Avoid beyond bounds copy while caching ACL
[zen-stable.git] / arch / x86 / kernel / microcode_amd.c
blob8a2ce8fd41c0e68bbedc6fce685fb52c95502d24
1 /*
2 * AMD CPU Microcode Update Driver for Linux
3 * Copyright (C) 2008-2011 Advanced Micro Devices Inc.
5 * Author: Peter Oruba <peter.oruba@amd.com>
7 * Based on work by:
8 * Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
10 * Maintainers:
11 * Andreas Herrmann <andreas.herrmann3@amd.com>
12 * Borislav Petkov <borislav.petkov@amd.com>
14 * This driver allows to upgrade microcode on F10h AMD
15 * CPUs and later.
17 * Licensed under the terms of the GNU General Public
18 * License version 2. See file COPYING for details.
21 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
23 #include <linux/firmware.h>
24 #include <linux/pci_ids.h>
25 #include <linux/uaccess.h>
26 #include <linux/vmalloc.h>
27 #include <linux/kernel.h>
28 #include <linux/module.h>
29 #include <linux/pci.h>
31 #include <asm/microcode.h>
32 #include <asm/processor.h>
33 #include <asm/msr.h>
35 MODULE_DESCRIPTION("AMD Microcode Update Driver");
36 MODULE_AUTHOR("Peter Oruba");
37 MODULE_LICENSE("GPL v2");
39 #define UCODE_MAGIC 0x00414d44
40 #define UCODE_EQUIV_CPU_TABLE_TYPE 0x00000000
41 #define UCODE_UCODE_TYPE 0x00000001
43 struct equiv_cpu_entry {
44 u32 installed_cpu;
45 u32 fixed_errata_mask;
46 u32 fixed_errata_compare;
47 u16 equiv_cpu;
48 u16 res;
49 } __attribute__((packed));
51 struct microcode_header_amd {
52 u32 data_code;
53 u32 patch_id;
54 u16 mc_patch_data_id;
55 u8 mc_patch_data_len;
56 u8 init_flag;
57 u32 mc_patch_data_checksum;
58 u32 nb_dev_id;
59 u32 sb_dev_id;
60 u16 processor_rev_id;
61 u8 nb_rev_id;
62 u8 sb_rev_id;
63 u8 bios_api_rev;
64 u8 reserved1[3];
65 u32 match_reg[8];
66 } __attribute__((packed));
68 struct microcode_amd {
69 struct microcode_header_amd hdr;
70 unsigned int mpb[0];
73 #define SECTION_HDR_SIZE 8
74 #define CONTAINER_HDR_SZ 12
76 static struct equiv_cpu_entry *equiv_cpu_table;
78 /* page-sized ucode patch buffer */
79 void *patch;
81 static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig)
83 struct cpuinfo_x86 *c = &cpu_data(cpu);
85 csig->rev = c->microcode;
86 pr_info("CPU%d: patch_level=0x%08x\n", cpu, csig->rev);
88 return 0;
91 static unsigned int verify_ucode_size(int cpu, u32 patch_size,
92 unsigned int size)
94 struct cpuinfo_x86 *c = &cpu_data(cpu);
95 u32 max_size;
97 #define F1XH_MPB_MAX_SIZE 2048
98 #define F14H_MPB_MAX_SIZE 1824
99 #define F15H_MPB_MAX_SIZE 4096
101 switch (c->x86) {
102 case 0x14:
103 max_size = F14H_MPB_MAX_SIZE;
104 break;
105 case 0x15:
106 max_size = F15H_MPB_MAX_SIZE;
107 break;
108 default:
109 max_size = F1XH_MPB_MAX_SIZE;
110 break;
113 if (patch_size > min_t(u32, size, max_size)) {
114 pr_err("patch size mismatch\n");
115 return 0;
118 return patch_size;
121 static u16 find_equiv_id(void)
123 unsigned int current_cpu_id, i = 0;
125 BUG_ON(equiv_cpu_table == NULL);
127 current_cpu_id = cpuid_eax(0x00000001);
129 while (equiv_cpu_table[i].installed_cpu != 0) {
130 if (current_cpu_id == equiv_cpu_table[i].installed_cpu)
131 return equiv_cpu_table[i].equiv_cpu;
133 i++;
135 return 0;
139 * we signal a good patch is found by returning its size > 0
141 static int get_matching_microcode(int cpu, const u8 *ucode_ptr,
142 unsigned int leftover_size, int rev,
143 unsigned int *current_size)
145 struct microcode_header_amd *mc_hdr;
146 unsigned int actual_size;
147 u16 equiv_cpu_id;
149 /* size of the current patch we're staring at */
150 *current_size = *(u32 *)(ucode_ptr + 4) + SECTION_HDR_SIZE;
152 equiv_cpu_id = find_equiv_id();
153 if (!equiv_cpu_id)
154 return 0;
157 * let's look at the patch header itself now
159 mc_hdr = (struct microcode_header_amd *)(ucode_ptr + SECTION_HDR_SIZE);
161 if (mc_hdr->processor_rev_id != equiv_cpu_id)
162 return 0;
164 /* ucode might be chipset specific -- currently we don't support this */
165 if (mc_hdr->nb_dev_id || mc_hdr->sb_dev_id) {
166 pr_err("CPU%d: chipset specific code not yet supported\n",
167 cpu);
168 return 0;
171 if (mc_hdr->patch_id <= rev)
172 return 0;
175 * now that the header looks sane, verify its size
177 actual_size = verify_ucode_size(cpu, *current_size, leftover_size);
178 if (!actual_size)
179 return 0;
181 /* clear the patch buffer */
182 memset(patch, 0, PAGE_SIZE);
184 /* all looks ok, get the binary patch */
185 get_ucode_data(patch, ucode_ptr + SECTION_HDR_SIZE, actual_size);
187 return actual_size;
190 static int apply_microcode_amd(int cpu)
192 u32 rev, dummy;
193 int cpu_num = raw_smp_processor_id();
194 struct ucode_cpu_info *uci = ucode_cpu_info + cpu_num;
195 struct microcode_amd *mc_amd = uci->mc;
196 struct cpuinfo_x86 *c = &cpu_data(cpu);
198 /* We should bind the task to the CPU */
199 BUG_ON(cpu_num != cpu);
201 if (mc_amd == NULL)
202 return 0;
204 wrmsrl(MSR_AMD64_PATCH_LOADER, (u64)(long)&mc_amd->hdr.data_code);
205 /* get patch id after patching */
206 rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
208 /* check current patch id and patch's id for match */
209 if (rev != mc_amd->hdr.patch_id) {
210 pr_err("CPU%d: update failed for patch_level=0x%08x\n",
211 cpu, mc_amd->hdr.patch_id);
212 return -1;
215 pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev);
216 uci->cpu_sig.rev = rev;
217 c->microcode = rev;
219 return 0;
222 static int install_equiv_cpu_table(const u8 *buf)
224 unsigned int *ibuf = (unsigned int *)buf;
225 unsigned int type = ibuf[1];
226 unsigned int size = ibuf[2];
228 if (type != UCODE_EQUIV_CPU_TABLE_TYPE || !size) {
229 pr_err("empty section/"
230 "invalid type field in container file section header\n");
231 return -EINVAL;
234 equiv_cpu_table = vmalloc(size);
235 if (!equiv_cpu_table) {
236 pr_err("failed to allocate equivalent CPU table\n");
237 return -ENOMEM;
240 get_ucode_data(equiv_cpu_table, buf + CONTAINER_HDR_SZ, size);
242 /* add header length */
243 return size + CONTAINER_HDR_SZ;
246 static void free_equiv_cpu_table(void)
248 vfree(equiv_cpu_table);
249 equiv_cpu_table = NULL;
252 static enum ucode_state
253 generic_load_microcode(int cpu, const u8 *data, size_t size)
255 struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
256 struct microcode_header_amd *mc_hdr = NULL;
257 unsigned int mc_size, leftover, current_size = 0;
258 int offset;
259 const u8 *ucode_ptr = data;
260 void *new_mc = NULL;
261 unsigned int new_rev = uci->cpu_sig.rev;
262 enum ucode_state state = UCODE_ERROR;
264 offset = install_equiv_cpu_table(ucode_ptr);
265 if (offset < 0) {
266 pr_err("failed to create equivalent cpu table\n");
267 goto out;
269 ucode_ptr += offset;
270 leftover = size - offset;
272 if (*(u32 *)ucode_ptr != UCODE_UCODE_TYPE) {
273 pr_err("invalid type field in container file section header\n");
274 goto free_table;
277 while (leftover) {
278 mc_size = get_matching_microcode(cpu, ucode_ptr, leftover,
279 new_rev, &current_size);
280 if (mc_size) {
281 mc_hdr = patch;
282 new_mc = patch;
283 new_rev = mc_hdr->patch_id;
284 goto out_ok;
287 ucode_ptr += current_size;
288 leftover -= current_size;
291 if (!new_mc) {
292 state = UCODE_NFOUND;
293 goto free_table;
296 out_ok:
297 uci->mc = new_mc;
298 state = UCODE_OK;
299 pr_debug("CPU%d update ucode (0x%08x -> 0x%08x)\n",
300 cpu, uci->cpu_sig.rev, new_rev);
302 free_table:
303 free_equiv_cpu_table();
305 out:
306 return state;
310 * AMD microcode firmware naming convention, up to family 15h they are in
311 * the legacy file:
313 * amd-ucode/microcode_amd.bin
315 * This legacy file is always smaller than 2K in size.
317 * Starting at family 15h they are in family specific firmware files:
319 * amd-ucode/microcode_amd_fam15h.bin
320 * amd-ucode/microcode_amd_fam16h.bin
321 * ...
323 * These might be larger than 2K.
325 static enum ucode_state request_microcode_amd(int cpu, struct device *device)
327 char fw_name[36] = "amd-ucode/microcode_amd.bin";
328 const struct firmware *fw;
329 enum ucode_state ret = UCODE_NFOUND;
330 struct cpuinfo_x86 *c = &cpu_data(cpu);
332 if (c->x86 >= 0x15)
333 snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
335 if (request_firmware(&fw, (const char *)fw_name, device)) {
336 pr_err("failed to load file %s\n", fw_name);
337 goto out;
340 ret = UCODE_ERROR;
341 if (*(u32 *)fw->data != UCODE_MAGIC) {
342 pr_err("invalid magic value (0x%08x)\n", *(u32 *)fw->data);
343 goto fw_release;
346 ret = generic_load_microcode(cpu, fw->data, fw->size);
348 fw_release:
349 release_firmware(fw);
351 out:
352 return ret;
355 static enum ucode_state
356 request_microcode_user(int cpu, const void __user *buf, size_t size)
358 return UCODE_ERROR;
361 static void microcode_fini_cpu_amd(int cpu)
363 struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
365 uci->mc = NULL;
368 static struct microcode_ops microcode_amd_ops = {
369 .request_microcode_user = request_microcode_user,
370 .request_microcode_fw = request_microcode_amd,
371 .collect_cpu_info = collect_cpu_info_amd,
372 .apply_microcode = apply_microcode_amd,
373 .microcode_fini_cpu = microcode_fini_cpu_amd,
376 struct microcode_ops * __init init_amd_microcode(void)
378 struct cpuinfo_x86 *c = &cpu_data(0);
380 if (c->x86_vendor != X86_VENDOR_AMD || c->x86 < 0x10) {
381 pr_warning("AMD CPU family 0x%x not supported\n", c->x86);
382 return NULL;
385 patch = (void *)get_zeroed_page(GFP_KERNEL);
386 if (!patch)
387 return NULL;
389 return &microcode_amd_ops;
392 void __exit exit_amd_microcode(void)
394 free_page((unsigned long)patch);