1 /* $NetBSD: errata.c,v 1.33 2023/07/28 05:02:13 mrg Exp $ */ 2 3 /*- 4 * Copyright (c) 2007 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Andrew Doran. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Detect, report on, and work around known errata with x86 CPUs. 34 * 35 * This currently only handles AMD CPUs, and is generalised because 36 * there are quite a few problems that the BIOS can patch via MSR, 37 * but it is not known if the OS can patch these yet. The list is 38 * expected to grow over time. 39 * 40 * The data here are from: Revision Guide for AMD Athlon 64 and 41 * AMD Opteron Processors, Publication #25759, Revision: 3.69, 42 * Issue Date: September 2006 43 * 44 * https://www.amd.com/system/files/TechDocs/25759.pdf 45 * 46 * XXX This should perhaps be integrated with the identcpu code. 47 */ 48 49 #include <sys/cdefs.h> 50 __KERNEL_RCSID(0, "$NetBSD: errata.c,v 1.33 2023/07/28 05:02:13 mrg Exp $"); 51 52 #include <sys/types.h> 53 #include <sys/systm.h> 54 55 #include <machine/cpu.h> 56 #include <machine/cpufunc.h> 57 #include <machine/specialreg.h> 58 59 #include <x86/cpuvar.h> 60 #include <x86/cputypes.h> 61 62 typedef struct errata { 63 u_short e_num; 64 u_short e_reported; 65 u_int e_data1; 66 const uint8_t *e_set; 67 bool (*e_act)(struct cpu_info *, struct errata *); 68 uint64_t e_data2; 69 } errata_t; 70 71 /* These names match names from various AMD Errata/Revision Guides. */ 72 typedef enum cpurev { 73 /* K8 / Family 0Fh */ 74 BH_E4, CH_CG, CH_D0, DH_CG, DH_D0, DH_E3, DH_E6, JH_E1, 75 JH_E6, SH_B0, SH_B3, SH_C0, SH_CG, SH_D0, SH_E4, SH_E5, 76 77 /* K10 / Family 10h */ 78 DR_BA, DR_B2, DR_B3, RB_C2, RB_C3, BL_C2, BL_C3, DA_C2, 79 DA_C3, HY_D0, HY_D1, HY_D1_G34R1, PH_E0, 80 81 /* Llano / Family 12h */ 82 LN_B0, 83 84 /* Jaguar / Family 16h */ 85 KB_A1, ML_A1, 86 87 /* Zen/Zen+/Zen2 / Family 17h */ 88 ZP_B1, ZP_B2, PiR_B2, Rome_B0, 89 90 /* XXX client Zen2 names aren't known yet. */ 91 Z2_XB, Z2_Ren, Z2_Luc, Z2_Mat, Z2_VG, Z2_Men, 92 93 /* Zen3/Zen4 / Family 19h */ 94 Milan_B1, Milan_B2, Genoa_B1, 95 OINK 96 } cpurev_t; 97 98 /* 99 * The bit-layout in the 0x80000001 CPUID result is, with bit-size 100 * as the final number here: 101 * 102 * resv1_4 extfam_8 extmodel_4 resv2_4 fam_4 model_4 stepping_4 103 * 104 * The CPUREV(family,model,stepping) macro handles the mapping for 105 * family 6 and family 15 in the "fam_4" nybble, if 6 or 15, the 106 * extended model is present and is bit-concatenated, and if 15, 107 * the extended family is additional (ie, family 0x10 is 0xF in 108 * fam_4 and 0x01 in extfam_8.) 109 */ 110 #define CPUREV(fam,mod,step) \ 111 (((fam) > 0xf ? \ 112 (0xf << 8) | ((fam) - 0xf) << 20 : \ 113 (fam) << 8) | \ 114 (((mod) & 0xf) << 4) | \ 115 (((fam) == 6 || ((fam) >= 0xf)) ? \ 116 ((mod) & 0xf0) << 12 : 0) | \ 117 ((step) & 0xf)) 118 static const u_int cpurevs[] = { 119 BH_E4, CPUREV(0x0F, 0x2B, 0x1), 120 CH_CG, CPUREV(0x0F, 0x08, 0x2), 121 CH_CG, CPUREV(0x0F, 0x0B, 0x2), 122 CH_D0, CPUREV(0x0F, 0x18, 0x0), 123 CH_D0, CPUREV(0x0F, 0x1B, 0x0), 124 DH_CG, CPUREV(0x0F, 0x0C, 0x0), 125 DH_CG, CPUREV(0x0F, 0x0E, 0x0), 126 DH_CG, CPUREV(0x0F, 0x0F, 0x0), 127 DH_D0, CPUREV(0x0F, 0x1C, 0x0), 128 DH_D0, CPUREV(0x0F, 0x1F, 0x0), 129 DH_E3, CPUREV(0x0F, 0x2C, 0x0), 130 DH_E3, CPUREV(0x0F, 0x2F, 0x0), 131 DH_E6, CPUREV(0x0F, 0x2C, 0x2), 132 DH_E6, CPUREV(0x0F, 0x2F, 0x2), 133 JH_E1, CPUREV(0x0F, 0x21, 0x0), 134 JH_E6, CPUREV(0x0F, 0x21, 0x2), 135 JH_E6, CPUREV(0x0F, 0x23, 0x2), 136 SH_B0, CPUREV(0x0F, 0x04, 0x0), 137 SH_B3, CPUREV(0x0F, 0x05, 0x1), 138 SH_C0, CPUREV(0x0F, 0x04, 0x8), 139 SH_C0, CPUREV(0x0F, 0x05, 0x8), 140 SH_CG, CPUREV(0x0F, 0x04, 0xA), 141 SH_CG, CPUREV(0x0F, 0x05, 0xA), 142 SH_CG, CPUREV(0x0F, 0x07, 0xA), 143 SH_D0, CPUREV(0x0F, 0x14, 0x0), 144 SH_D0, CPUREV(0x0F, 0x15, 0x0), 145 SH_D0, CPUREV(0x0F, 0x17, 0x0), 146 SH_E4, CPUREV(0x0F, 0x25, 0x1), 147 SH_E4, CPUREV(0x0F, 0x27, 0x1), 148 SH_E5, CPUREV(0x0F, 0x24, 0x2), 149 150 DR_BA, CPUREV(0x10, 0x02, 0xA), 151 DR_B2, CPUREV(0x10, 0x02, 0x2), 152 DR_B3, CPUREV(0x10, 0x02, 0x3), 153 RB_C2, CPUREV(0x10, 0x04, 0x2), 154 RB_C3, CPUREV(0x10, 0x04, 0x3), 155 BL_C2, CPUREV(0x10, 0x05, 0x2), 156 BL_C3, CPUREV(0x10, 0x05, 0x3), 157 DA_C2, CPUREV(0x10, 0x06, 0x2), 158 DA_C3, CPUREV(0x10, 0x06, 0x3), 159 HY_D0, CPUREV(0x10, 0x08, 0x0), 160 HY_D1, CPUREV(0x10, 0x08, 0x1), 161 HY_D1_G34R1, CPUREV(0x10, 0x09, 0x1), 162 PH_E0, CPUREV(0x10, 0x0A, 0x0), 163 164 LN_B0, CPUREV(0x12, 0x01, 0x0), 165 166 KB_A1, CPUREV(0x16, 0x00, 0x1), 167 ML_A1, CPUREV(0x16, 0x30, 0x1), 168 169 ZP_B1, CPUREV(0x17, 0x01, 0x1), 170 ZP_B2, CPUREV(0x17, 0x01, 0x2), 171 PiR_B2, CPUREV(0x17, 0x08, 0x2), 172 Rome_B0, CPUREV(0x17, 0x31, 0x0), 173 Z2_XB, CPUREV(0x17, 0x47, 0x0), 174 Z2_Ren, CPUREV(0x17, 0x60, 0x1), 175 Z2_Luc, CPUREV(0x17, 0x68, 0x1), 176 Z2_Mat, CPUREV(0x17, 0x71, 0x0), 177 Z2_VG, CPUREV(0x17, 0x90, 0x2), 178 Z2_Men, CPUREV(0x17, 0xA0, 0x0), 179 180 Milan_B1, CPUREV(0x19, 0x01, 0x1), 181 Milan_B2, CPUREV(0x19, 0x01, 0x2), 182 Genoa_B1, CPUREV(0x19, 0x11, 0x1), 183 OINK 184 }; 185 186 static const uint8_t x86_errata_set1[] = { 187 SH_B3, SH_C0, SH_CG, DH_CG, CH_CG, OINK 188 }; 189 190 static const uint8_t x86_errata_set2[] = { 191 SH_B3, SH_C0, SH_CG, DH_CG, CH_CG, SH_D0, DH_D0, CH_D0, OINK 192 }; 193 194 static const uint8_t x86_errata_set3[] = { 195 JH_E1, DH_E3, OINK 196 }; 197 198 static const uint8_t x86_errata_set4[] = { 199 SH_C0, SH_CG, DH_CG, CH_CG, SH_D0, DH_D0, CH_D0, JH_E1, 200 DH_E3, SH_E4, BH_E4, SH_E5, DH_E6, JH_E6, OINK 201 }; 202 203 static const uint8_t x86_errata_set5[] = { 204 SH_B3, OINK 205 }; 206 207 static const uint8_t x86_errata_set6[] = { 208 SH_C0, SH_CG, DH_CG, CH_CG, OINK 209 }; 210 211 static const uint8_t x86_errata_set7[] = { 212 SH_C0, SH_CG, DH_CG, CH_CG, SH_D0, DH_D0, CH_D0, OINK 213 }; 214 215 static const uint8_t x86_errata_set8[] = { 216 BH_E4, CH_CG, CH_CG, CH_D0, CH_D0, DH_CG, DH_CG, DH_CG, 217 DH_D0, DH_D0, DH_E3, DH_E3, DH_E6, DH_E6, JH_E1, JH_E6, 218 JH_E6, SH_B0, SH_B3, SH_C0, SH_C0, SH_CG, SH_CG, SH_CG, 219 SH_D0, SH_D0, SH_D0, SH_E4, SH_E4, SH_E5, OINK 220 }; 221 222 static const uint8_t x86_errata_set9[] = { 223 DR_BA, DR_B2, OINK 224 }; 225 226 static const uint8_t x86_errata_set10[] = { 227 DR_BA, DR_B2, DR_B3, OINK 228 }; 229 230 static const uint8_t x86_errata_set11[] = { 231 DR_BA, DR_B2, DR_B3, RB_C2, RB_C3, BL_C2, BL_C3, DA_C2, 232 DA_C3, HY_D0, HY_D1, HY_D1_G34R1, PH_E0, LN_B0, OINK 233 }; 234 235 static const uint8_t x86_errata_set12[] = { 236 KB_A1, OINK 237 }; 238 239 static const uint8_t x86_errata_set13[] = { 240 ZP_B1, ZP_B2, PiR_B2, OINK 241 }; 242 243 static const uint8_t x86_errata_set14[] = { 244 ZP_B1, OINK 245 }; 246 247 static const uint8_t x86_errata_set15[] = { 248 KB_A1, ML_A1, OINK 249 }; 250 251 static const uint8_t x86_errata_set16[] = { 252 Rome_B0, Z2_XB, Z2_Ren, Z2_Luc, Z2_Mat, Z2_VG, Z2_Men, OINK 253 }; 254 255 static bool x86_errata_setmsr(struct cpu_info *, errata_t *); 256 static bool x86_errata_testmsr(struct cpu_info *, errata_t *); 257 258 static errata_t errata[] = { 259 /* 260 * 81: Cache Coherency Problem with Hardware Prefetching 261 * and Streaming Stores 262 */ 263 { 264 81, FALSE, MSR_DC_CFG, x86_errata_set5, 265 x86_errata_testmsr, DC_CFG_DIS_SMC_CHK_BUF 266 }, 267 /* 268 * 86: DRAM Data Masking Feature Can Cause ECC Failures 269 */ 270 { 271 86, FALSE, MSR_NB_CFG, x86_errata_set1, 272 x86_errata_testmsr, NB_CFG_DISDATMSK 273 }, 274 /* 275 * 89: Potential Deadlock With Locked Transactions 276 */ 277 { 278 89, FALSE, MSR_NB_CFG, x86_errata_set8, 279 x86_errata_testmsr, NB_CFG_DISIOREQLOCK 280 }, 281 /* 282 * 94: Sequential Prefetch Feature May Cause Incorrect 283 * Processor Operation 284 */ 285 { 286 94, FALSE, MSR_IC_CFG, x86_errata_set1, 287 x86_errata_testmsr, IC_CFG_DIS_SEQ_PREFETCH 288 }, 289 /* 290 * 97: 128-Bit Streaming Stores May Cause Coherency 291 * Failure 292 * 293 * XXX "This workaround must not be applied to processors 294 * prior to revision C0." We don't apply it, but if it 295 * can't be applied, it shouldn't be reported. 296 */ 297 { 298 97, FALSE, MSR_DC_CFG, x86_errata_set6, 299 x86_errata_testmsr, DC_CFG_DIS_CNV_WC_SSO 300 }, 301 /* 302 * 104: DRAM Data Masking Feature Causes ChipKill ECC 303 * Failures When Enabled With x8/x16 DRAM Devices 304 */ 305 { 306 104, FALSE, MSR_NB_CFG, x86_errata_set7, 307 x86_errata_testmsr, NB_CFG_DISDATMSK 308 }, 309 /* 310 * 113: Enhanced Write-Combining Feature Causes System Hang 311 */ 312 { 313 113, FALSE, MSR_BU_CFG, x86_errata_set3, 314 x86_errata_setmsr, BU_CFG_WBENHWSBDIS 315 }, 316 /* 317 * 69: Multiprocessor Coherency Problem with Hardware 318 * Prefetch Mechanism 319 */ 320 { 321 69, FALSE, MSR_BU_CFG, x86_errata_set5, 322 x86_errata_setmsr, BU_CFG_WBPFSMCCHKDIS 323 }, 324 /* 325 * 101: DRAM Scrubber May Cause Data Corruption When Using 326 * Node-Interleaved Memory 327 */ 328 { 329 101, FALSE, 0, x86_errata_set2, 330 NULL, 0 331 }, 332 /* 333 * 106: Potential Deadlock with Tightly Coupled Semaphores 334 * in an MP System 335 */ 336 { 337 106, FALSE, MSR_LS_CFG, x86_errata_set2, 338 x86_errata_testmsr, LS_CFG_DIS_LS2_SQUISH 339 }, 340 /* 341 * 107: Possible Multiprocessor Coherency Problem with 342 * Setting Page Table A/D Bits 343 */ 344 { 345 107, FALSE, MSR_BU_CFG, x86_errata_set2, 346 x86_errata_testmsr, BU_CFG_THRL2IDXCMPDIS 347 }, 348 /* 349 * 122: TLB Flush Filter May Cause Coherency Problem in 350 * Multiprocessor Systems 351 */ 352 { 353 122, FALSE, MSR_HWCR, x86_errata_set4, 354 x86_errata_setmsr, HWCR_FFDIS 355 }, 356 /* 357 * 254: Internal Resource Livelock Involving Cached TLB Reload 358 */ 359 { 360 254, FALSE, MSR_BU_CFG, x86_errata_set9, 361 x86_errata_testmsr, BU_CFG_ERRATA_254 362 }, 363 /* 364 * 261: Processor May Stall Entering Stop-Grant Due to Pending Data 365 * Cache Scrub 366 */ 367 { 368 261, FALSE, MSR_DC_CFG, x86_errata_set10, 369 x86_errata_testmsr, DC_CFG_ERRATA_261 370 }, 371 /* 372 * 298: L2 Eviction May Occur During Processor Operation To Set 373 * Accessed or Dirty Bit 374 */ 375 { 376 298, FALSE, MSR_HWCR, x86_errata_set9, 377 x86_errata_testmsr, HWCR_TLBCACHEDIS 378 }, 379 { 380 298, FALSE, MSR_BU_CFG, x86_errata_set9, 381 x86_errata_testmsr, BU_CFG_ERRATA_298 382 }, 383 /* 384 * 309: Processor Core May Execute Incorrect Instructions on 385 * Concurrent L2 and Northbridge Response 386 */ 387 { 388 309, FALSE, MSR_BU_CFG, x86_errata_set9, 389 x86_errata_testmsr, BU_CFG_ERRATA_309 390 }, 391 /* 392 * 721: Processor May Incorrectly Update Stack Pointer 393 */ 394 { 395 721, FALSE, MSR_DE_CFG, x86_errata_set11, 396 x86_errata_setmsr, DE_CFG_ERRATA_721 397 }, 398 /* 399 * 776: Incorrect Processor Branch Prediction for Two Consecutive 400 * Linear Pages 401 */ 402 { 403 776, FALSE, MSR_IC_CFG, x86_errata_set12, 404 x86_errata_setmsr, IC_CFG_ERRATA_776 405 }, 406 /* 407 * 793: Specific Combination of Writes to Write Combined Memory 408 * Types and Locked Instructions May Cause Core Hang 409 */ 410 { 411 793, FALSE, MSR_LS_CFG, x86_errata_set15, 412 x86_errata_setmsr, LS_CFG_ERRATA_793 413 }, 414 /* 415 * 1021: Load Operation May Receive Stale Data From Older Store 416 * Operation 417 */ 418 { 419 1021, FALSE, MSR_DE_CFG, x86_errata_set13, 420 x86_errata_setmsr, DE_CFG_ERRATA_1021 421 }, 422 /* 423 * 1033: A Lock Operation May Cause the System to Hang 424 */ 425 { 426 1033, FALSE, MSR_LS_CFG, x86_errata_set14, 427 x86_errata_setmsr, LS_CFG_ERRATA_1033 428 }, 429 /* 430 * 1049: FCMOV Instruction May Not Execute Correctly 431 */ 432 { 433 1049, FALSE, MSR_FP_CFG, x86_errata_set13, 434 x86_errata_setmsr, FP_CFG_ERRATA_1049 435 }, 436 #if 0 /* Should we apply this errata? The other OSes don't. */ 437 /* 438 * 1091: Address Boundary Crossing Load Operation May Receive 439 * Stale Data 440 */ 441 { 442 1091, FALSE, MSR_LS_CFG2, x86_errata_set13, 443 x86_errata_setmsr, LS_CFG2_ERRATA_1091 444 }, 445 #endif 446 /* 447 * 1095: Potential Violation of Read Ordering In Lock Operation 448 * In SMT (Simultaneous Multithreading) Mode 449 */ 450 { 451 1095, FALSE, MSR_LS_CFG, x86_errata_set13, 452 x86_errata_setmsr, LS_CFG_ERRATA_1095 453 }, 454 /* 455 * Zenbleed: 456 * https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html 457 * https://github.com/google/security-research/security/advisories/GHSA-v6wh-rxpg-cmm8 458 * https://lock.cmpxchg8b.com/zenbleed.html 459 */ 460 { 461 -1, FALSE, MSR_DE_CFG, x86_errata_set16, 462 x86_errata_setmsr, DE_CFG_ERRATA_ZENBLEED, 463 }, 464 }; 465 466 static bool 467 x86_errata_testmsr(struct cpu_info *ci, errata_t *e) 468 { 469 uint64_t val; 470 471 (void)ci; 472 473 val = rdmsr_locked(e->e_data1); 474 if ((val & e->e_data2) != 0) 475 return FALSE; 476 477 e->e_reported = TRUE; 478 return TRUE; 479 } 480 481 static bool 482 x86_errata_setmsr(struct cpu_info *ci, errata_t *e) 483 { 484 uint64_t val; 485 486 (void)ci; 487 488 val = rdmsr_locked(e->e_data1); 489 if ((val & e->e_data2) != 0) 490 return FALSE; 491 wrmsr_locked(e->e_data1, val | e->e_data2); 492 aprint_debug_dev(ci->ci_dev, "erratum %d patched\n", 493 e->e_num); 494 495 return FALSE; 496 } 497 498 void 499 x86_errata(void) 500 { 501 struct cpu_info *ci; 502 uint32_t descs[4]; 503 errata_t *e, *ex; 504 cpurev_t rev; 505 int i, j, upgrade; 506 static int again; 507 508 /* don't run if we are under a hypervisor */ 509 if (cpu_feature[1] & CPUID2_RAZ) 510 return; 511 512 /* only for AMD */ 513 if (cpu_vendor != CPUVENDOR_AMD) 514 return; 515 516 ci = curcpu(); 517 518 x86_cpuid(0x80000001, descs); 519 if (CPU_IS_PRIMARY(ci)) { 520 aprint_verbose_dev(ci->ci_dev, 521 "searching errata for cpu revision 0x%08"PRIx32"\n", 522 descs[0]); 523 } 524 525 for (i = 0;; i += 2) { 526 if ((rev = cpurevs[i]) == OINK) 527 return; 528 if (cpurevs[i + 1] == descs[0]) 529 break; 530 } 531 532 ex = errata + __arraycount(errata); 533 for (upgrade = 0, e = errata; e < ex; e++) { 534 if (e->e_reported) 535 continue; 536 if (e->e_set != NULL) { 537 for (j = 0; e->e_set[j] != OINK; j++) 538 if (e->e_set[j] == rev) 539 break; 540 if (e->e_set[j] == OINK) 541 continue; 542 } 543 544 aprint_debug_dev(ci->ci_dev, "testing for erratum %d\n", 545 e->e_num); 546 547 if (e->e_act == NULL) 548 e->e_reported = TRUE; 549 else if ((*e->e_act)(ci, e) == FALSE) 550 continue; 551 552 aprint_verbose_dev(ci->ci_dev, "erratum %d present\n", 553 e->e_num); 554 upgrade = 1; 555 } 556 557 if (upgrade && !again) { 558 again = 1; 559 aprint_normal_dev(ci->ci_dev, "WARNING: errata present," 560 " BIOS upgrade may be\n"); 561 aprint_normal_dev(ci->ci_dev, "WARNING: necessary to ensure" 562 " reliable operation\n"); 563 } 564 } 565