Blame SOURCES/check_caveats

c59b13
#! /bin/bash -eu
c59b13
c59b13
# Script for checking various microcode caveats
c59b13
#
c59b13
#
c59b13
# SPDX-License-Identifier: CC0-1.0
c59b13
c59b13
: ${MC_CAVEATS_DATA_DIR=/usr/share/microcode_ctl/ucode_with_caveats}
c59b13
: ${FW_DIR=/lib/firmware}
c59b13
: ${CFG_DIR=/etc/microcode_ctl/ucode_with_caveats}
c59b13
ca7245
MAX_NESTING_LEVEL=8
ca7245
c59b13
usage() {
078ac8
	echo 'Usage: check_caveats [-d] [-e] [-k TARGET_KVER] [-c CONFIG]'
078ac8
	echo '                     [-m] [-v]'
c59b13
	echo
078ac8
	echo '   -d - enables disclaimer printing mode'
c59b13
	echo '   -e - check for early microcode load possibility (instead of'
c59b13
	echo '        late microcode load)'
c59b13
	echo '   -k - target version to check against, $(uname -r) is used'
c59b13
	echo '        otherwise'
c59b13
	echo '   -c - caveat config(s) to check, all configs are checked'
c59b13
	echo '        otherwise'
c59b13
	echo '   -m - check that caveats actually apply to the current model'
c59b13
	echo '   -v - verbose output'
c59b13
	echo
c59b13
	echo 'Environment:'
c59b13
	echo '  MC_CAVEATS_DATA_DIR - directory that contains caveats'
c59b13
	echo '                        configuration data'
c59b13
}
c59b13
c59b13
debug() { [ 0 = "$verbose" ] || echo "$*" >&2; }
c59b13
c59b13
# A simplified RPM version comparison that takes into account knowledge about
c59b13
# Y- and Z-streams (so it compares versions inside Y-stram or Z-stream if
c59b13
# the version against which comparison is performed has appropriate versioning
c59b13
# scheme).
c59b13
#
c59b13
# $1 - kernel version to check
c59b13
# $* - list of kernel versions to check against
c59b13
check_kver()
c59b13
{
c59b13
	local t_major= t_minor= t_patch= t_y= t_z1= t_z2= t_rest=
c59b13
	local m_major= m_minor= m_patch= m_y= m_z1= m_z2= m_rest=
c59b13
	local cmp_type=
c59b13
c59b13
	# IFS=.- read -r t_major t_minor t_patch t_y t_z1 t_z2 t_rest <<<"$1"
c59b13
	# "cannot create temp file for here-document: Read-only file system"
c59b13
	# that's why we can't have nice things.
c59b13
	t_major=${1%%.*}
c59b13
	t_rest=${1#${t_major}}
c59b13
	t_rest=${t_rest#.}
c59b13
	t_minor=${t_rest%%.*}
c59b13
	t_rest=${t_rest#${t_minor}}
c59b13
	t_rest=${t_rest#.}
c59b13
	t_patch=${t_rest%%-*}
c59b13
	t_rest=${t_rest#${t_patch}}
c59b13
	t_rest=${t_rest#-}
c59b13
	t_y=${t_rest%%.*}
c59b13
	t_rest=${t_rest#${t_y}}
c59b13
	t_rest=${t_rest#.}
c59b13
	t_z1=${t_rest%%.*}
c59b13
	t_rest=${t_rest#${t_z1}}
c59b13
	t_rest=${t_rest#.}
c59b13
	t_z2=${t_rest%%.*}
c59b13
c59b13
	# minor/major/patch/y should be numeric
c59b13
	[ -n "${t_major##*[!0-9]*}" ] || return 1
c59b13
	[ -n "${t_minor##*[!0-9]*}" ] || return 1
c59b13
	[ -n "${t_patch##*[!0-9]*}" ] || return 1
c59b13
	[ -n "${t_y##*[!0-9]*}" ] || return 1
c59b13
	# reset z1/z2 to zero if non-numeric
c59b13
	[ -n "${t_z1##*[!0-9]*}" ] || t_z1=0
c59b13
	[ -n "${t_z2##*[!0-9]*}" ] || t_z2=0
c59b13
c59b13
	while [ 1 -lt "$#" ]; do
c59b13
		cmp_type=upstream
c59b13
c59b13
		shift
c59b13
		m_major=${1%%.*}
c59b13
		m_rest=${1#${m_major}}
c59b13
		m_rest=${m_rest#.}
c59b13
		m_minor=${m_rest%%.*}
c59b13
		m_rest=${m_rest#${m_minor}}
c59b13
		m_rest=${m_rest#.}
c59b13
		m_patch=${m_rest%%-*}
c59b13
		m_rest=${m_rest#${m_patch}}
c59b13
		m_rest=${m_rest#-}
c59b13
		m_y=${m_rest%%.*}
c59b13
		m_rest=${m_rest#${m_y}}
c59b13
		m_rest=${m_rest#.}
c59b13
		m_z1=${m_rest%%.*}
c59b13
		m_rest=${m_rest#${m_z1}}
c59b13
		m_rest=${m_rest#.}
c59b13
		m_z2=${m_rest%%.*}
c59b13
c59b13
		# minor/major/patch should be numeric
c59b13
		[ -n "${m_major##*[!0-9]*}" ] || continue
c59b13
		[ -n "${m_minor##*[!0-9]*}" ] || continue
c59b13
		[ -n "${m_patch##*[!0-9]*}" ] || continue
c59b13
		# reset z1/z2 to zero if non-numeric
c59b13
		[ -n "${m_y##*[!0-9]*}" ] && cmp_type=y || m_y=0
c59b13
		[ -n "${m_z1##*[!0-9]*}" ] && cmp_type=z || m_z1=0
c59b13
		[ -n "${m_z2##*[!0-9]*}" ] && cmp_type=z || m_z2=0
c59b13
c59b13
		# Comparing versions
c59b13
		case "$cmp_type" in
c59b13
		upstream)
c59b13
			[ "$t_major" -ge "$m_major" ] || continue
c59b13
			[ "$t_minor" -ge "$m_minor" ] || continue
c59b13
			[ "$t_patch" -ge "$m_patch" ] || continue
c59b13
			return 0
c59b13
			;;
c59b13
		y)
c59b13
			[ "$t_major" -eq "$m_major" ] || continue
c59b13
			[ "$t_minor" -eq "$m_minor" ] || continue
c59b13
			[ "$t_patch" -eq "$m_patch" ] || continue
c59b13
			[ "$t_y" -ge "$m_y" ] || continue
c59b13
			return 0
c59b13
			;;
c59b13
		z)
c59b13
			[ "$t_major" -eq "$m_major" ] || continue
c59b13
			[ "$t_minor" -eq "$m_minor" ] || continue
c59b13
			[ "$t_patch" -eq "$m_patch" ] || continue
c59b13
			[ "$t_y" -eq "$m_y" ] || continue
c59b13
			[ "$t_z1" -ge "$m_z1" ] || continue
c59b13
			[ "$t_z2" -ge "$m_z2" ] || continue
c59b13
			return 0
c59b13
			;;
c59b13
		esac
c59b13
	done
c59b13
c59b13
	return 1
c59b13
}
c59b13
3a6b56
# It is needed for SKX[1] for which different product segments
3a6b56
# are differentiated by a value in the CAPID0 field of PCU registers
3a6b56
# device[2].
3a6b56
# [1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/21
3a6b56
# [2] https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-scalable-spec-update.pdf#page=13
3a6b56
#
6e6257
# $1 - params in config file, space-separated, in key=value form:
3a6b56
#   domain=* - PCI domain, '*' or number
3a6b56
#   bus=* - PCI bus, '*' or number
3a6b56
#   device=* - PCI device, '*' or number
3a6b56
#   function=* - PCI function, '*' or number
3a6b56
#   vid= - PCI vendor ID, empty or number
3a6b56
#   did= - PCI device ID, empty or number
3a6b56
#   offset=0 - offset in configuration space
3a6b56
#   size=4 - field size
3a6b56
#   mask=0 - mask applied to the data read
3a6b56
#   val=0 - comma-separated list of possible values
3a6b56
#   mode=success-any [ success-ail, fail-any, fail-all ] - matching mode:
3a6b56
#     success-any: Returns 0 if there was at least one match, otherwise 1.
3a6b56
#     success-all: Returns 0 if there was at least one device checked and all
3a6b56
#                  the checked devices have matches, otherwise 1.
3a6b56
#     fail-any:    Returns 1 if there was at least one match, otherwise 0.
3a6b56
#     fail-all:    Returns 1 if there was at least one device checked and all
3a6b56
#                  the checked devices have matches, otherwise 0.
3a6b56
# $2 - whether model filter is engaged (if it is not '1', just return the result
3a6b56
#      based on "mode" value that assumes that there were 0 checks/0 matches).
3a6b56
check_pci_config_val()
3a6b56
{
3a6b56
	local domain='*' bus='*' device='*' func='*' vid= did=
3a6b56
	local offset=0 size=4 mask=0 val=0 mode=success-any
3a6b56
	local checked=0 matched=0 path=''
3a6b56
	local dev_path dev_vid dev_did dev_val
3a6b56
	local opts="${1:-}"
5532bf
	local match_model="${2:-0}"
3a6b56
3a6b56
	set -- $1
3a6b56
	while [ "$#" -gt 0 ]; do
3a6b56
		[ "x${1#domain=}" = "x${1}" ] || domain="${1#domain=}"
3a6b56
		[ "x${1#bus=}" = "x${1}" ] || bus="${1#bus=}"
3a6b56
		[ "x${1#device=}" = "x${1}" ] || device="${1#device=}"
3a6b56
		[ "x${1#function=}" = "x${1}" ] || func="${1#function=}"
3a6b56
		[ "x${1#vid=}" = "x${1}" ] || vid="${1#vid=}"
3a6b56
		[ "x${1#did=}" = "x${1}" ] || did="${1#did=}"
3a6b56
		[ "x${1#offset=}" = "x${1}" ] || offset="${1#offset=}"
3a6b56
		[ "x${1#size=}" = "x${1}" ] || size="${1#size=}"
3a6b56
		[ "x${1#mask=}" = "x${1}" ] || mask="${1#mask=}"
3a6b56
		[ "x${1#val=}" = "x${1}" ] || val="${1#val=}"
3a6b56
		[ "x${1#mode=}" = "x${1}" ] || mode="${1#mode=}"
3a6b56
3a6b56
		shift
3a6b56
	done
3a6b56
3a6b56
	path="$domain"
3a6b56
	if [ "x$bus" = 'x*' ]; then
3a6b56
		path="$path:$bus";
3a6b56
	else
3a6b56
		path=$(printf '%s:%02x' "$path" "$bus")
3a6b56
	fi
3a6b56
	if [ "x$device" = 'x*' ]; then
3a6b56
		path="$path:$device";
3a6b56
	else
3a6b56
		path=$(printf '%s:%02x' "$path" "$device")
3a6b56
	fi
3a6b56
	if [ "x$func" = 'x*' ]; then
3a6b56
		path="$path.$func";
3a6b56
	else
3a6b56
		path=$(printf '%s.%01x' "$path" "$func")
3a6b56
	fi
3a6b56
3a6b56
	# Normalise VID, DID
3a6b56
	[ -n "$vid" ] || vid="$(printf '0x%04x' "$vid")"
3a6b56
	[ -n "$did" ] || did="$(printf '0x%04x' "$did")"
3a6b56
3a6b56
	( [ 1 != "$match_model" ] \
3a6b56
	  || /usr/bin/find /sys/bus/pci/devices/ -maxdepth 1 -name "$path" \
3a6b56
	  || : ) | (
3a6b56
		while read -r dev_path; do
3a6b56
			# Filter VID, DID
3a6b56
			if [ -n "$vid" ]; then
3a6b56
				dev_vid=$(/bin/cat "$dev_path/vendor")
3a6b56
				[ "x$vid" = "x$dev_vid" ] || continue
3a6b56
			fi
3a6b56
			if [ -n "$did" ]; then
3a6b56
				dev_did=$(/bin/cat "$dev_path/device")
3a6b56
				[ "x$did" = "x$dev_did" ] || continue
3a6b56
			fi
3a6b56
3a6b56
			checked="$((checked + 1))"
3a6b56
3a6b56
			dev_val="$(/usr/bin/od -j "$offset" -N "$size" -A n \
3a6b56
					       -t "u$size" "$dev_path/config")"
3a6b56
3a6b56
			val_rest="${val}"
3a6b56
			while :; do
3a6b56
				cur_val="${val_rest%%,*}"
3a6b56
				if [ "$((dev_val & mask))" = "$((cur_val & mask))" ]
3a6b56
				then
3a6b56
					matched="$((matched + 1))"
3a6b56
					break
3a6b56
				fi
3a6b56
				[ "x${val_rest}" != "x${val_rest#*,}" ] || break
3a6b56
				val_rest="${val_rest#*,}"
3a6b56
			done
3a6b56
3a6b56
			case "$mode" in
3a6b56
			success-any) [ "$matched" -eq 0 ] || { echo 0; exit; } ;;
3a6b56
			success-all) [ "$matched" -eq "$checked" ] || { echo 1; exit; } ;;
3a6b56
			fail-any)    [ "$matched" -eq 0 ] || { echo 1; exit; } ;;
3a6b56
			fail-all)    [ "$matched" -eq "$checked" ] || { echo 0; exit; } ;;
3a6b56
			*)           echo 2; exit;;
3a6b56
			esac
3a6b56
		done
3a6b56
3a6b56
		debug "PCI config value check ($opts): checked $checked," \
3a6b56
		      "matched $matched (model check is set to $match_model)"
3a6b56
3a6b56
		case "$mode" in
3a6b56
		success-any) if [ "$matched" -eq 0 ]; then echo 1; else echo 0; fi ;;
3a6b56
		success-all) if [ "$matched" -gt 0 -a "$matched" -eq "$checked" ]; then echo 0; else echo 1; fi ;;
3a6b56
		fail-any)    if [ "$matched" -eq 0 ]; then echo 0; else echo 1; fi  ;;
3a6b56
		fail-all)    if [ "$matched" -gt 0 -a "$matched" -eq "$checked" ]; then echo 1; else echo 0; fi ;;
3a6b56
		*)           echo 2; exit;;
3a6b56
		esac
3a6b56
	)
3a6b56
}
3a6b56
6e6257
# It is needed for filtering by BIOS vendor name that is available in DMI data
6e6257
#
6e6257
# $1 - params in config file, space-separated, in key=value form:
ca7245
#   key= - DMI data record to check. Can be one of the following: bios_date,
6e6257
#          bios_vendor, bios_version, board_asset_tag, board_name, board_serial,
6e6257
#          board_vendor, board_version, chassis_asset_tag, chassis_serial,
6e6257
#          chassis_type, chassis_vendor, chassis_version, product_family,
6e6257
#          product_name, product_serial, product_uuid, product_version,
6e6257
#          sys_vendor.
6e6257
#   val= - a string to match DMI data against.  Can be enclosed in single
6e6257
#          or double quotes.
ca7245
#   keyval= - a string of format "KEY(!)?[=:]VAL" (so, one of "KEY=VAL",
ca7245
#             "KEY!=VAL", "KEY:VAL", "KEY!:VAL") that allows providing
ca7245
#             a key-value pair in a single parameter.  It is possible to provide
ca7245
#             multiple keyval= parameters.  "!" before :/= means negated match.
ca7245
#             The action supplied in the mode= parameter is executed upon
ca7245
#             successful (non-)matching of all the keyval pairs (as well
ca7245
#             as the pair provided in a pair of key= and val= parameters).
6e6257
#   mode=success-equal [ success-equal, fail-equal ] - matching mode:
ca7245
#     success-equal: Returns 0 if the all values present in the corresponding
ca7245
#                    files under /sys/devices/virtual/dmi/id/<KEY> are equal
ca7245
#                    (or not equal in case of a keyval= with negated match)
ca7245
#                    to the respective values supplied as the values
ca7245
#                    of the keyval= parameters or the pair of key= vand val=
ca7245
#                    parameters, otherwise 1.
ca7245
#     fail-equal:    Returns 1 if all the values present in DMI files in sysfs
ca7245
#                    match (as described above), otherwise 0.
6e6257
#   no-model-mode=success [ success, fail ] - return value if model filter
6e6257
#                                             is not enabled:
6e6257
#     success: Return 0.
6e6257
#     fail:    Return 1.
6e6257
# $2 - whether model filter is engaged (if it is not '1', just return the result
ca7245
#      based on "no-model-mode" value).
6e6257
check_dmi_val()
6e6257
{
ca7245
	local key= val= keyval= keyvals= mode='success-equal' nm_mode='success'
6e6257
	local opts="${1:-}" opt= opt_=
5532bf
	local match_model="${2:-0}"
6e6257
6e6257
	local valid_keys=" bios_date bios_vendor bios_version board_asset_tag board_name board_serial board_vendor board_version chassis_asset_tag chassis_serial chassis_type chassis_vendor chassis_version product_family product_name product_serial product_uuid product_version sys_vendor "
6e6257
	local success=1
6e6257
6e6257
	while [ -n "$opts" ]; do
6e6257
		opt="${opts%%[ 	]*}"
6e6257
		[ -n "${opt}" ] || { opts="${opts#[ 	]}"; continue; }
6e6257
6e6257
		[ "x${opt#key=}" = "x${opt}" ] || key="${opt#key=}"
6e6257
		[ "x${opt#mode=}" = "x${opt}" ] || mode="${opt#mode=}"
6e6257
		[ "x${opt#no-model-mode=}" = "x${opt}" ] || \
6e6257
			nm_mode="${opt#no-model-mode=}"
6e6257
6e6257
		# Handle possible quoting
6e6257
		[ "x${opt#val=}" = "x${opt}" ] || {
6e6257
			case "${opt#val=}" in
ca7245
			[\']*) opt_="${opts#val=\'}"; val="${opt_%%\'*}"; opt="val='${val}'" ;;
ca7245
			[\"]*) opt_="${opts#val=\"}"; val="${opt_%%\"*}"; opt="val=\"${val}\"" ;;
6e6257
			*)    val="${opt#val=}" ;;
6e6257
			esac
6e6257
		}
ca7245
		[ "x${opt#keyval=}" = "x${opt}" ] || {
ca7245
			case "${opt#keyval=}" in
ca7245
			[\']*)
ca7245
				opt_="${opts#keyval=\'}"
ca7245
				keyval="${opt_%%\'*}"
ca7245
				opt="keyval='${keyval}'"
ca7245
				keyvals="${keyvals}
ca7245
					${keyval}"
ca7245
				;;
ca7245
			[\"]*)
ca7245
				opt_="${opts#keyval=\"}"
ca7245
				keyval="${opt_%%\"*}"
ca7245
				opt="keyval=\"${keyval}\""
ca7245
				keyvals="${keyvals}
ca7245
					${keyval}"
ca7245
				;;
ca7245
			*)
ca7245
				keyvals="${keyvals}
ca7245
					${opt#keyval=}"
ca7245
				;;
ca7245
			esac
ca7245
		}
6e6257
6e6257
		opts="${opts#"${opt}"}"
6e6257
		continue
6e6257
	done
6e6257
ca7245
	[ -z "$key" -a -z "$val" ] || keyvals="${key}=${val}${keyvals}"
ca7245
ca7245
	[ -n "x${keyvals}" ] || {
ca7245
		debug "Neither key=, val=, nor keyval= parameters were privoded"
6e6257
		echo 2
ca7245
		return
6e6257
	}
6e6257
6e6257
	[ 1 = "$match_model" ] || {
6e6257
		case "$nm_mode" in
6e6257
		success) echo 0 ;;
6e6257
		fail)    echo 1 ;;
6e6257
		*)
6e6257
			debug "Invalid no-model-mode value: \"${nm_mode}\""
6e6257
			echo 2
6e6257
			;;
6e6257
		esac
6e6257
ca7245
		return
6e6257
	}
6e6257
ca7245
	case "$mode" in
ca7245
	success-equal|fail-equal) ;;
ca7245
	*) debug "Invalid mode value: \"${nm_mode}\""; echo 2; return ;;
ca7245
	esac
6e6257
ca7245
	printf "%s\n" "${keyvals}" | (
ca7245
		while read l; do
ca7245
			[ -n "$l" ] || continue
ca7245
			key="${l%%[=:]*}"
ca7245
			val="${l#${key}[=:]}"
ca7245
ca7245
			cmp="="
ca7245
			[ "x${key%!}" = "x${key}" ] || {
ca7245
				cmp="!="
ca7245
				key="${key%!}"
ca7245
			}
ca7245
ca7245
			# Check key for validity
ca7245
			[ "x${valid_keys#* ${key} *}" != "x${valid_keys}" ] || {
ca7245
				debug "Invalid \"key\" parameter value: \"${key}\""
ca7245
				echo 2
ca7245
				return
ca7245
			}
ca7245
ca7245
			[ -r "/sys/devices/virtual/dmi/id/${key}" ] || {
ca7245
				debug "Can't access /sys/devices/virtual/dmi/id/${key}"
ca7245
				echo 3
ca7245
				return
ca7245
			}
ca7245
ca7245
			file_val="$(/bin/cat "/sys/devices/virtual/dmi/id/${key}")"
ca7245
ca7245
			[ "x${val}" "${cmp}" "x${file_val}" ] || {
ca7245
				case "$mode" in
ca7245
				success-equal) echo 1 ;;
ca7245
				fail-equal)    echo 0 ;;
ca7245
				esac
ca7245
ca7245
				return
ca7245
			}
ca7245
		done
6e6257
ca7245
		case "$mode" in
ca7245
		success-equal) echo 0 ;;
ca7245
		fail-equal)    echo 1 ;;
ca7245
		esac
ca7245
	)
ca7245
}
6e6257
ca7245
# check_dependency CURLEVEL DEP_TYPE DEP_NAME OPTS
ca7245
# DEP_TYPE:
ca7245
#   required - caveat can be enabled only if dependency is enabled
ca7245
#              (is not forcefully disabled and meets caveat conditions)
ca7245
# OPTS:
ca7245
#   match-model-mode=same [ on, off, same ] - what mode matching mode is to be used for dependency
ca7245
#   skip=skip [ fail, skip, success ]
ca7245
#   force-skip=skip [ fail, skip, success ]
ca7245
#   nesting-too-deep=fail [ fail, skip, success ]
ca7245
# Return values:
ca7245
#   0 - success
ca7245
#   1 - fail
ca7245
#   2 - skip
ca7245
#   9 - error
ca7245
check_dependency()
ca7245
{
ca7245
	local cur_level="$1"
ca7245
	local dep_type="$2"
ca7245
	local dep_name="$3"
ca7245
	local match_model_mode=same old_match_model="${match_model}"
ca7245
	local skip=skip
ca7245
	local force_skip=skip
ca7245
	local nesting_too_deep=fail
ca7245
ca7245
	local check="Dependency check for ${dep_type} ${dep_name}"
ca7245
ca7245
	set -- ${4:-}
ca7245
	while [ "$#" -gt 0 ]; do
ca7245
		[ "x${1#match-model-mode=}" = "x${1}" ] || match_model_mode="${1#match-model-mode=}"
ca7245
		[ "x${1#skip=}" = "x${1}" ] || skip="${1#skip=}"
ca7245
		[ "x${1#force-skip=}" = "x${1}" ] || force_skip="${1#force-skip=}"
ca7245
		[ "x${1#nesting-too-deep=}" = "x${1}" ] || nesting_too_deep="${1#nesting-too-deep=}"
ca7245
ca7245
		shift
ca7245
	done
ca7245
ca7245
	case "${dep_type}" in
ca7245
	required)
ca7245
		[ "x${dep_name%/*}" = "x${dep_name}" ] || {
ca7245
			debug "${check} error: dependency name (${dep_name})" \
ca7245
			      "cannot contain slashes"
ca7245
			echo 9
ca7245
			return
ca7245
		}
ca7245
ca7245
		[ "${MAX_NESTING_LEVEL}" -ge "$cur_level" ] || {
ca7245
			local reason="nesting level is too deep (${cur_level}) and nesting-too-deep='${nesting_too_deep}'"
ca7245
ca7245
			case "$nesting_too_deep" in
ca7245
			success) debug "${check} succeeded: ${reason}"; echo 0 ;;
ca7245
			fail)    debug "${check} failed: ${reason}"; echo 1 ;;
ca7245
			skip)    debug "${check} skipped: ${reason}"; echo 2 ;;
ca7245
			*)       debug "${check} error: invalid" \
ca7245
				       "nesting-too-deep mode" \
ca7245
				       "(${nesting_too_deep})"; echo 9 ;;
ca7245
			esac
ca7245
ca7245
			return
ca7245
		}
ca7245
ca7245
		case "${match_model_mode}" in
ca7245
		same) ;;
ca7245
		on)   match_model=1 ;;
ca7245
		off)  match_model=0 ;;
ca7245
		*)
ca7245
			debug "${check} error: invalid match-model-mode" \
ca7245
			      "(${match_model_mode})"
ca7245
			echo 9
ca7245
			return
ca7245
			;;
ca7245
		esac
ca7245
ca7245
		local result=0
ca7245
		debug "${check}: calling check_caveat '${dep_name}'" \
ca7245
		      "'$(($cur_level + 1))' match_model=${match_model}"
ca7245
		check_caveat "${dep_name}" "$(($cur_level + 1))" > /dev/null || result="$?"
ca7245
ca7245
		match_model="${old_match_model}"
ca7245
ca7245
		case "${result}" in
ca7245
		0) debug "${check} succeeded: result=${result}"; echo "${result}" ;;
ca7245
		1) debug "${check} failed: result=${result}"; echo "${result}" ;;
ca7245
		2)
ca7245
			local reason="result=${result} and skip='${skip}'"
ca7245
ca7245
			case "${skip}" in
ca7245
			success) debug "${check} succeeded: ${reason}"; echo 0 ;;
ca7245
			fail)    debug "${check} failed: ${reason}"; echo 1 ;;
ca7245
			skip)    debug "${check} skipped: ${reason}"; echo 2 ;;
ca7245
			*)       debug "${check} error: unexpected skip=" \
ca7245
				       "setting (${skip})"; echo 9 ;;
ca7245
			esac
ca7245
			;;
ca7245
		3)
ca7245
			local reason="result=${result} and force_skip='${force_skip}'"
ca7245
ca7245
			case "${force_skip}" in
ca7245
			success) debug "${check} succeeded: ${reason}"; echo 0 ;;
ca7245
			fail)    debug "${check} failed: ${reason}"; echo 1 ;;
ca7245
			skip)    debug "${check} skipped: ${reason}"; echo 2 ;;
ca7245
			*)       debug "${check} error: unexpected force-skip=" \
ca7245
				       "setting (${skip})"; echo 9 ;;
ca7245
			esac
ca7245
			;;
ca7245
		*)
ca7245
			debug "${check} error: unexpected check_caveat result" \
ca7245
			      "(${result})"; echo 9 ;;
ca7245
		esac
ca7245
		;;
ca7245
	*)
ca7245
		debug "${check} error: unknown dependency type '${dep_type}'"
ca7245
		echo 9
ca7245
		;;
6e6257
	esac
6e6257
}
6e6257
c59b13
# Provides model in format "VENDOR_ID FAMILY-MODEL-STEPPING"
c59b13
#
c59b13
# We check only the first processor as we don't expect non-symmetrical setups
c59b13
# with CPUs with caveats
c59b13
get_model_string()
c59b13
{
c59b13
	/usr/bin/printf "%s %02x-%02x-%02x" \
c59b13
		$(/bin/sed -rn '1,/^$/{
c59b13
			s/^vendor_id[[:space:]]*: (.*)$/\1/p;
c59b13
			s/^cpu family[[:space:]]*: (.*)$/\1/p;
c59b13
			s/^model[[:space:]]*: (.*)$/\1/p;
c59b13
			s/^stepping[[:space:]]*: (.*)$/\1/p;
c59b13
		}' /proc/cpuinfo)
c59b13
}
c59b13
c59b13
get_model_name()
c59b13
{
c59b13
	/bin/sed -rn '1,/^$/s/^model name[[:space:]]*: (.*)$/\1/p' /proc/cpuinfo
c59b13
}
c59b13
c59b13
get_vendor_id()
c59b13
{
c59b13
	/bin/sed -rn '1,/^$/s/^vendor_id[[:space:]]*: (.*)$/\1/p' /proc/cpuinfo
c59b13
}
c59b13
c59b13
get_mc_path()
c59b13
{
c59b13
	case "$1" in
c59b13
	GenuineIntel)
c59b13
		echo "intel-ucode/$2"
c59b13
		;;
c59b13
	AuthenticAMD)
c59b13
		echo "amd-ucode/$2"
c59b13
		;;
5532bf
	*)
5532bf
		# We actually only support Intel ucode, but things may break
5532bf
		# if nothing is printed (input would be gotten from stdin
5532bf
		# otherwise).
5532bf
		echo "invalid"
5532bf
		;;
c59b13
	esac
c59b13
}
c59b13
c59b13
get_mc_ver()
c59b13
{
c59b13
	/bin/sed -rn '1,/^$/s/^microcode[[:space:]]*: (.*)$/\1/p' /proc/cpuinfo
c59b13
}
c59b13
c59b13
c59b13
match_model=0
c59b13
configs=
c59b13
kver=$(/bin/uname -r)
c59b13
verbose=0
c59b13
early_check=0
078ac8
print_disclaimers=0
c59b13
c59b13
ret=0
c59b13
078ac8
while getopts "dek:c:mv" opt; do
c59b13
	case "${opt}" in
078ac8
	d)
078ac8
		print_disclaimers=1
078ac8
		early_check=2
078ac8
		;;
c59b13
	e)
c59b13
		early_check=1
c59b13
		;;
c59b13
	k)
c59b13
		kver="$OPTARG"
c59b13
		;;
c59b13
	c)
c59b13
		configs="$configs $OPTARG"
c59b13
		;;
c59b13
	m)
c59b13
		match_model=1
c59b13
		;;
c59b13
	v)
c59b13
		verbose=1
c59b13
		;;
c59b13
	*)
c59b13
		usage
c59b13
		exit 1;
c59b13
		;;
c59b13
	esac
c59b13
done
c59b13
3a6b56
: "${configs:=$(find "${MC_CAVEATS_DATA_DIR}" -maxdepth 1 -mindepth 1 -type d -printf "%f\n")}"
c59b13
c59b13
cpu_model=$(get_model_string)
c59b13
cpu_model_name=$(get_model_name)
c59b13
cpu_vendor=$(get_vendor_id)
c59b13
c59b13
ret_paths=""
c59b13
ok_paths=""
c59b13
fail_paths=""
c59b13
c59b13
ret_cfgs=""
c59b13
ok_cfgs=""
c59b13
fail_cfgs=""
c59b13
c59b13
skip_cfgs=""
c59b13
c59b13
if [ 1 -eq "$early_check" ]; then
c59b13
	stage="early"
c59b13
else
c59b13
	stage="late"
c59b13
fi
c59b13
ca7245
# check_caveat CFG [CHECK_LEVEL]
5532bf
# changes ret_paths, ok_paths, fail_paths, ret_cfgs, ok_cfgs, fail_cfgs,
ca7245
# skip_cfgs if CHECK_LEVEL is set to 0 (default).
ca7245
# CHECK_LEVEL is used for recursive configuration dependency checks,
ca7245
# and indicates nesting level.
5532bf
# Return value:
5532bf
#  0 - check is successful
5532bf
#  1 - check has been failed
5532bf
#  2 - configuration has been skipped
ca7245
#  3 - configuration has been skipped due to presence of an override file
5532bf
check_caveat() {
5532bf
	local cfg="$1"
ca7245
	local check_level="${2:-0}"
5532bf
	local dir="$MC_CAVEATS_DATA_DIR/$cfg"
c59b13
c59b13
	[ -r "${dir}/readme" ] || {
c59b13
		debug "File 'readme' in ${dir} is not found, skipping"
5532bf
		return 2
c59b13
	}
c59b13
c59b13
	[ -r "${dir}/config" ] || {
c59b13
		debug "File 'config' in ${dir} is not found, skipping"
5532bf
		return 2
c59b13
	}
c59b13
5532bf
	local cfg_model=
5532bf
	local cfg_vendor=
5532bf
	local cfg_path=
5532bf
	local cfg_kvers=
5532bf
	local cfg_kvers_early=
5532bf
	local cfg_mc_min_ver_late=
5532bf
	local cfg_disable=
5532bf
	local cfg_pci=
5532bf
	local cfg_dmi=
ca7245
	local cfg_dependency=
5532bf
5532bf
	local key
5532bf
	local value
c59b13
c59b13
	while read -r key value; do
c59b13
		case "$key" in
c59b13
		model)
c59b13
			cfg_model="$value"
c59b13
			;;
c59b13
		vendor)
c59b13
			cfg_vendor="$value"
c59b13
			;;
c59b13
		path)
c59b13
			cfg_path="$cfg_path $value"
c59b13
			;;
c59b13
		kernel)
c59b13
			cfg_kvers="$cfg_kvers $value"
c59b13
			;;
c59b13
		kernel_early)
c59b13
			cfg_kvers_early="$cfg_kvers_early $value"
c59b13
			;;
c59b13
		mc_min_ver_late)
c59b13
			cfg_mc_min_ver_late="$value"
c59b13
			;;
c59b13
		disable)
c59b13
			cfg_disable="$cfg_disable $value "
c59b13
			;;
3a6b56
		pci_config_val)
3a6b56
			cfg_pci="$cfg_pci
3a6b56
				$value"
3a6b56
			;;
6e6257
		dmi)
6e6257
			cfg_dmi="$cfg_dmi
6e6257
				$value"
6e6257
			;;
ca7245
		dependency)
ca7245
			cfg_dependency="$cfg_dependency
ca7245
				$value"
ca7245
			;;
3a6b56
		'#'*|'')
3a6b56
			continue
3a6b56
			;;
3a6b56
		*)
3a6b56
			debug "Unknown key '$key' (value '$value') in config" \
3a6b56
			      "'$cfg'"
c59b13
			;;
c59b13
		esac
c59b13
	done < "${dir}/config"
c59b13
c59b13
	debug "${cfg}: model '$cfg_model', path '$cfg_path', kvers '$cfg_kvers'"
ca7245
	echo "$cfg_path"
c59b13
c59b13
	# Check for override files in the following order:
c59b13
	#  - disallow early/late specific caveat for specific kernel
c59b13
	#  - force early/late specific caveat for specific kernel
c59b13
	#  - disallow specific caveat for specific kernel
c59b13
	#  - force specific caveat for specific kernel
c59b13
	#
c59b13
	#  - disallow early/late specific caveat for any kernel
c59b13
	#  - disallow early/late any caveat for specific kernel
c59b13
	#  - force early/late specific caveat for any kernel
c59b13
	#  - force early/late any caveat for specific kernel
c59b13
	#  - disallow specific caveat for any kernel
c59b13
	#  - disallow any caveat for specific kernel
c59b13
	#  - force specific caveat for any kernel
c59b13
	#  - force any caveat for specific kernel
c59b13
	#
c59b13
	#  - disallow early/late everything
c59b13
	#  - force early/late everyhting
c59b13
	#  - disallow everything
c59b13
	#  - force everyhting
5532bf
	local ignore_cfg=0
5532bf
	local force_cfg=0
5532bf
	local override_file=""
5532bf
	local overrides="
c59b13
	0:$FW_DIR/$kver/disallow-$stage-$cfg
c59b13
	1:$FW_DIR/$kver/force-$stage-$cfg
c59b13
	0:$FW_DIR/$kver/disallow-$cfg
c59b13
	1:$FW_DIR/$kver/force-$cfg
c59b13
	0:$FW_DIR/$kver/disallow-$stage
c59b13
	0:$CFG_DIR/disallow-$stage-$cfg
c59b13
	1:$FW_DIR/$kver/force-$stage
c59b13
	1:$CFG_DIR/force-$stage-$cfg
c59b13
	0:$FW_DIR/$kver/disallow
c59b13
	0:$CFG_DIR/disallow-$cfg
c59b13
	1:$FW_DIR/$kver/force
c59b13
	1:$CFG_DIR/force-$cfg
c59b13
	0:$CFG_DIR/disallow-$stage
c59b13
	1:$CFG_DIR/force-$stage
c59b13
	0:$CFG_DIR/disallow
c59b13
	1:$CFG_DIR/force"
5532bf
	local o
5532bf
	local o_force
5532bf
	local override_file
c59b13
	for o in $(echo "$overrides"); do
c59b13
		o_force=${o%%:*}
c59b13
		override_file=${o#$o_force:}
c59b13
c59b13
		[ -e "$override_file" ] || continue
c59b13
c59b13
		if [ 0 -eq "$o_force" ]; then
c59b13
			ignore_cfg=1
c59b13
		else
c59b13
			force_cfg=1
c59b13
		fi
c59b13
c59b13
		break
c59b13
	done
c59b13
c59b13
	[ 0 -eq "$ignore_cfg" ] || {
c59b13
		debug "Configuration \"$cfg\" is ignored due to presence of" \
c59b13
		      "\"$override_file\"."
ca7245
		return 3
c59b13
	}
c59b13
c59b13
	# Check model if model filter is enabled
c59b13
	if [ 1 -eq "$match_model" -a  -n "$cfg_model" ]; then
c59b13
		[ "x$cpu_model" = "x$cfg_model" ] || {
c59b13
			debug "Current CPU model '$cpu_model' doesn't" \
c59b13
			      "match configuration CPU model '$cfg_model'," \
c59b13
			      "skipping"
5532bf
			return 2
c59b13
		}
c59b13
	fi
c59b13
c59b13
	# Check paths if model filter is enabled
5532bf
	local cpu_mc_path
5532bf
	local cfg_mc_present
c59b13
	if [ 1 -eq "$match_model" -a  -n "$cfg_path" ]; then
c59b13
		cpu_mc_path="$MC_CAVEATS_DATA_DIR/$cfg/$(get_mc_path \
c59b13
			"$cpu_vendor" "${cpu_model#* }")"
c59b13
		cfg_mc_present=0
c59b13
c59b13
		for p in $(printf "%s" "$cfg_path"); do
7fc171
			/usr/bin/find "$MC_CAVEATS_DATA_DIR/$cfg" \
7fc171
				-path "$MC_CAVEATS_DATA_DIR/$cfg/$p" -print0 \
7fc171
			    | /bin/grep -zFxc "$cpu_mc_path" > /dev/null \
c59b13
			    || continue
c59b13
c59b13
			cfg_mc_present=1
3a6b56
			break
c59b13
		done
c59b13
c59b13
		[ 1 = "$cfg_mc_present" ] || {
c59b13
			debug "No matching microcode files in '$cfg_path'" \
c59b13
			      "for CPU model '$cpu_model', skipping"
5532bf
			return 2
c59b13
		}
c59b13
	fi
c59b13
c59b13
	# Check vendor if model filter is enabled
c59b13
	if [ 1 -eq "$match_model" -a  -n "$cfg_vendor" ]; then
c59b13
		[ "x$cpu_vendor" = "x$cfg_vendor" ] || {
c59b13
			debug "Current CPU vendor '$cpu_vendor' doesn't" \
c59b13
			      "match configuration CPU vendor '$cfg_vendor'," \
c59b13
			      "skipping"
5532bf
			return 2
c59b13
		}
c59b13
	fi
c59b13
ca7245
	# Has to be performed before dependency checks
c59b13
	[ 0 -eq "$force_cfg" ] || {
c59b13
		debug "Checks for configuration \"$cfg\" are ignored due to" \
c59b13
		      "presence of \"$override_file\"."
c59b13
5532bf
		return 0
c59b13
	}
c59b13
ca7245
	# Check dependencies
ca7245
	# It has to be performed here (before adding configuration
ca7245
	# to $ret_cfgs/$ret_paths) since it may be skipped.
ca7245
	if [ -n "$cfg_dependency" ]; then
ca7245
		dep_line="$(printf "%s\n" "$cfg_dependency" | \
ca7245
			while read -r dep_type dep_name dep_opts
ca7245
			do
ca7245
				[ -n "$dep_type" ] || continue
ca7245
				dep_res=$(check_dependency "$check_level" \
ca7245
							   "$dep_type" \
ca7245
							   "$dep_name" \
ca7245
							   "$dep_opts")
ca7245
				[ 0 != "$dep_res" ] || continue
ca7245
				echo "$dep_res $dep_type $dep_name $dep_opts"
ca7245
				break
ca7245
			done
ca7245
			echo "0 ")"
ca7245
ca7245
		case "${dep_line%% *}" in
ca7245
		0) ;;
ca7245
		2)
ca7245
			debug "Dependency check '${dep_line#* }'" \
ca7245
			      "induced configuration skip"
ca7245
			return 2
ca7245
			;;
ca7245
		*)
ca7245
			debug "Dependency check '${dep_line#* }'" \
ca7245
			      "failed (with return code ${dep_line%% *})"
ca7245
			return 1
ca7245
			;;
ca7245
		esac
ca7245
	fi
ca7245
ca7245
	# Check configuration files
ca7245
c59b13
	[ "x${cfg_disable%%* $stage *}" = "x$cfg_disable" ] || {
c59b13
		debug "${cfg}: caveat is disabled in configuration"
5532bf
		return 1
c59b13
	}
c59b13
c59b13
	# Check late load kernel version
c59b13
	if [ 1 -ne "$early_check" -a -n "$cfg_kvers" ]; then
c59b13
		check_kver "$kver" $cfg_kvers || {
c59b13
			debug "${cfg}: late load kernel version check for" \
c59b13
			      " '$kver' against '$cfg_kvers' failed"
5532bf
			return 1
c59b13
		}
c59b13
	fi
c59b13
c59b13
	# Check early load kernel version
c59b13
	if [ 0 -ne "$early_check" -a -n "$cfg_kvers_early" ]; then
c59b13
		check_kver "$kver" $cfg_kvers_early || {
c59b13
			debug "${cfg}: early load kernel version check for" \
c59b13
			      "'$kver' against '$cfg_kvers_early' failed"
5532bf
			return 1
c59b13
		}
c59b13
	fi
c59b13
c59b13
	# Check current microcode version for the late update
c59b13
	if [ -n "$cfg_mc_min_ver_late" -a 1 -ne "$early_check" -a \
c59b13
	   "x$cpu_model" = "x$cfg_model" ]; then
c59b13
		cpu_mc_ver="$(get_mc_ver)"
c59b13
c59b13
		[ 1 -eq $((cpu_mc_ver >= cfg_mc_min_ver_late)) ] || {
c59b13
			debug "${cfg}: CPU microcode version $cpu_mc_ver" \
c59b13
			      "failed check (should be at least" \
c59b13
			      "${cfg_mc_min_ver_late})"
5532bf
			return 1
c59b13
		}
c59b13
	fi
c59b13
3a6b56
	# Check PCI devices if model filter is enabled
3a6b56
	# Note that the model filter check is done inside check_pci_config_val
3a6b56
	# based on the 'mode=' parameter.
3a6b56
	if [ -n "$cfg_pci" ]; then
ebb8cf
		pci_line="$(printf "%s\n" "$cfg_pci" | while read -r pci_line; do
ebb8cf
				[ -n "$pci_line" ] || continue
ebb8cf
				pci_res=$(check_pci_config_val "$pci_line" \
ebb8cf
							       "$match_model")
ebb8cf
				[ 0 != "$pci_res" ] || continue
ebb8cf
				echo "$pci_res $pci_line"
ebb8cf
				break
ebb8cf
			done
ebb8cf
			echo "0 ")"
ebb8cf
ebb8cf
		[ -z "${pci_line#* }" ] || {
ebb8cf
			debug "PCI configuration word check '${pci_line#* }'" \
ebb8cf
			      "failed (with return code ${pci_line%% *})"
5532bf
			return 1
3a6b56
		}
3a6b56
	fi
3a6b56
6e6257
	# Check DMI data if model filter is enabled
ca7245
	# Note that the model filter check is done inside check_dmi_val
ca7245
	# (which returns the value of 'no-model-mode=' parameter
ca7245
	# if it is disenaged).
6e6257
	if [ -n "$cfg_dmi" ]; then
6e6257
		dmi_line="$(printf "%s\n" "$cfg_dmi" | while read -r dmi_line
6e6257
			do
6e6257
				[ -n "$dmi_line" ] || continue
6e6257
				dmi_res=$(check_dmi_val "$dmi_line" \
6e6257
							"$match_model")
6e6257
				[ 0 != "$dmi_res" ] || continue
6e6257
				echo "$dmi_res $dmi_line"
6e6257
				break
6e6257
			done
6e6257
			echo "0 ")"
6e6257
6e6257
		[ -z "${dmi_line#* }" ] || {
6e6257
			debug "DMI data check '${dmi_line#* }'" \
6e6257
			      "failed (with return code ${dmi_line%% *})"
5532bf
			return 1
6e6257
		}
6e6257
	fi
6e6257
5532bf
	return 0
5532bf
}
5532bf
5532bf
for cfg in $(echo "${configs}"); do
ca7245
	if cfg_path=$(check_caveat "$cfg"; exit "$?")
ca7245
	then
ca7245
		ret_cfgs="$ret_cfgs $cfg"
ca7245
		ret_paths="$ret_paths $cfg_path"
ca7245
		ok_cfgs="$ok_cfgs $cfg"
ca7245
		ok_paths="$ok_paths $cfg_path"
ca7245
	else
ca7245
		case "$?" in
ca7245
		1)
ca7245
			ret=1
ca7245
ca7245
			ret_cfgs="$ret_cfgs $cfg"
ca7245
			ret_paths="$ret_paths $cfg_path"
ca7245
			fail_cfgs="$fail_cfgs $cfg"
ca7245
			fail_paths="$fail_paths $cfg_path"
ca7245
ca7245
			[ 0 -eq "$print_disclaimers" ] \
ca7245
				|| [ ! -e "${MC_CAVEATS_DATA_DIR}/${cfg}/disclaimer" ] \
ca7245
				|| /bin/cat "${MC_CAVEATS_DATA_DIR}/${cfg}/disclaimer"
ca7245
			;;
ca7245
		2|3)
ca7245
			skip_cfgs="$skip_cfgs $cfg";
ca7245
			;;
ca7245
		*)
ca7245
			debug "Unexpected check_caveat return code '$?'" \
ca7245
			      "for config '$cfg'"
ca7245
			;;
ca7245
		esac
ca7245
	fi
c59b13
done
c59b13
078ac8
[ 0 -eq "$print_disclaimers" ] || exit 0
078ac8
c59b13
echo "cfgs$ret_cfgs"
c59b13
echo "skip_cfgs$skip_cfgs"
c59b13
echo "paths$ret_paths"
c59b13
echo "ok_cfgs$ok_cfgs"
c59b13
echo "ok_paths$ok_paths"
c59b13
echo "fail_cfgs$fail_cfgs"
c59b13
echo "fail_paths$fail_paths"
c59b13
c59b13
exit $ret