[M] Change in coreboot[master]: {cpu, security}: Stitch multiple microcodes per CPUID into CBFS

[Subrata Banik (Code Review)]

Attention is currently required from: Arthur Heymans, Himanshu Sahdev, Julius Werner, Lean Sheng Tan, Rizwan Qureshi, Tarun Tuli, Wonkyu Kim, Yu-Ping Wu.

Hello Arthur Heymans, Julius Werner, Kapil Porwal, Lean Sheng Tan, Nick Vaccaro, Rizwan Qureshi, Tarun Tuli, Wonkyu Kim, Yu-Ping Wu, build bot (Jenkins),

I'd like you to reexamine a change. Please visit

https://review.coreboot.org/c/coreboot/+/75357?usp=email

to look at the new patch set (#15).

The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)

Change subject: {cpu, security}: Stitch multiple microcodes per CPUID into CBFS
......................................................................

{cpu, security}: Stitch multiple microcodes per CPUID into CBFS

The current design of the `ucode-<variant>.bin` file combines all
possible microcode per cpuid into a unified blob. This model increases
the microcode loading time from RW CBFS due to higher CBFS verification
time (the bigger the CBFS binary the longer the verification takes).

This patch creates a provision to pack individual microcodes (per CPUID)
into the CBFS (RO and RWs). Implementation logic introduces
CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config which relies on converting
Intel CPU microcode INC file into the binary file as per format
specified as in “cpu_microcode_$(CPUID).bin”.

For example: Intel CPU microcode `m506e3.inc` to convert into
"cpu_microcode_506e3.bin" binary file for coreboot to integrate if
CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config is enabled.

Another config named CPU_INTEL_UCODE_SPLIT_BINARIES is used to specify
the directory name (including path) that holds the split microcode
binary files per CPUID for each coreboot variants.

For example: if google/kunimitsu had built with Intel SkyLake processor
with CPUID "506e3" and "506e4" then CPU_INTEL_UCODE_SPLIT_BINARIES
refers to the directory path that holds the split microcode binary
files aka cpu_microcode_506e3.bin and cpu_microcode_506e4.bin.

Refer to the file representation below:
  ├── 3rdparty
  │   ├── blobs
  │   │   ├── mainboard
  │   │   │   ├── google
  │   │   │   │   ├── kunimitsu
  │   │   │   │   │   │── microcode_inputs
  │   │   │   │   │   │   │── kunimitsu
  │   │   │   │   │   │   │   ├── cpu_microcode_506e3.bin
  │   │   │   │   │   │   │   ├── cpu_microcode_506e4.bin

Users of this config option requires to manually place the microcode
binary files per CPUIDs as per the given format
(`cpu_microcode_$(CPUID).bin`) in a directory. Finally specify the
microcode binary directory path using CPU_UCODE_SPLIT_BINARIES config.

Additionally, modified the `find_cbfs_microcode()` logic to search
microcode from CBFS by CPUID. This change will improve the microcode
verification time from the CBFS, and will make it easier to update
individual microcodes.

BUG=b:242473942
TEST=emerge-rex sys-firmware/mtl-ucode-firmware-private
coreboot-private-files-baseboard-rex coreboot

Able to optimize ~10ms of boot time while loading microcode using
below configuration.

CONFIG_CPU_MICROCODE_CBFS_SPLIT_BINS=y
CONFIG_CPU_UCODE_SPLIT_BINARIES="3rdparty/blobs/mainboard/
               $(CONFIG_MAINBOARD_DIR)/microcode_inputs"

Without this patch:

10:start of ramstage           1,005,139 (44)
  971:loading FSP-S              1,026,619 (21,479)
> RO/RW-A/RW-B CBFS contains unified cpu_microcode_blob.bin

Name                           Offset     Type           Size   Comp
  ...
  cpu_microcode_blob.bin         0x1f740    microcode      273408 none
  intel_fit                      0x623c0    intel_fit          80 none
  ...
  ...
  bootblock                      0x3ee200   bootblock       32192 none

With this patch:

10:start of ramstage           997,495 (43)
  971:loading FSP-S              1,010,148 (12,653)
> RO/RW-A/B CBFS that stores split microcode files per CPUID

FMAP REGION: FW_MAIN_A
  Name                           Offset     Type           Size   Comp
  fallback/romstage              0x0        stage          127632 none
  cpu_microcode_a06a1.bin        0x1f340    microcode      137216 none
  cpu_microcode_a06a2.bin        0x40bc0    microcode      136192 none
  ...
  ...
  ecrw                           0x181280   raw            327680 none
  fallback/payload               0x1d1300   simple elf     127443 none

At reset, able to load the correct microcode using FIT table (RO CBFS)

[NOTE ]  coreboot-coreboot-unknown.9999.3ad3153 Sat May 20 12:29:19
           UTC 2023 x86_32 bootblock starting (log level: 8)...
  [DEBUG]  CPU: Genuine Intel(R) 0000
  [DEBUG]  CPU: ID a06a1, MeteorLake A0, ucode: 00000016

Able to find `cpu_microcode_a06a1.bin` on google/rex with ES1 CPU
stepping (w/ CPUID 0xA06A1) (from RW CBFS)

localhost ~ # cbmem -c -1 | grep microcode
  [DEBUG]  microcode: sig=0xa06a1 pf=0x80 revision=0x16
  [INFO ]  CBFS: Found 'cpu_microcode_a06a1.bin' @0x407c0 size 0x21800 in
           mcache @0x75c0d0e0
  [INFO ]  microcode: Update skipped, already up-to-date

Signed-off-by: Subrata Banik 
Change-Id: Ic7db73335ffa25399869cfb0d59129ee118f1012
---
M src/cpu/intel/microcode/Kconfig
M src/cpu/intel/microcode/Makefile.inc
M src/cpu/intel/microcode/microcode.c
3 files changed, 108 insertions(+), 4 deletions(-)

git pull ssh://review.coreboot.org:29418/coreboot refs/changes/57/75357/15