[xen stable-4.20] x86/ucode: Work around Granite Rapids erraturm GNR98

[patchbot@xxxxxxx]

commit afd8175444ed7be2a3c1ab5f6ad542d082414ddc
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Sep 10 12:40:03 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Sep 10 12:40:03 2026 +0200

    x86/ucode: Work around Granite Rapids erraturm GNR98
    
    Block loads which are known to hang the system.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Teddy Astie <teddy.astie@xxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 70cbd9a08d6542185fabb14f91c61b63ec4cb2ec
    master date: 2026-09-09 18:07:32 +0100
---
 xen/arch/x86/cpu/microcode/intel.c | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/xen/arch/x86/cpu/microcode/intel.c 
b/xen/arch/x86/cpu/microcode/intel.c
index 3f8e9ca63b..368bbb18cc 100644
--- a/xen/arch/x86/cpu/microcode/intel.c
+++ b/xen/arch/x86/cpu/microcode/intel.c
@@ -24,6 +24,7 @@
 #include <xen/err.h>
 #include <xen/init.h>
 
+#include <asm/intel-family.h>
 #include <asm/msr.h>
 #include <asm/system.h>
 
@@ -269,6 +270,46 @@ static bool microcode_fits_cpu(const struct 
microcode_patch *mc)
     return false;
 }
 
+static bool microcode_safe_to_load(const struct microcode_patch *mc)
+{
+    const struct cpu_signature *cpu_sig = &this_cpu(cpu_sig);
+
+    /*
+     * Treat pre-production as always safe - anyone using pre-production
+     * microcode knows what they are doing, and can keep any resulting pieces.
+     */
+    if ( (int)cpu_sig->rev < 0 || mc->rev < 0 )
+        return true;
+
+    /*
+     * GNR98 states that Granite Rapids systems hang when loading new ucode on
+     * sufficiently old firmware.  GNR101 retroactively states that one ucode
+     * had an incorrect minimum revision field, in light of discovering GNR98.
+     *
+     * Both are incomplete statements of the problem.
+     *
+     * At the time of writing (August 2026), the believed safe sequence is:
+     *   previous -> [0x01000380...0x010003f3] -> 0x01000405 -> any later
+     *
+     * Disallow known-unsafe loads while permitting believed-safe loads.  For
+     * GNR, this allows multi-hop loading to get up to the latest.
+     */
+    if ( boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+         boot_cpu_data.x86 == 6 &&
+         boot_cpu_data.x86_model == INTEL_FAM6_GRANITERAPIDS_X &&
+         boot_cpu_data.x86_mask == 1 && (cpu_sig->pf & 0x95) &&
+         ((cpu_sig->rev < 0x01000380 && mc->rev >= 0x01000405) ||
+          (cpu_sig->rev < 0x01000405 && mc->rev >  0x01000405)) )
+    {
+        printk_once(XENLOG_WARNING "microcode: Granite Rapids erratum GNR98 
detected.  Skipping ucode 0x%08x\n"
+                    XENLOG_WARNING "microcode: Firmware update recommended\n",
+                    mc->rev);
+        return false;
+    }
+
+    return true;
+}
+
 static int cf_check intel_compare(
     const struct microcode_patch *old, const struct microcode_patch *new)
 {
@@ -361,6 +402,7 @@ static struct microcode_patch *cf_check 
cpu_request_microcode(
          * one with higher revision.
          */
         if ( microcode_fits_cpu(mc) &&
+             microcode_safe_to_load(mc) &&
              (!saved || compare_revisions(saved->rev, mc->rev) == NEW_UCODE) )
             saved = mc;
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20