#include <linux/nmi.h>#include <linux/fs.h>#include <linux/mm.h> #include <asm/microcode_intel.h>#include <asm/cpu_device_id.h>#include <asm/microcode_amd.h>#include <asm/perf_event.h>#include <asm/microcode.h>#include <asm/processor.h>#include <asm/cmdline.h>#include <asm/setup.h> #define DRIVER_VERSION "2.2" static struct microcode_ops *microcode_ops;static bool dis_ucode_ldr = true; bool initrd_gone; LIST_HEAD(microcode_cache); /* * Synchronization. * * All non cpu-hotplug-callback call sites use: * * - microcode_mutex to synchronize with each other; * - cpus_read_lock/unlock() to synchronize with * the cpu-hotplug-callback call sites. * * We guarantee that only a single cpu is being * updated at any particular moment of time. */static DEFINE_MUTEX(microcode_mutex); struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; struct cpu_info_ctx { struct cpu_signature *cpu_sig; int err;}; /* * Those patch levels cannot be updated to newer ones and thus should be final. */static u32 final_levels[] = { 0x01000098, 0x0100009f, 0x010000af, 0, /* T-101 terminator */}; /* * Check the current patch level on this CPU. * * Returns: * - true: if update should stop * - false: otherwise */static bool amd_check_current_patch_level(void){ u32 lvl, dummy, i; u32 *levels; native_rdmsr(MSR_AMD64_PATCH_LEVEL, lvl, dummy); if (IS_ENABLED(CONFIG_X86_32)) levels = (u32 *)__pa_nodebug(&final_levels); else levels = final_levels; for (i = 0; levels[i]; i++) { if (lvl == levels[i]) return true; } return false;} static bool __init check_loader_disabled_bsp(void){ static const char *__dis_opt_str = "dis_ucode_ldr"; #ifdef CONFIG_X86_32 const char *cmdline = (const char *)__pa_nodebug(boot_command_line); const char *option = (const char *)__pa_nodebug(__dis_opt_str); bool *res = (bool *)__pa_nodebug(&dis_ucode_ldr); #else /* CONFIG_X86_64 */ const char *cmdline = boot_command_line; const char *option = __dis_opt_str; bool *res = &dis_ucode_ldr;#endif /* * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not * completely accurate as xen pv guests don't see that CPUID bit set but * that's good enough as they don't land on the BSP path anyway. */ if (native_cpuid_ecx(1) & BIT(31)) return *res; if (x86_cpuid_vendor() == X86_VENDOR_AMD) { if (amd_check_current_patch_level()) return *res; } if (cmdline_find_option_bool(cmdline, option) <= 0) *res = false; return *res;} void __init load_ucode_bsp(void){ unsigned int cpuid_1_eax; bool intel = true; if (!have_cpuid_p()) return; cpuid_1_eax = native_cpuid_eax(1); switch (x86_cpuid_vendor()) { case X86_VENDOR_INTEL: if (x86_family(cpuid_1_eax) < 6) return; break; case X86_VENDOR_AMD: if (x86_family(cpuid_1_eax) < 0x10) return; intel = false; break; default: return; } if (check_loader_disabled_bsp()) return; if (intel) load_ucode_intel_bsp(); else load_ucode_amd_bsp(cpuid_1_eax);} static bool check_loader_disabled_ap(void){#ifdef CONFIG_X86_32 return *((bool *)__pa_nodebug(&dis_ucode_ldr));#else return dis_ucode_ldr;#endif} void load_ucode_ap(void){ unsigned int cpuid_1_eax; if (check_loader_disabled_ap()) return; cpuid_1_eax = native_cpuid_eax(1); switch (x86_cpuid_vendor()) { case X86_VENDOR_INTEL: if (x86_family(cpuid_1_eax) >= 6) load_ucode_intel_ap(); break; case X86_VENDOR_AMD: if (x86_family(cpuid_1_eax) >= 0x10) load_ucode_amd_ap(cpuid_1_eax); break; default: break; }} static int __init save_microcode_in_initrd(void){ struct cpuinfo_x86 *c = &boot_cpu_data; int ret = -EINVAL; switch (c->x86_vendor) { case X86_VENDOR_INTEL: if (c->x86 >= 6) ret = save_microcode_in_initrd_intel(); break; case X86_VENDOR_AMD: if (c->x86 >= 0x10) ret = save_microcode_in_initrd_amd(cpuid_eax(1)); break; default: break; } initrd_gone = true; return ret;} struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa){#ifdef CONFIG_BLK_DEV_INITRD unsigned long start = 0; size_t size; #ifdef CONFIG_X86_32 struct boot_params *params; if (use_pa) params = (struct boot_params *)__pa_nodebug(&boot_params); else params = &boot_params; size = params->hdr.ramdisk_size; /* * Set start only if we have an initrd image. We cannot use initrd_start * because it is not set that early yet. */ if (size) start = params->hdr.ramdisk_image; # else /* CONFIG_X86_64 */ size = (unsigned long)boot_params.ext_ramdisk_size << 32; size |= boot_params.hdr.ramdisk_size; if (size) { start = (unsigned long)boot_params.ext_ramdisk_image << 32; start |= boot_params.hdr.ramdisk_image; start += PAGE_OFFSET; }# endif /* * Fixup the start address: after reserve_initrd() runs, initrd_start * has the virtual address of the beginning of the initrd. It also * possibly relocates the ramdisk. In either case, initrd_start contains * the updated address so use that instead. * * initrd_gone is for the hotplug case where we've thrown out initrd * already. */ if (!use_pa) { if (initrd_gone) return (struct cpio_data){ NULL, 0, "" }; if (initrd_start) start = initrd_start; } else { /* * The picture with physical addresses is a bit different: we * need to get the *physical* address to which the ramdisk was * relocated, i.e., relocated_ramdisk (not initrd_start) and * since we're running from physical addresses, we need to access * relocated_ramdisk through its *physical* address too. */ u64 *rr = (u64 *)__pa_nodebug(&relocated_ramdisk); if (*rr) start = *rr; } return find_cpio_data(path, (void *)start, size, NULL);#else /* !CONFIG_BLK_DEV_INITRD */ return (struct cpio_data){ NULL, 0, "" };#endif} void reload_early_microcode(void){ int vendor, family; vendor = x86_cpuid_vendor(); family = x86_cpuid_family(); switch (vendor) { case X86_VENDOR_INTEL: if (family >= 6) reload_ucode_intel(); break; case X86_VENDOR_AMD: if (family >= 0x10) reload_ucode_amd(); break; default: break; }} static void collect_cpu_info_local(void *arg){ struct cpu_info_ctx *ctx = arg; ctx->err = microcode_ops->collect_cpu_info(smp_processor_id(), ctx->cpu_sig);} static int collect_cpu_info_on_target(int cpu, struct cpu_signature *cpu_sig){ struct cpu_info_ctx ctx = { .cpu_sig = cpu_sig, .err = 0 }; int ret; ret = smp_call_function_single(cpu, collect_cpu_info_local, &ctx, 1); if (!ret) ret = ctx.err; return ret;} static int collect_cpu_info(int cpu){ struct ucode_cpu_info *uci = ucode_cpu_info + cpu; int ret; memset(uci, 0, sizeof(*uci)); ret = collect_cpu_info_on_target(cpu, &uci->cpu_sig); if (!ret) uci->valid = 1; return ret;} static void apply_microcode_local(void *arg){ enum ucode_state *err = arg; *err = microcode_ops->apply_microcode(smp_processor_id());} static int apply_microcode_on_target(int cpu){ enum ucode_state err; int ret; ret = smp_call_function_single(cpu, apply_microcode_local, &err, 1); if (!ret) { if (err == UCODE_ERROR) ret = 1; } return ret;} /* fake device for request_firmware */static struct platform_device *microcode_pdev; #ifdef CONFIG_MICROCODE_LATE_LOADING/* * Late loading dance. Why the heavy-handed stomp_machine effort? * * - HT siblings must be idle and not execute other code while the other sibling * is loading microcode in order to avoid any negative interactions caused by * the loading. * * - In addition, microcode update on the cores must be serialized until this * requirement can be relaxed in the future. Right now, this is conservative * and good. */#define SPINUNIT 100 /* 100 nsec */ static int check_online_cpus(void){ unsigned int cpu; /* * Make sure all CPUs are online. It's fine for SMT to be disabled if * all the primary threads are still online. */ for_each_present_cpu(cpu) { if (topology_is_primary_thread(cpu) && !cpu_online(cpu)) { pr_err("Not all CPUs online, aborting microcode update.\n"); return -EINVAL; } } return 0;} static atomic_t late_cpus_in;static atomic_t late_cpus_out; static int __wait_for_cpus(atomic_t *t, long long timeout){ int all_cpus = num_online_cpus(); atomic_inc(t); while (atomic_read(t) < all_cpus) { if (timeout < SPINUNIT) { pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n", all_cpus - atomic_read(t)); return 1; } ndelay(SPINUNIT); timeout -= SPINUNIT; touch_nmi_watchdog(); } return 0;} /* * Returns: * < 0 - on error * 0 - success (no update done or microcode was updated) */static int __reload_late(void *info){ int cpu = smp_processor_id(); enum ucode_state err; int ret = 0; /* * Wait for all CPUs to arrive. A load will not be attempted unless all * CPUs show up. * */ if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) return -1; /* * On an SMT system, it suffices to load the microcode on one sibling of * the core because the microcode engine is shared between the threads. * Synchronization still needs to take place so that no concurrent * loading attempts happen on multiple threads of an SMT core. See * below. */ if (cpumask_first(topology_sibling_cpumask(cpu)) == cpu) apply_microcode_local(&err); else goto wait_for_siblings; if (err >= UCODE_NFOUND) { if (err == UCODE_ERROR) pr_warn("Error reloading microcode on CPU %d\n", cpu); ret = -1; } wait_for_siblings: if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC)) panic("Timeout during microcode update!\n"); /* * At least one thread has completed update on each core. * For others, simply call the update to make sure the * per-cpu cpuinfo can be updated with right microcode * revision. */ if (cpumask_first(topology_sibling_cpumask(cpu)) != cpu) apply_microcode_local(&err); return ret;} /* * Reload microcode late on all CPUs. Wait for a sec until they * all gather together. */static int microcode_reload_late(void){ int ret; pr_err("Attempting late microcode loading - it is dangerous and taints the kernel.\n"); pr_err("You should switch to early loading, if possible.\n"); atomic_set(&late_cpus_in, 0); atomic_set(&late_cpus_out, 0);Lines 1–500 of 799. Load more
// SPDX-License-Identifier: GPL-2.0-or-later /* * CPU Microcode Update Driver for Linux * * Copyright (C) 2000-2006 Tigran Aivazian <aivazian.tigran@gmail.com> * 2006 Shaohua Li <shaohua.li@intel.com> * 2013-2016 Borislav Petkov <bp@alien8.de> * * X86 CPU microcode early update for Linux: * * Copyright (C) 2012 Fenghua Yu <fenghua.yu@intel.com> * H Peter Anvin" <hpa@zytor.com> * (C) 2015 Borislav Petkov <bp@alien8.de> * * This driver allows to upgrade microcode on x86 processors. */ #define pr_fmt(fmt) "microcode: " fmt #include <linux/platform_device.h> #include <linux/stop_machine.h> #include <linux/syscore_ops.h> #include <linux/miscdevice.h> #include <linux/capability.h> #include <linux/firmware.h> #include <linux/kernel.h> #include <linux/delay.h> #include <linux/mutex.h> #include <linux/cpu.h> #include <linux/nmi.h> #include <linux/fs.h> #include <linux/mm.h> #include <asm/microcode_intel.h> #include <asm/cpu_device_id.h> #include <asm/microcode_amd.h> #include <asm/perf_event.h> #include <asm/microcode.h> #include <asm/processor.h> #include <asm/cmdline.h> #include <asm/setup.h> #define DRIVER_VERSION "2.2" static struct microcode_ops *microcode_ops; static bool dis_ucode_ldr = true; bool initrd_gone; LIST_HEAD(microcode_cache); /* * Synchronization. * * All non cpu-hotplug-callback call sites use: * * - microcode_mutex to synchronize with each other; * - cpus_read_lock/unlock() to synchronize with * the cpu-hotplug-callback call sites. * * We guarantee that only a single cpu is being * updated at any particular moment of time. */ static DEFINE_MUTEX(microcode_mutex); struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; struct cpu_info_ctx { struct cpu_signature *cpu_sig; int err; }; /* * Those patch levels cannot be updated to newer ones and thus should be final. */ static u32 final_levels[] = { 0x01000098, 0x0100009f, 0x010000af, 0, /* T-101 terminator */ }; /* * Check the current patch level on this CPU. * * Returns: * - true: if update should stop * - false: otherwise */ static bool amd_check_current_patch_level(void) { u32 lvl, dummy, i; u32 *levels; native_rdmsr(MSR_AMD64_PATCH_LEVEL, lvl, dummy); if (IS_ENABLED(CONFIG_X86_32)) levels = (u32 *)__pa_nodebug(&final_levels); else levels = final_levels; for (i = 0; levels[i]; i++) { if (lvl == levels[i]) return true; } return false; } static bool __init check_loader_disabled_bsp(void) { static const char *__dis_opt_str = "dis_ucode_ldr"; #ifdef CONFIG_X86_32 const char *cmdline = (const char *)__pa_nodebug(boot_command_line); const char *option = (const char *)__pa_nodebug(__dis_opt_str); bool *res = (bool *)__pa_nodebug(&dis_ucode_ldr); #else /* CONFIG_X86_64 */ const char *cmdline = boot_command_line; const char *option = __dis_opt_str; bool *res = &dis_ucode_ldr; #endif /* * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not * completely accurate as xen pv guests don't see that CPUID bit set but * that's good enough as they don't land on the BSP path anyway. */ if (native_cpuid_ecx(1) & BIT(31)) return *res; if (x86_cpuid_vendor() == X86_VENDOR_AMD) { if (amd_check_current_patch_level()) return *res; } if (cmdline_find_option_bool(cmdline, option) <= 0) *res = false; return *res; } void __init load_ucode_bsp(void) { unsigned int cpuid_1_eax; bool intel = true; if (!have_cpuid_p()) return; cpuid_1_eax = native_cpuid_eax(1); switch (x86_cpuid_vendor()) { case X86_VENDOR_INTEL: if (x86_family(cpuid_1_eax) < 6) return; break; case X86_VENDOR_AMD: if (x86_family(cpuid_1_eax) < 0x10) return; intel = false; break; default: return; } if (check_loader_disabled_bsp()) return; if (intel) load_ucode_intel_bsp(); else load_ucode_amd_bsp(cpuid_1_eax); } static bool check_loader_disabled_ap(void) { #ifdef CONFIG_X86_32 return *((bool *)__pa_nodebug(&dis_ucode_ldr)); #else return dis_ucode_ldr; #endif } void load_ucode_ap(void) { unsigned int cpuid_1_eax; if (check_loader_disabled_ap()) return; cpuid_1_eax = native_cpuid_eax(1); switch (x86_cpuid_vendor()) { case X86_VENDOR_INTEL: if (x86_family(cpuid_1_eax) >= 6) load_ucode_intel_ap(); break; case X86_VENDOR_AMD: if (x86_family(cpuid_1_eax) >= 0x10) load_ucode_amd_ap(cpuid_1_eax); break; default: break; } } static int __init save_microcode_in_initrd(void) { struct cpuinfo_x86 *c = &boot_cpu_data; int ret = -EINVAL; switch (c->x86_vendor) { case X86_VENDOR_INTEL: if (c->x86 >= 6) ret = save_microcode_in_initrd_intel(); break; case X86_VENDOR_AMD: if (c->x86 >= 0x10) ret = save_microcode_in_initrd_amd(cpuid_eax(1)); break; default: break; } initrd_gone = true; return ret; } struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa) { #ifdef CONFIG_BLK_DEV_INITRD unsigned long start = 0; size_t size; #ifdef CONFIG_X86_32 struct boot_params *params; if (use_pa) params = (struct boot_params *)__pa_nodebug(&boot_params); else params = &boot_params; size = params->hdr.ramdisk_size; /* * Set start only if we have an initrd image. We cannot use initrd_start * because it is not set that early yet. */ if (size) start = params->hdr.ramdisk_image; # else /* CONFIG_X86_64 */ size = (unsigned long)boot_params.ext_ramdisk_size << 32; size |= boot_params.hdr.ramdisk_size; if (size) { start = (unsigned long)boot_params.ext_ramdisk_image << 32; start |= boot_params.hdr.ramdisk_image; start += PAGE_OFFSET; } # endif /* * Fixup the start address: after reserve_initrd() runs, initrd_start * has the virtual address of the beginning of the initrd. It also * possibly relocates the ramdisk. In either case, initrd_start contains * the updated address so use that instead. * * initrd_gone is for the hotplug case where we've thrown out initrd * already. */ if (!use_pa) { if (initrd_gone) return (struct cpio_data){ NULL, 0, "" }; if (initrd_start) start = initrd_start; } else { /* * The picture with physical addresses is a bit different: we * need to get the *physical* address to which the ramdisk was * relocated, i.e., relocated_ramdisk (not initrd_start) and * since we're running from physical addresses, we need to access * relocated_ramdisk through its *physical* address too. */ u64 *rr = (u64 *)__pa_nodebug(&relocated_ramdisk); if (*rr) start = *rr; } return find_cpio_data(path, (void *)start, size, NULL); #else /* !CONFIG_BLK_DEV_INITRD */ return (struct cpio_data){ NULL, 0, "" }; #endif } void reload_early_microcode(void) { int vendor, family; vendor = x86_cpuid_vendor(); family = x86_cpuid_family(); switch (vendor) { case X86_VENDOR_INTEL: if (family >= 6) reload_ucode_intel(); break; case X86_VENDOR_AMD: if (family >= 0x10) reload_ucode_amd(); break; default: break; } } static void collect_cpu_info_local(void *arg) { struct cpu_info_ctx *ctx = arg; ctx->err = microcode_ops->collect_cpu_info(smp_processor_id(), ctx->cpu_sig); } static int collect_cpu_info_on_target(int cpu, struct cpu_signature *cpu_sig) { struct cpu_info_ctx ctx = { .cpu_sig = cpu_sig, .err = 0 }; int ret; ret = smp_call_function_single(cpu, collect_cpu_info_local, &ctx, 1); if (!ret) ret = ctx.err; return ret; } static int collect_cpu_info(int cpu) { struct ucode_cpu_info *uci = ucode_cpu_info + cpu; int ret; memset(uci, 0, sizeof(*uci)); ret = collect_cpu_info_on_target(cpu, &uci->cpu_sig); if (!ret) uci->valid = 1; return ret; } static void apply_microcode_local(void *arg) { enum ucode_state *err = arg; *err = microcode_ops->apply_microcode(smp_processor_id()); } static int apply_microcode_on_target(int cpu) { enum ucode_state err; int ret; ret = smp_call_function_single(cpu, apply_microcode_local, &err, 1); if (!ret) { if (err == UCODE_ERROR) ret = 1; } return ret; } /* fake device for request_firmware */ static struct platform_device *microcode_pdev; #ifdef CONFIG_MICROCODE_LATE_LOADING /* * Late loading dance. Why the heavy-handed stomp_machine effort? * * - HT siblings must be idle and not execute other code while the other sibling * is loading microcode in order to avoid any negative interactions caused by * the loading. * * - In addition, microcode update on the cores must be serialized until this * requirement can be relaxed in the future. Right now, this is conservative * and good. */ #define SPINUNIT 100 /* 100 nsec */ static int check_online_cpus(void) { unsigned int cpu; /* * Make sure all CPUs are online. It's fine for SMT to be disabled if * all the primary threads are still online. */ for_each_present_cpu(cpu) { if (topology_is_primary_thread(cpu) && !cpu_online(cpu)) { pr_err("Not all CPUs online, aborting microcode update.\n"); return -EINVAL; } } return 0; } static atomic_t late_cpus_in; static atomic_t late_cpus_out; static int __wait_for_cpus(atomic_t *t, long long timeout) { int all_cpus = num_online_cpus(); atomic_inc(t); while (atomic_read(t) < all_cpus) { if (timeout < SPINUNIT) { pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n", all_cpus - atomic_read(t)); return 1; } ndelay(SPINUNIT); timeout -= SPINUNIT; touch_nmi_watchdog(); } return 0; } /* * Returns: * < 0 - on error * 0 - success (no update done or microcode was updated) */ static int __reload_late(void *info) { int cpu = smp_processor_id(); enum ucode_state err; int ret = 0; /* * Wait for all CPUs to arrive. A load will not be attempted unless all * CPUs show up. * */ if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) return -1; /* * On an SMT system, it suffices to load the microcode on one sibling of * the core because the microcode engine is shared between the threads. * Synchronization still needs to take place so that no concurrent * loading attempts happen on multiple threads of an SMT core. See * below. */ if (cpumask_first(topology_sibling_cpumask(cpu)) == cpu) apply_microcode_local(&err); else goto wait_for_siblings; if (err >= UCODE_NFOUND) { if (err == UCODE_ERROR) pr_warn("Error reloading microcode on CPU %d\n", cpu); ret = -1; } wait_for_siblings: if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC)) panic("Timeout during microcode update!\n"); /* * At least one thread has completed update on each core. * For others, simply call the update to make sure the * per-cpu cpuinfo can be updated with right microcode * revision. */ if (cpumask_first(topology_sibling_cpumask(cpu)) != cpu) apply_microcode_local(&err); return ret; } /* * Reload microcode late on all CPUs. Wait for a sec until they * all gather together. */ static int microcode_reload_late(void) { int ret; pr_err("Attempting late microcode loading - it is dangerous and taints the kernel.\n"); pr_err("You should switch to early loading, if possible.\n"); atomic_set(&late_cpus_in, 0); atomic_set(&late_cpus_out, 0);