[PATCH 0/8] x86/microcode: Address GNR errata and follow-up

[Chang S. Bae]

Dear x86 maintainers,

We recently found a couple of microcode loading issues [1]. This series
addresses them from both short-term and long-term perspectives.

It would be much appreciated if the short-term, one-off fix (patch1)
could be sorted out first to allow backporting.

== Issue Summary ==

As background, the minimum revision check was introduced by commit
cf5ab01c8703 ("x86/microcode/intel: Add a minimum required revision for
late loading"). It was originally intended to address changes visible to
software at runtime, and has therefore been limited to the late loading
path.

The two errata are essentially about dependencies between microcode
revisions:

 1 GNR98 involves a dependency on an older revision 0x1000405, which
   contains internal changes required by subsequent revisions. Since this
   is not an OS-visible change, the dependency applies to both early and
   late loading. The minimum revision check only applies to late loading.

 2 GNR101 describes an incorrect minimum revision value in revision
   0x1000423, in spite of the same dependency on 0x1000405. The
   late-loading minimum revision check does not prevent 0x1000423 from
   being loaded directly on an older revision.

== Short-term Remedy ==

There are therefore gaps in both boot-time and runtime loading. The
one-off short-term fix is to reject the problematic loading cases on both
paths.

With this change, systems running an older revision need to update
firmware. See `FIT Microcode Update` in [2]. There may be other ways to
deploy the required update more efficiently, but those are outside the
scope of this kernel patch series.

== Long-term Direction ==

The issues above also raise a couple of questions for the longer term.

 1 How can we address microcode dependencies during early loading?

   The minimum revision information can serve as a more general revision
   dependency check, rather than being limited to runtime changes. The
   series applies the minimum revision checker for early loading
   (patch5-6).

 2 Can we do better for late loading?

   Looking at Intel microcode releases [3], the repository traditionally
   provides the latest blob. When updating from an older revision, admins
   may need to retrieve prerequisite older revisions from the git
   history. This can be inefficient and error-prone.

   Intel will now concatenate prerequisite older blobs with the latest
   blob together into a multi-blob image. The kernel, however, currently
   selects the highest loadable revision, or at best one prerequisite
   when the minimum revision check is enforced. Admins may need to
   trigger multiple loads manually.

   Instead the kernel loader can facilitate iterative loading to apply
   the available blobs incrementally. There are some possible ways to
   implement this.

   One is to rely on the minimum revision check and select the highest
   revision whose prerequisite has been loaded already. Another is to
   load the blobs sequentially according to the order in the image.

   Both approaches have drawbacks: the former depends on the minimum
   revision information being correct, while the latter is sensitive to
   blob ordering.

   The approach here selects the lowest loadable revision on each
   iteration, so that the blobs to be applied incrementally (patch7-8).

== Patch Set ==

The series started as a single patch to block the problematic loading
cases. It was then expanded to address the underlying gaps in early and
late loading, with some fixes along the way.

  Part1, patch1: One-off fix to reject the errata loading cases
  Part2, patch2-4: Preparatory fixes
  Part3, patch5-6: Early loading: apply minimum revision check
  Part4, patch7-8: Late loading: support iterative loading

== Tests ==

Andrew helped providing useful scripts to concatenate blobs from the
repository [3] into a test image. Thanks! I could grab one production
system and test changed paths with the concatenated test image.

The patch set is available in this repository:
 git://github.com/intel-staging/microcode.git gnr-errata-followup-v1

Thanks,
Chang

[1] https://edc.intel.com/content/www/jp/ja/design/products-and-solutions/processors-and-chipsets/birch-stream/xeon-6900-6700-6500-series-processors-with-p-cores-specification-update/016US/errata-summary-table/

   GNR98. MCE When Early OS Microcode Update to MCU 0x1000405 Release or Later
   Problem: The 0x1000405 microcode release introduced changes to the
   inter-microcode communication interface that are incompatible with
   prior versions.

   GNR101. Incorrect Minimum Runtime Microcode Update Revision in 0x1000423 Release
   Problem: The 0x1000423 microcode release does not correctly set the
   Minimum Runtime Microcode Update Revision, document number 783834, ID
   in the microcode header to reference the 0x1000405 release.

[2] Microcode Update Guidance
    https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/microcode-update-guidance.html

[3] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files.git

Chang S. Bae (8):
  x86/microcode/intel: Reject problematic loading on GNR systems
  x86/microcode: Solidify base_rev= option parsing
  x86/microcode: Accept a boolean for force_minrev parameter
  x86/microcode: Mark early_data __initdata
  x86/microcode: Decouple minimum revision check from late loading
  x86/microcode/intel: Apply minimum revision check to early loading
  x86/microcode: Introduce iterative late loading
  x86/microcode/intel: Select the lowest loadable revision for iterative
    loading

 .../admin-guide/kernel-parameters.txt         |  11 +-
 arch/x86/Kconfig                              |  31 +++--
 arch/x86/kernel/cpu/microcode/amd.c           |  11 +-
 arch/x86/kernel/cpu/microcode/core.c          |  86 ++++++++++++--
 arch/x86/kernel/cpu/microcode/intel.c         | 110 ++++++++++++++----
 arch/x86/kernel/cpu/microcode/internal.h      |   2 +
 6 files changed, 202 insertions(+), 49 deletions(-)


base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.53.0