Blame SOURCES/check_caveats

539655
#! /bin/bash -eu
539655
539655
# Script for checking various microcode caveats
539655
#
539655
#
539655
# SPDX-License-Identifier: CC0-1.0
539655
539655
: ${MC_CAVEATS_DATA_DIR=/usr/share/microcode_ctl/ucode_with_caveats}
4eb1a6
: ${FW_DIR=/lib/firmware}
4eb1a6
: ${CFG_DIR=/etc/microcode_ctl/ucode_with_caveats}
539655
539655
usage() {
ee041c
	echo 'Usage: check_caveats [-d] [-e] [-k TARGET_KVER] [-c CONFIG]'
ee041c
	echo '                     [-m] [-v]'
539655
	echo
ee041c
	echo '   -d - enables disclaimer printing mode'
4eb1a6
	echo '   -e - check for early microcode load possibility (instead of'
4eb1a6
	echo '        late microcode load)'
539655
	echo '   -k - target version to check against, $(uname -r) is used'
539655
	echo '        otherwise'
539655
	echo '   -c - caveat config(s) to check, all configs are checked'
539655
	echo '        otherwise'
539655
	echo '   -m - check that caveats actually apply to the current model'
539655
	echo '   -v - verbose output'
539655
	echo
539655
	echo 'Environment:'
539655
	echo '  MC_CAVEATS_DATA_DIR - directory that contains caveats'
539655
	echo '                        configuration data'
539655
}
539655
539655
debug() { [ 0 = "$verbose" ] || echo "$*" >&2; }
539655
539655
# A simplified RPM version comparison that takes into account knowledge about
539655
# Y- and Z-streams (so it compares versions inside Y-stram or Z-stream if
539655
# the version against which comparison is performed has appropriate versioning
539655
# scheme).
539655
#
539655
# $1 - kernel version to check
539655
# $* - list of kernel versions to check against
539655
check_kver()
539655
{
539655
	local t_major= t_minor= t_patch= t_y= t_z1= t_z2= t_rest=
539655
	local m_major= m_minor= m_patch= m_y= m_z1= m_z2= m_rest=
539655
	local cmp_type=
539655
539655
	# IFS=.- read -r t_major t_minor t_patch t_y t_z1 t_z2 t_rest <<<"$1"
539655
	# "cannot create temp file for here-document: Read-only file system"
539655
	# that's why we can't have nice things.
4eb1a6
	t_major=${1%%.*}
539655
	t_rest=${1#${t_major}}
4eb1a6
	t_rest=${t_rest#.}
4eb1a6
	t_minor=${t_rest%%.*}
539655
	t_rest=${t_rest#${t_minor}}
4eb1a6
	t_rest=${t_rest#.}
4eb1a6
	t_patch=${t_rest%%-*}
539655
	t_rest=${t_rest#${t_patch}}
4eb1a6
	t_rest=${t_rest#-}
4eb1a6
	t_y=${t_rest%%.*}
539655
	t_rest=${t_rest#${t_y}}
4eb1a6
	t_rest=${t_rest#.}
4eb1a6
	t_z1=${t_rest%%.*}
539655
	t_rest=${t_rest#${t_z1}}
4eb1a6
	t_rest=${t_rest#.}
4eb1a6
	t_z2=${t_rest%%.*}
539655
539655
	# minor/major/patch/y should be numeric
539655
	[ -n "${t_major##*[!0-9]*}" ] || return 1
539655
	[ -n "${t_minor##*[!0-9]*}" ] || return 1
539655
	[ -n "${t_patch##*[!0-9]*}" ] || return 1
539655
	[ -n "${t_y##*[!0-9]*}" ] || return 1
539655
	# reset z1/z2 to zero if non-numeric
539655
	[ -n "${t_z1##*[!0-9]*}" ] || t_z1=0
539655
	[ -n "${t_z2##*[!0-9]*}" ] || t_z2=0
539655
539655
	while [ 1 -lt "$#" ]; do
539655
		cmp_type=upstream
539655
539655
		shift
4eb1a6
		m_major=${1%%.*}
539655
		m_rest=${1#${m_major}}
4eb1a6
		m_rest=${m_rest#.}
4eb1a6
		m_minor=${m_rest%%.*}
539655
		m_rest=${m_rest#${m_minor}}
4eb1a6
		m_rest=${m_rest#.}
4eb1a6
		m_patch=${m_rest%%-*}
539655
		m_rest=${m_rest#${m_patch}}
4eb1a6
		m_rest=${m_rest#-}
4eb1a6
		m_y=${m_rest%%.*}
539655
		m_rest=${m_rest#${m_y}}
4eb1a6
		m_rest=${m_rest#.}
4eb1a6
		m_z1=${m_rest%%.*}
539655
		m_rest=${m_rest#${m_z1}}
4eb1a6
		m_rest=${m_rest#.}
4eb1a6
		m_z2=${m_rest%%.*}
539655
539655
		# minor/major/patch should be numeric
539655
		[ -n "${m_major##*[!0-9]*}" ] || continue
539655
		[ -n "${m_minor##*[!0-9]*}" ] || continue
539655
		[ -n "${m_patch##*[!0-9]*}" ] || continue
539655
		# reset z1/z2 to zero if non-numeric
539655
		[ -n "${m_y##*[!0-9]*}" ] && cmp_type=y || m_y=0
539655
		[ -n "${m_z1##*[!0-9]*}" ] && cmp_type=z || m_z1=0
539655
		[ -n "${m_z2##*[!0-9]*}" ] && cmp_type=z || m_z2=0
539655
539655
		# Comparing versions
539655
		case "$cmp_type" in
539655
		upstream)
539655
			[ "$t_major" -ge "$m_major" ] || continue
539655
			[ "$t_minor" -ge "$m_minor" ] || continue
539655
			[ "$t_patch" -ge "$m_patch" ] || continue
539655
			return 0
539655
			;;
539655
		y)
539655
			[ "$t_major" -eq "$m_major" ] || continue
539655
			[ "$t_minor" -eq "$m_minor" ] || continue
539655
			[ "$t_patch" -eq "$m_patch" ] || continue
539655
			[ "$t_y" -ge "$m_y" ] || continue
539655
			return 0
539655
			;;
539655
		z)
539655
			[ "$t_major" -eq "$m_major" ] || continue
539655
			[ "$t_minor" -eq "$m_minor" ] || continue
539655
			[ "$t_patch" -eq "$m_patch" ] || continue
539655
			[ "$t_y" -eq "$m_y" ] || continue
539655
			[ "$t_z1" -ge "$m_z1" ] || continue
539655
			[ "$t_z2" -ge "$m_z2" ] || continue
539655
			return 0
539655
			;;
539655
		esac
539655
	done
539655
539655
	return 1
539655
}
539655
347126
# It is needed for SKX[1] for which different product segments
347126
# are differentiated by a value in the CAPID0 field of PCU registers
347126
# device[2].
347126
# [1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/21
347126
# [2] https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-scalable-spec-update.pdf#page=13
347126
#
50693b
# $1 - params in config file, space-separated, in key=value form:
347126
#   domain=* - PCI domain, '*' or number
347126
#   bus=* - PCI bus, '*' or number
347126
#   device=* - PCI device, '*' or number
347126
#   function=* - PCI function, '*' or number
347126
#   vid= - PCI vendor ID, empty or number
347126
#   did= - PCI device ID, empty or number
347126
#   offset=0 - offset in configuration space
347126
#   size=4 - field size
347126
#   mask=0 - mask applied to the data read
347126
#   val=0 - comma-separated list of possible values
347126
#   mode=success-any [ success-ail, fail-any, fail-all ] - matching mode:
347126
#     success-any: Returns 0 if there was at least one match, otherwise 1.
347126
#     success-all: Returns 0 if there was at least one device checked and all
347126
#                  the checked devices have matches, otherwise 1.
347126
#     fail-any:    Returns 1 if there was at least one match, otherwise 0.
347126
#     fail-all:    Returns 1 if there was at least one device checked and all
347126
#                  the checked devices have matches, otherwise 0.
347126
# $2 - whether model filter is engaged (if it is not '1', just return the result
347126
#      based on "mode" value that assumes that there were 0 checks/0 matches).
347126
check_pci_config_val()
347126
{
347126
	local domain='*' bus='*' device='*' func='*' vid= did=
347126
	local offset=0 size=4 mask=0 val=0 mode=success-any
347126
	local checked=0 matched=0 path=''
347126
	local dev_path dev_vid dev_did dev_val
347126
	local opts="${1:-}"
347126
	local match_model="${2:0}"
347126
347126
	set -- $1
347126
	while [ "$#" -gt 0 ]; do
347126
		[ "x${1#domain=}" = "x${1}" ] || domain="${1#domain=}"
347126
		[ "x${1#bus=}" = "x${1}" ] || bus="${1#bus=}"
347126
		[ "x${1#device=}" = "x${1}" ] || device="${1#device=}"
347126
		[ "x${1#function=}" = "x${1}" ] || func="${1#function=}"
347126
		[ "x${1#vid=}" = "x${1}" ] || vid="${1#vid=}"
347126
		[ "x${1#did=}" = "x${1}" ] || did="${1#did=}"
347126
		[ "x${1#offset=}" = "x${1}" ] || offset="${1#offset=}"
347126
		[ "x${1#size=}" = "x${1}" ] || size="${1#size=}"
347126
		[ "x${1#mask=}" = "x${1}" ] || mask="${1#mask=}"
347126
		[ "x${1#val=}" = "x${1}" ] || val="${1#val=}"
347126
		[ "x${1#mode=}" = "x${1}" ] || mode="${1#mode=}"
347126
347126
		shift
347126
	done
347126
347126
	path="$domain"
347126
	if [ "x$bus" = 'x*' ]; then
347126
		path="$path:$bus";
347126
	else
347126
		path=$(printf '%s:%02x' "$path" "$bus")
347126
	fi
347126
	if [ "x$device" = 'x*' ]; then
347126
		path="$path:$device";
347126
	else
347126
		path=$(printf '%s:%02x' "$path" "$device")
347126
	fi
347126
	if [ "x$func" = 'x*' ]; then
347126
		path="$path.$func";
347126
	else
347126
		path=$(printf '%s.%01x' "$path" "$func")
347126
	fi
347126
347126
	# Normalise VID, DID
347126
	[ -n "$vid" ] || vid="$(printf '0x%04x' "$vid")"
347126
	[ -n "$did" ] || did="$(printf '0x%04x' "$did")"
347126
347126
	( [ 1 != "$match_model" ] \
347126
	  || /usr/bin/find /sys/bus/pci/devices/ -maxdepth 1 -name "$path" \
347126
	  || : ) | (
347126
		while read -r dev_path; do
347126
			# Filter VID, DID
347126
			if [ -n "$vid" ]; then
347126
				dev_vid=$(/bin/cat "$dev_path/vendor")
347126
				[ "x$vid" = "x$dev_vid" ] || continue
347126
			fi
347126
			if [ -n "$did" ]; then
347126
				dev_did=$(/bin/cat "$dev_path/device")
347126
				[ "x$did" = "x$dev_did" ] || continue
347126
			fi
347126
347126
			checked="$((checked + 1))"
347126
347126
			dev_val="$(/usr/bin/od -j "$offset" -N "$size" -A n \
347126
					       -t "u$size" "$dev_path/config")"
347126
347126
			val_rest="${val}"
347126
			while :; do
347126
				cur_val="${val_rest%%,*}"
347126
				if [ "$((dev_val & mask))" = "$((cur_val & mask))" ]
347126
				then
347126
					matched="$((matched + 1))"
347126
					break
347126
				fi
347126
				[ "x${val_rest}" != "x${val_rest#*,}" ] || break
347126
				val_rest="${val_rest#*,}"
347126
			done
347126
347126
			case "$mode" in
347126
			success-any) [ "$matched" -eq 0 ] || { echo 0; exit; } ;;
347126
			success-all) [ "$matched" -eq "$checked" ] || { echo 1; exit; } ;;
347126
			fail-any)    [ "$matched" -eq 0 ] || { echo 1; exit; } ;;
347126
			fail-all)    [ "$matched" -eq "$checked" ] || { echo 0; exit; } ;;
347126
			*)           echo 2; exit;;
347126
			esac
347126
		done
347126
347126
		debug "PCI config value check ($opts): checked $checked," \
347126
		      "matched $matched (model check is set to $match_model)"
347126
347126
		case "$mode" in
347126
		success-any) if [ "$matched" -eq 0 ]; then echo 1; else echo 0; fi ;;
347126
		success-all) if [ "$matched" -gt 0 -a "$matched" -eq "$checked" ]; then echo 0; else echo 1; fi ;;
347126
		fail-any)    if [ "$matched" -eq 0 ]; then echo 0; else echo 1; fi  ;;
347126
		fail-all)    if [ "$matched" -gt 0 -a "$matched" -eq "$checked" ]; then echo 1; else echo 0; fi ;;
347126
		*)           echo 2; exit;;
347126
		esac
347126
	)
347126
}
347126
50693b
# It is needed for filtering by BIOS vendor name that is available in DMI data
50693b
#
50693b
# $1 - params in config file, space-separated, in key=value form:
50693b
#   key= - DMI value to check. Can be one of the following: bios_date,
50693b
#          bios_vendor, bios_version, board_asset_tag, board_name, board_serial,
50693b
#          board_vendor, board_version, chassis_asset_tag, chassis_serial,
50693b
#          chassis_type, chassis_vendor, chassis_version, product_family,
50693b
#          product_name, product_serial, product_uuid, product_version,
50693b
#          sys_vendor.
50693b
#   val= - a string to match DMI data against.  Can be enclosed in single
50693b
#          or double quotes.
50693b
#   mode=success-equal [ success-equal, fail-equal ] - matching mode:
50693b
#     success-equal: Returns 0 if the value present in the corresponding file
50693b
#                    under /sys/devices/virtual/dmi/id/<key> is equal
50693b
#                    to the value supplied as a value of "val" parameter,
50693b
#                    otherwise 1.
50693b
#     fail-equal:    Returns 1 if the value present in the corresponding file
50693b
#                    under /sys/devices/virtual/dmi/id/<key> is equal
50693b
#                    to the value supplied as a value of "val" parameter,
50693b
#                    otherwise 0.
50693b
#   no-model-mode=success [ success, fail ] - return value if model filter
50693b
#                                             is not enabled:
50693b
#     success: Return 0.
50693b
#     fail:    Return 1.
50693b
# $2 - whether model filter is engaged (if it is not '1', just return the result
50693b
#      based on "mode" value that assumes that the check has failed).
50693b
check_dmi_val()
50693b
{
50693b
	local key= val= mode='success-equal' nm_mode='success'
50693b
	local opts="${1:-}" opt= opt_=
50693b
	local match_model="${2:0}"
50693b
50693b
	local valid_keys=" bios_date bios_vendor bios_version board_asset_tag board_name board_serial board_vendor board_version chassis_asset_tag chassis_serial chassis_type chassis_vendor chassis_version product_family product_name product_serial product_uuid product_version sys_vendor "
50693b
	local success=1
50693b
50693b
	while [ -n "$opts" ]; do
50693b
		opt="${opts%%[ 	]*}"
50693b
		[ -n "${opt}" ] || { opts="${opts#[ 	]}"; continue; }
50693b
50693b
		[ "x${opt#key=}" = "x${opt}" ] || key="${opt#key=}"
50693b
		[ "x${opt#mode=}" = "x${opt}" ] || mode="${opt#mode=}"
50693b
		[ "x${opt#no-model-mode=}" = "x${opt}" ] || \
50693b
			nm_mode="${opt#no-model-mode=}"
50693b
50693b
		# Handle possible quoting
50693b
		[ "x${opt#val=}" = "x${opt}" ] || {
50693b
			case "${opt#val=}" in
50693b
			[']*) opt_="${opts#val=\'}"; val="${opt_%%\'*}"; opt="val=\'${val}\'" ;;
50693b
			["]*) opt_="${opts#val=\"}"; val="${opt_%%\"*}"; opt="val=\"${val}\"" ;;
50693b
			*)    val="${opt#val=}" ;;
50693b
			esac
50693b
		}
50693b
50693b
		opts="${opts#"${opt}"}"
50693b
		continue
50693b
	done
50693b
50693b
	# Check key for validity
50693b
	[ "x${valid_keys#* ${key} *}" != "x${valid_keys}" ] || {
50693b
		debug "Invalid \"key\" parameter value: \"${key}\""
50693b
		echo 2
50693b
		exit
50693b
	}
50693b
50693b
	[ 1 = "$match_model" ] || {
50693b
		case "$nm_mode" in
50693b
		success) echo 0 ;;
50693b
		fail)    echo 1 ;;
50693b
		*)
50693b
			debug "Invalid no-model-mode value: \"${nm_mode}\""
50693b
			echo 2
50693b
			;;
50693b
		esac
50693b
50693b
		exit
50693b
	}
50693b
50693b
	[ -r "/sys/devices/virtual/dmi/id/${key}" ] || {
50693b
		debug "Can't access /sys/devices/virtual/dmi/id/${key}"
50693b
		echo 3
50693b
		exit
50693b
	}
50693b
50693b
	file_val="$(cat "/sys/devices/virtual/dmi/id/${key}")"
50693b
50693b
	[ "x${val}" = "x${file_val}" ] || success=0
50693b
50693b
	case "$mode" in
50693b
	success-equal) echo "$((1 - $success))" ;;
50693b
	fail-equal)    echo "${success}" ;;
50693b
	*)             debug "Invalid mode value: \"${nm_mode}\""; echo 2 ;;
50693b
	esac
50693b
}
50693b
539655
# Provides model in format "VENDOR_ID FAMILY-MODEL-STEPPING"
539655
#
539655
# We check only the first processor as we don't expect non-symmetrical setups
539655
# with CPUs with caveats
539655
get_model_string()
539655
{
539655
	/usr/bin/printf "%s %02x-%02x-%02x" \
539655
		$(/bin/sed -rn '1,/^$/{
539655
			s/^vendor_id[[:space:]]*: (.*)$/\1/p;
539655
			s/^cpu family[[:space:]]*: (.*)$/\1/p;
539655
			s/^model[[:space:]]*: (.*)$/\1/p;
539655
			s/^stepping[[:space:]]*: (.*)$/\1/p;
539655
		}' /proc/cpuinfo)
539655
}
539655
539655
get_model_name()
539655
{
539655
	/bin/sed -rn '1,/^$/s/^model name[[:space:]]*: (.*)$/\1/p' /proc/cpuinfo
539655
}
539655
4eb1a6
get_vendor_id()
4eb1a6
{
4eb1a6
	/bin/sed -rn '1,/^$/s/^vendor_id[[:space:]]*: (.*)$/\1/p' /proc/cpuinfo
4eb1a6
}
4eb1a6
742279
get_mc_path()
742279
{
742279
	case "$1" in
742279
	GenuineIntel)
742279
		echo "intel-ucode/$2"
742279
		;;
742279
	AuthenticAMD)
742279
		echo "amd-ucode/$2"
742279
		;;
742279
	esac
742279
}
742279
4eb1a6
get_mc_ver()
4eb1a6
{
4eb1a6
	/bin/sed -rn '1,/^$/s/^microcode[[:space:]]*: (.*)$/\1/p' /proc/cpuinfo
4eb1a6
}
4eb1a6
4eb1a6
fail()
4eb1a6
{
4eb1a6
	ret=1
4eb1a6
4eb1a6
	fail_cfgs="$fail_cfgs $cfg"
4eb1a6
	fail_paths="$fail_paths $cfg_path"
ee041c
ee041c
	[ 0 -eq "$print_disclaimers" ] || [ ! -e "${dir}/disclaimer" ] \
347126
		|| /bin/cat "${dir}/disclaimer"
4eb1a6
}
4eb1a6
539655
#check_kver "$@"
539655
#get_model_name
539655
539655
match_model=0
539655
configs=
539655
kver=$(/bin/uname -r)
539655
verbose=0
4eb1a6
early_check=0
ee041c
print_disclaimers=0
4eb1a6
4eb1a6
ret=0
539655
ee041c
while getopts "dek:c:mv" opt; do
539655
	case "${opt}" in
ee041c
	d)
ee041c
		print_disclaimers=1
ee041c
		early_check=2
ee041c
		;;
4eb1a6
	e)
4eb1a6
		early_check=1
4eb1a6
		;;
539655
	k)
539655
		kver="$OPTARG"
539655
		;;
539655
	c)
539655
		configs="$configs $OPTARG"
539655
		;;
539655
	m)
539655
		match_model=1
539655
		;;
539655
	v)
539655
		verbose=1
539655
		;;
539655
	*)
539655
		usage
539655
		exit 1;
539655
		;;
539655
	esac
539655
done
539655
347126
: "${configs:=$(find "${MC_CAVEATS_DATA_DIR}" -maxdepth 1 -mindepth 1 -type d -printf "%f\n")}"
539655
539655
cpu_model=$(get_model_string)
539655
cpu_model_name=$(get_model_name)
4eb1a6
cpu_vendor=$(get_vendor_id)
4eb1a6
4eb1a6
ret_paths=""
4eb1a6
ok_paths=""
4eb1a6
fail_paths=""
4eb1a6
4eb1a6
ret_cfgs=""
4eb1a6
ok_cfgs=""
4eb1a6
fail_cfgs=""
4eb1a6
4eb1a6
skip_cfgs=""
4eb1a6
4eb1a6
if [ 1 -eq "$early_check" ]; then
4eb1a6
	stage="early"
4eb1a6
else
4eb1a6
	stage="late"
4eb1a6
fi
4eb1a6
539655
539655
for cfg in $(echo "${configs}"); do
539655
	dir="$MC_CAVEATS_DATA_DIR/$cfg"
4eb1a6
4eb1a6
	# We add cfg to the skip list first and then, if we do not skip it,
4eb1a6
	# we remove the configuration from the list.
4eb1a6
	skip_cfgs="$skip_cfgs $cfg"
4eb1a6
4eb1a6
	[ -r "${dir}/readme" ] || {
4eb1a6
		debug "File 'readme' in ${dir} is not found, skipping"
4eb1a6
		continue
4eb1a6
	}
4eb1a6
539655
	[ -r "${dir}/config" ] || {
539655
		debug "File 'config' in ${dir} is not found, skipping"
539655
		continue
539655
	}
539655
539655
	cfg_model=
4eb1a6
	cfg_vendor=
539655
	cfg_path=
539655
	cfg_kvers=
4eb1a6
	cfg_kvers_early=
539655
	cfg_blacklist=
4eb1a6
	cfg_mc_min_ver_late=
4eb1a6
	cfg_disable=
347126
	cfg_pci=
50693b
	cfg_dmi=
539655
539655
	while read -r key value; do
539655
		case "$key" in
539655
		model)
539655
			cfg_model="$value"
539655
			;;
4eb1a6
		vendor)
4eb1a6
			cfg_vendor="$value"
4eb1a6
			;;
539655
		path)
539655
			cfg_path="$cfg_path $value"
539655
			;;
539655
		kernel)
539655
			cfg_kvers="$cfg_kvers $value"
539655
			;;
4eb1a6
		kernel_early)
4eb1a6
			cfg_kvers_early="$cfg_kvers_early $value"
4eb1a6
			;;
4eb1a6
		mc_min_ver_late)
4eb1a6
			cfg_mc_min_ver_late="$value"
4eb1a6
			;;
4eb1a6
		disable)
4eb1a6
			cfg_disable="$cfg_disable $value "
4eb1a6
			;;
539655
		blacklist)
539655
			cfg_blacklist=1
50693b
			# "blacklist" is special: it stops entity parsing,
50693b
			# and the rest of file is a list of blacklisted model
50693b
			# names.
50693b
			break
347126
			;;
347126
		pci_config_val)
347126
			cfg_pci="$cfg_pci
347126
				$value"
347126
			;;
50693b
		dmi)
50693b
			cfg_dmi="$cfg_dmi
50693b
				$value"
50693b
			;;
347126
		'#'*|'')
347126
			continue
347126
			;;
347126
		*)
347126
			debug "Unknown key '$key' (value '$value') in config" \
347126
			      "'$cfg'"
539655
			;;
539655
		esac
539655
	done < "${dir}/config"
539655
539655
	[ -z "${cfg_blacklist}" ] || \
539655
		cfg_blacklist=$(/bin/sed -n '/^blacklist$/,$p' "${dir}/config" |
539655
					/usr/bin/tail -n +2)
539655
539655
	debug "${cfg}: model '$cfg_model', path '$cfg_path', kvers '$cfg_kvers'"
539655
	debug "${cfg}: blacklist '$cfg_blacklist'"
539655
4eb1a6
	# Check for override files in the following order:
4eb1a6
	#  - disallow early/late specific caveat for specific kernel
4eb1a6
	#  - force early/late specific caveat for specific kernel
4eb1a6
	#  - disallow specific caveat for specific kernel
4eb1a6
	#  - force specific caveat for specific kernel
4eb1a6
	#
4eb1a6
	#  - disallow early/late specific caveat for any kernel
4eb1a6
	#  - disallow early/late any caveat for specific kernel
4eb1a6
	#  - force early/late specific caveat for any kernel
4eb1a6
	#  - force early/late any caveat for specific kernel
4eb1a6
	#  - disallow specific caveat for any kernel
4eb1a6
	#  - disallow any caveat for specific kernel
4eb1a6
	#  - force specific caveat for any kernel
4eb1a6
	#  - force any caveat for specific kernel
4eb1a6
	#
4eb1a6
	#  - disallow early/late everything
4eb1a6
	#  - force early/late everyhting
4eb1a6
	#  - disallow everything
4eb1a6
	#  - force everyhting
4eb1a6
	ignore_cfg=0
4eb1a6
	force_cfg=0
4eb1a6
	override_file=""
4eb1a6
	overrides="
4eb1a6
	0:$FW_DIR/$kver/disallow-$stage-$cfg
4eb1a6
	1:$FW_DIR/$kver/force-$stage-$cfg
4eb1a6
	0:$FW_DIR/$kver/disallow-$cfg
4eb1a6
	1:$FW_DIR/$kver/force-$cfg
4eb1a6
	0:$FW_DIR/$kver/disallow-$stage
4eb1a6
	0:$CFG_DIR/disallow-$stage-$cfg
4eb1a6
	1:$FW_DIR/$kver/force-$stage
4eb1a6
	1:$CFG_DIR/force-$stage-$cfg
4eb1a6
	0:$FW_DIR/$kver/disallow
4eb1a6
	0:$CFG_DIR/disallow-$cfg
4eb1a6
	1:$FW_DIR/$kver/force
4eb1a6
	1:$CFG_DIR/force-$cfg
4eb1a6
	0:$CFG_DIR/disallow-$stage
4eb1a6
	1:$CFG_DIR/force-$stage
4eb1a6
	0:$CFG_DIR/disallow
4eb1a6
	1:$CFG_DIR/force"
4eb1a6
	for o in $(echo "$overrides"); do
4eb1a6
		o_force=${o%%:*}
4eb1a6
		override_file=${o#$o_force:}
4eb1a6
4eb1a6
		[ -e "$override_file" ] || continue
4eb1a6
4eb1a6
		if [ 0 -eq "$o_force" ]; then
4eb1a6
			ignore_cfg=1
4eb1a6
		else
4eb1a6
			force_cfg=1
4eb1a6
		fi
4eb1a6
4eb1a6
		break
4eb1a6
	done
4eb1a6
4eb1a6
	[ 0 -eq "$ignore_cfg" ] || {
4eb1a6
		debug "Configuration \"$cfg\" is ignored due to presence of" \
4eb1a6
		      "\"$override_file\"."
4eb1a6
		continue
4eb1a6
	}
4eb1a6
4eb1a6
	# Check model if model filter is enabled
4eb1a6
	if [ 1 -eq "$match_model" -a  -n "$cfg_model" ]; then
4eb1a6
		[ "x$cpu_model" = "x$cfg_model" ] || {
4eb1a6
			debug "Current CPU model '$cpu_model' doesn't" \
4eb1a6
			      "match configuration CPU model '$cfg_model'," \
4eb1a6
			      "skipping"
4eb1a6
			continue
4eb1a6
		}
4eb1a6
	fi
4eb1a6
742279
	# Check paths if model filter is enabled
742279
	if [ 1 -eq "$match_model" -a  -n "$cfg_path" ]; then
742279
		cpu_mc_path="$MC_CAVEATS_DATA_DIR/$cfg/$(get_mc_path \
742279
			"$cpu_vendor" "${cpu_model#* }")"
742279
		cfg_mc_present=0
742279
742279
		for p in $(printf "%s" "$cfg_path"); do
50693b
			/usr/bin/find "$MC_CAVEATS_DATA_DIR/$cfg" \
50693b
				-path "$MC_CAVEATS_DATA_DIR/$cfg/$p" -print0 \
50693b
			    | /bin/grep -zFxc "$cpu_mc_path" > /dev/null \
742279
			    || continue
742279
742279
			cfg_mc_present=1
347126
			break
742279
		done
742279
742279
		[ 1 = "$cfg_mc_present" ] || {
742279
			debug "No matching microcode files in '$cfg_path'" \
742279
			      "for CPU model '$cpu_model', skipping"
742279
			continue
742279
		}
742279
	fi
742279
4eb1a6
	# Check vendor if model filter is enabled
4eb1a6
	if [ 1 -eq "$match_model" -a  -n "$cfg_vendor" ]; then
4eb1a6
		[ "x$cpu_vendor" = "x$cfg_vendor" ] || {
4eb1a6
			debug "Current CPU vendor '$cpu_vendor' doesn't" \
4eb1a6
			      "match configuration CPU vendor '$cfg_vendor'," \
4eb1a6
			      "skipping"
4eb1a6
			continue
539655
		}
539655
	fi
539655
4eb1a6
	# Check configuration files
4eb1a6
4eb1a6
	ret_cfgs="$ret_cfgs $cfg"
4eb1a6
	ret_paths="$ret_paths $cfg_path"
4eb1a6
	skip_cfgs="${skip_cfgs% $cfg}"
4eb1a6
4eb1a6
	[ 0 -eq "$force_cfg" ] || {
4eb1a6
		debug "Checks for configuration \"$cfg\" are ignored due to" \
4eb1a6
		      "presence of \"$override_file\"."
4eb1a6
4eb1a6
		ok_cfgs="$ok_cfgs $cfg"
4eb1a6
		ok_paths="$ok_paths $cfg_path"
4eb1a6
4eb1a6
		continue
4eb1a6
	}
4eb1a6
4eb1a6
	[ "x${cfg_disable%%* $stage *}" = "x$cfg_disable" ] || {
4eb1a6
		debug "${cfg}: caveat is disabled in configuration"
4eb1a6
		fail
4eb1a6
		continue
4eb1a6
	}
4eb1a6
4eb1a6
	# Check late load kernel version
4eb1a6
	if [ 1 -ne "$early_check" -a -n "$cfg_kvers" ]; then
539655
		check_kver "$kver" $cfg_kvers || {
4eb1a6
			debug "${cfg}: late load kernel version check for" \
4eb1a6
			      " '$kver' against '$cfg_kvers' failed"
4eb1a6
			fail
4eb1a6
			continue
539655
		}
539655
	fi
539655
4eb1a6
	# Check early load kernel version
4eb1a6
	if [ 0 -ne "$early_check" -a -n "$cfg_kvers_early" ]; then
4eb1a6
		check_kver "$kver" $cfg_kvers_early || {
4eb1a6
			debug "${cfg}: early load kernel version check for" \
4eb1a6
			      "'$kver' against '$cfg_kvers_early' failed"
4eb1a6
			fail
4eb1a6
			continue
4eb1a6
		}
4eb1a6
	fi
4eb1a6
4eb1a6
	# Check model blacklist
539655
	if [ -n "$cfg_blacklist" ]; then
539655
		echo "$cfg_blacklist" | /bin/grep -vqFx "${cpu_model_name}" || {
539655
			debug "${cfg}: model '${cpu_model_name}' is blacklisted"
4eb1a6
			fail
4eb1a6
			continue
4eb1a6
		}
4eb1a6
	fi
4eb1a6
4eb1a6
	# Check current microcode version for the late update
4eb1a6
	if [ -n "$cfg_mc_min_ver_late" -a 1 -ne "$early_check" -a \
4eb1a6
	   "x$cpu_model" = "x$cfg_model" ]; then
4eb1a6
		cpu_mc_ver="$(get_mc_ver)"
4eb1a6
4eb1a6
		[ 1 -eq $((cpu_mc_ver >= cfg_mc_min_ver_late)) ] || {
4eb1a6
			debug "${cfg}: CPU microcode version $cpu_mc_ver" \
4eb1a6
			      "failed check (should be at least" \
4eb1a6
			      "${cfg_mc_min_ver_late})"
4eb1a6
			fail
4eb1a6
			continue
539655
		}
539655
	fi
539655
347126
	# Check PCI devices if model filter is enabled
347126
	# Note that the model filter check is done inside check_pci_config_val
347126
	# based on the 'mode=' parameter.
347126
	if [ -n "$cfg_pci" ]; then
347126
		pci_line="$(printf "%s\n" "$cfg_pci" | while read -r pci_line; do
347126
				[ -n "$pci_line" ] || continue
347126
				pci_res=$(check_pci_config_val "$pci_line" \
347126
							       "$match_model")
347126
				[ 0 != "$pci_res" ] || continue
347126
				echo "$pci_res $pci_line"
347126
				break
347126
			done
347126
			echo "0 ")"
347126
347126
		[ -z "${pci_line#* }" ] || {
347126
			debug "PCI configuration word check '${pci_line#* }'" \
347126
			      "failed (with return code ${pci_line%% *})"
347126
			fail
347126
			continue
347126
		}
347126
	fi
347126
50693b
	# Check DMI data if model filter is enabled
50693b
	# Note that the model filter check is done inside check_pci_config_val
50693b
	# based on the 'mode=' parameter.
50693b
	if [ -n "$cfg_dmi" ]; then
50693b
		dmi_line="$(printf "%s\n" "$cfg_dmi" | while read -r dmi_line
50693b
			do
50693b
				[ -n "$dmi_line" ] || continue
50693b
				dmi_res=$(check_dmi_val "$dmi_line" \
50693b
							"$match_model")
50693b
				[ 0 != "$dmi_res" ] || continue
50693b
				echo "$dmi_res $dmi_line"
50693b
				break
50693b
			done
50693b
			echo "0 ")"
50693b
50693b
		[ -z "${dmi_line#* }" ] || {
50693b
			debug "DMI data check '${dmi_line#* }'" \
50693b
			      "failed (with return code ${dmi_line%% *})"
50693b
			fail
50693b
			continue
50693b
		}
50693b
	fi
50693b
4eb1a6
	ok_cfgs="$ok_cfgs $cfg"
4eb1a6
	ok_paths="$ok_paths $cfg_path"
539655
done
539655
ee041c
[ 0 -eq "$print_disclaimers" ] || exit 0
ee041c
4eb1a6
echo "cfgs$ret_cfgs"
4eb1a6
echo "skip_cfgs$skip_cfgs"
4eb1a6
echo "paths$ret_paths"
4eb1a6
echo "ok_cfgs$ok_cfgs"
4eb1a6
echo "ok_paths$ok_paths"
4eb1a6
echo "fail_cfgs$fail_cfgs"
4eb1a6
echo "fail_paths$fail_paths"
4eb1a6
4eb1a6
exit $ret