x86/microcode: enable which microcode to build into the kernel

Using the x86 microcode updater requires users to go and extend
the the configuration manually. We can help with this possibly
error prone process for firmware present on linux-firmware and
allow users to select which firmware they want to build into the
kernel. This is possible given there isn't many files to support
for microcode updates.

This will also allow us to use these to test the kernel's built
in firmware support by using these known target blobs. Since
the actual built-in files are by default empty, this should
make it clear why perhaps we should disable this feature by
default, as doing so will save just a few bytes from the final
kernel build, and disables this functionality all together.

Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>

9 files changed, 153 insertions, 23 deletions

diff --git a/Documentation/x86/microcode.rst b/Documentation/x86/microcode.rst
index 7aa9c86b2868e..ba4dbd12a0bb2 100644
--- a/Documentation/x86/microcode.rst
+++ b/Documentation/x86/microcode.rst
@@ -6,6 +6,7 @@ The Linux Microcode Loader
 
 :Authors: - Fenghua Yu <fenghua.yu@intel.com>
           - Borislav Petkov <bp@suse.de>
+          - Luis Chamberlain <mcgrof@kernel.org>
 
 The kernel has a x86 microcode loading facility which is supposed to
 provide microcode loading methods in the OS. Potential use cases are
@@ -114,29 +115,39 @@ Builtin microcode
 =================
 
 The loader supports also loading of a builtin microcode supplied through
-the regular builtin firmware method using CONFIG_FW_LOADER_BUILTIN and
-CONFIG_FW_LOADER_BUILTIN_FILES. Only 64-bit is currently supported.
+the regular builtin firmware. The respective CPU loader will only look
+for the appropriate microcode for its respective CPU family.
 
-Here's an example::
+To help assist users with support for this all x86 microcode which is present
+on the linux-firmware git repository can be enabled to be built into the kernel
+using 'make menuconfig'. Although the loader has support to update microcode for
+Intel and AMD processors, only AMD microcode is present on the linux-firmware
+tree at this time, as such you can only take advatange of this if on AMD
+processors. If using Intel processors you wil have to extend the kconfig
+symbol CONFIG_FW_LOADER_BUILTIN_FILES manually at configuration time.
 
-  CONFIG_FW_LOADER_BUILTIN=y
-  CONFIG_FW_LOADER_BUILTIN_FILES="intel-ucode/06-3a-09 amd-ucode/microcode_amd_fam15h.bin"
-  CONFIG_FW_LOADER_BUILTIN_DIR="/lib/firmware"
-
-This basically means, you have the following tree structure locally::
+If using AMD processors you can select which processor family you want to
+provide support for. For instance
 
-  /lib/firmware/
-  |-- amd-ucode
-  ...
-  |   |-- microcode_amd_fam15h.bin
-  ...
-  |-- intel-ucode
-  ...
-  |   |-- 06-3a-09
-  ...
+Here's an example of enabling all AMD microcode to be built into the kernel::
 
-so that the build system can find those files and integrate them into
-the final kernel image. The early loader finds them and applies them.
+  CONFIG_FW_LOADER_BUILTIN=y
+  CONFIG_FW_LOADER_BUILTIN_FILES=""
+  CONFIG_FW_LOADER_BUILTIN_DIR="/lib/firmware"
+  CONFIG_MICROCODE_BUILTIN=y
+  CONFIG_MICROCODE_INTEL=y
+  CONFIG_MICROCODE_AMD=y
+  CONFIG_MICROCODE_BUILTIN_AMD=y
+  CONFIG_MICROCODE_BUILTIN_AMD_DIR="amd-ucode"
+  CONFIG_MICROCODE_BUILTIN_AMD_10H_14H=y
+  CONFIG_MICROCODE_BUILTIN_AMD_15H=y
+  CONFIG_MICROCODE_BUILTIN_AMD_16H=y
+  CONFIG_MICROCODE_BUILTIN_AMD_17H=y
+
+Under this configuration you will have all the latest and greatest
+microcode from linux-firmware available on /lib/firmware.
+
+If using Intel processors adjust CONFIG_FW_LOADER_BUILTIN_FILES manually.
 
 Needless to say, this method is not the most flexible one because it
 requires rebuilding the kernel each time updated microcode from the CPU
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 60eae188ebe07..ee6fa3ba1d3f1 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1303,9 +1303,24 @@ config MICROCODE
 	  CONFIG_BLK_DEV_INITRD in order for the loader to be able to scan the
 	  initrd for microcode blobs.
 
-	  In addition, you can build the microcode into the kernel. For that you
-	  need to add the vendor-supplied microcode to the configuration option
-	  CONFIG_FW_LOADER_BUILTIN_FILES
+config MICROCODE_BUILTIN
+	bool "CPU microcode update using built-in firmware"
+	default y
+	depends on MICROCODE
+	help
+	  If you say Y here, you will be able to use the kernel's builtin
+	  firmware functionality to try to update your CPU's microcode.
+	  Disabling this will disallow this functionality from your kernel.
+	  If enabled you will also be allowed to also select microcode to
+	  build into the kernel for microcode present on the linux-firmare
+	  git tree. If microcode files are not present on linux-firmware
+	  you will have to manually augment the out of tree vendor-supplied
+	  microcode to the configuration option CONFIG_FW_LOADER_BUILTIN_FILES.
+	  Currently only AMD provides updates to microcode into the
+	  linux-firmware git tree.
+
+	  You should say N here if you are not actually going to use this
+	  functionality.
 
 config MICROCODE_INTEL
 	bool "Intel microcode loading support"
@@ -1326,6 +1341,75 @@ config MICROCODE_AMD
 	  If you select this option, microcode patch loading support for AMD
 	  processors will be enabled.
 
+if MICROCODE_BUILTIN
+
+config MICROCODE_BUILTIN_AMD
+	bool "Enable you to select AMD microcode to build into the kernel"
+	depends on MICROCODE_AMD
+	default y
+
+config MICROCODE_BUILTIN_AMD_DIR
+	string
+	depends on MICROCODE_BUILTIN_AMD
+	default "amd-ucode"
+
+config MICROCODE_BUILTIN_AMD_10H_14H
+	bool "Build in microcode for AMD Families 10h ~ 14h Processors"
+	depends on MICROCODE_BUILTIN_AMD
+	help
+	  If enabled at build time we will look inside the directory
+	  CONFIG_FW_LOADER_BUILTIN_DIR/CONFIG_MICROCODE_BUILTIN_AMD_DIR/
+	  microcode_amd.bin which is used for updating the microcode to the
+	  AMD Families 10h ~ 14h Processors. Enabling this does not mean the
+	  microcode updater will use this file, it just means that your kernel
+	  will have support to allow the microcode update code to use this file
+	  from the kernel if the microcode update code decides this is the
+	  right file for your CPU.
+	  The file is expected to have md5sum: 55ae79b82cbfddcf7142058be3c9ec2d
+
+config MICROCODE_BUILTIN_AMD_15H
+	bool "Build in microcode for AMD Families 15h Processors"
+	depends on MICROCODE_BUILTIN_AMD
+	help
+	  If enabled at build time we will look inside the directory
+	  CONFIG_FW_LOADER_BUILTIN_DIR/CONFIG_MICROCODE_BUILTIN_AMD_DIR/
+	  microcode_amd_fam15h.bin which is used for updating the microcode to
+	  the AMD Families 15h Processors. Enabling this does not mean the
+	  microcode updater will use this file, it just means that your kernel
+	  will have support to allow the microcode update code to use this file
+	  from the kernel if the microcode update code decides this is the
+	  right file for your CPU.
+	  The file is expected to have md5sum: 3bdedb4466186a79c469f62120f6d7bb
+
+config MICROCODE_BUILTIN_AMD_16H
+	bool "Build in microcode for AMD Families 16h Processors"
+	depends on MICROCODE_BUILTIN_AMD
+	help
+	  If enabled at build time we will look inside the directory
+	  CONFIG_FW_LOADER_BUILTIN_DIR/CONFIG_MICROCODE_BUILTIN_AMD_DIR/
+	  microcode_amd_fam16h.bin which is used for updating the microcode to
+	  the AMD Families 16h Processors. Enabling this does not mean the
+	  microcode updater will use this file, it just means that your kernel
+	  will have support to allow the microcode update code to use this file
+	  from the kernel if the microcode update code decides this is the
+	  right file for your CPU.
+	  The file is expected to have md5sum: 6a47a6393c52ddfc0b5b044efc076a77
+
+config MICROCODE_BUILTIN_AMD_17H
+	bool "Build in microcode for AMD Families 17h Processors"
+	depends on MICROCODE_BUILTIN_AMD
+	help
+	  If enabled at build time we will look inside the directory
+	  CONFIG_FW_LOADER_BUILTIN_DIR/CONFIG_MICROCODE_BUILTIN_AMD_DIR/
+	  microcode_amd_fam17h.bin which is used for updating the microcode to
+	  the AMD Families 17h Processors. Enabling this does not mean the
+	  microcode updater will use this file, it just means that your kernel
+	  will have support to allow the microcode update code to use this file
+	  from the kernel if the microcode update code decides this is the
+	  right file for your CPU.
+	  The file is expected to have md5sum: 60f18b6d7fa3d1231b27cc339c173c8c
+endif
+
 config MICROCODE_OLD_INTERFACE
 	bool "Ancient loading interface (DEPRECATED)"
 	default n
diff --git a/arch/x86/kernel/cpu/microcode/Makefile b/arch/x86/kernel/cpu/microcode/Makefile
index 34098d48c48fc..39b7160a88d76 100644
--- a/arch/x86/kernel/cpu/microcode/Makefile
+++ b/arch/x86/kernel/cpu/microcode/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 microcode-y				:= core.o
 obj-$(CONFIG_MICROCODE)			+= microcode.o
+obj-$(CONFIG_MICROCODE_BUILTIN)		+= builtin/
 microcode-$(CONFIG_MICROCODE_INTEL)	+= intel.o
 microcode-$(CONFIG_MICROCODE_AMD)	+= amd.o
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index fef1eea2f557b..689f37b5ffd87 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -454,6 +454,7 @@ apply_microcode_early_amd(u32 cpuid_1_eax, void *ucode, size_t size, bool save_p
 	return ret;
 }
 
+#ifdef MICROCODE_BUILTIN
 static bool get_builtin_microcode(struct cpio_data *cp, unsigned int family)
 {
 	char fw_name[36] = "amd-ucode/microcode_amd.bin";
@@ -474,6 +475,12 @@ static bool get_builtin_microcode(struct cpio_data *cp, unsigned int family)
 
 	return false;
 }
+#else
+static bool get_builtin_microcode(struct cpio_data *cp, unsigned int family)
+{
+	return false;
+}
+#endif
 
 static void __load_ucode_amd(unsigned int cpuid_1_eax, struct cpio_data *ret)
 {
diff --git a/arch/x86/kernel/cpu/microcode/builtin/Makefile b/arch/x86/kernel/cpu/microcode/builtin/Makefile
new file mode 100644
index 0000000000000..906a1ba95fc06
--- /dev/null
+++ b/arch/x86/kernel/cpu/microcode/builtin/Makefile
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_MICROCODE_BUILTIN_AMD) += amd/
diff --git a/arch/x86/kernel/cpu/microcode/builtin/amd/.gitignore b/arch/x86/kernel/cpu/microcode/builtin/amd/.gitignore
new file mode 100644
index 0000000000000..1d46553f50a09
--- /dev/null
+++ b/arch/x86/kernel/cpu/microcode/builtin/amd/.gitignore
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+*.gen.S
+*.bin
diff --git a/arch/x86/kernel/cpu/microcode/builtin/amd/Makefile b/arch/x86/kernel/cpu/microcode/builtin/amd/Makefile
new file mode 100644
index 0000000000000..6543070b816a7
--- /dev/null
+++ b/arch/x86/kernel/cpu/microcode/builtin/amd/Makefile
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0
+include $(srctree)/drivers/base/firmware_loader/builtin/lib.Makefile
+
+microcode-builtin-y :=
+microcode-builtin-$(CONFIG_MICROCODE_BUILTIN_AMD_10H_14H) += microcode_amd.bin
+microcode-builtin-$(CONFIG_MICROCODE_BUILTIN_AMD_15H) += microcode_amd_fam15h.bin
+microcode-builtin-$(CONFIG_MICROCODE_BUILTIN_AMD_16H) += microcode_amd_fam16h.bin
+microcode-builtin-$(CONFIG_MICROCODE_BUILTIN_AMD_17H) += microcode_amd_fam17h.bin
+
+microcode-builtin-y := $(addprefix $(CONFIG_MICROCODE_BUILTIN_AMD_DIR)/,$(microcode-builtin-y))
+
+fwdir := $(subst $(quote),,$(CONFIG_FW_LOADER_BUILTIN_DIR))
+fwdir := $(addprefix $(srctree)/,$(filter-out /%,$(fwdir)))$(filter /%,$(fwdir))
+
+firmware  := $(addsuffix .gen.o, $(subst $(quote),,$(microcode-builtin-y)))
+obj-y += $(firmware)
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 93ef374ec5f78..784de969edee8 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -453,6 +453,7 @@ static void save_mc_for_early(struct ucode_cpu_info *uci, u8 *mc, unsigned int s
 	mutex_unlock(&x86_cpu_microcode_mutex);
 }
 
+#ifdef MICROCODE_BUILTIN
 static bool load_builtin_intel_microcode(struct cpio_data *cp)
 {
 	unsigned int eax = 1, ebx, ecx = 0, edx;
@@ -475,6 +476,12 @@ static bool load_builtin_intel_microcode(struct cpio_data *cp)
 
 	return false;
 }
+#else
+static bool load_builtin_intel_microcode(struct cpio_data *cp)
+{
+	return false;
+}
+#endif
 
 /*
  * Print ucode update info.
diff --git a/drivers/base/firmware_loader/builtin/Makefile b/drivers/base/firmware_loader/builtin/Makefile
index baad7777974b3..9b0dc193f6c7f 100644
--- a/drivers/base/firmware_loader/builtin/Makefile
+++ b/drivers/base/firmware_loader/builtin/Makefile
@@ -2,7 +2,6 @@
 include $(srctree)/drivers/base/firmware_loader/builtin/lib.Makefile
 
 obj-y  += main.o
-obj-$(CONFIG_TEST_BUILTIN_FIRMWARE)  += test-builtin-firmware.bin.gen.o
 
 # Create $(fwdir) from $(CONFIG_FW_LOADER_BUILTIN_DIR) -- if it doesn't have a
 # leading /, it's relative to $(srctree).