cpu: Enable per-CPUID microcode loading in CBFS

The current design of the `ucode-<variant>.bin` file combines all
possible microcode per cpuid into a unified blob. This model increases
the microcode loading time from RW CBFS due to higher CBFS verification
time (the bigger the CBFS binary the longer the verification takes).

This patch creates a provision to pack individual microcodes (per CPUID)
into the CBFS (RO and RWs). Implementation logic introduces
CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config which relies on converting
Intel CPU microcode INC file into the binary file as per format
specified as in `cpu_microcode_$(CPUID).bin`.

For example: Intel CPU microcode `m506e3.inc` to convert into
`cpu_microcode_506e3.bin` binary file for coreboot to integrate if
CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config is enabled.

Another config named CPU_INTEL_UCODE_SPLIT_BINARIES is used to specify
the directory name (including path) that holds the split microcode
binary files per CPUID for each coreboot variants.

For example: if google/kunimitsu had built with Intel SkyLake processor
with CPUID `506e3` and `506e4` then CPU_INTEL_UCODE_SPLIT_BINARIES
refers to the directory path that holds the split microcode binary
files aka cpu_microcode_506e3.bin and cpu_microcode_506e4.bin.

Refer to the file representation below:
|---3rdparty
|   |--- blobs
|   |    |--- mainboard
|   |    |   |--- google
|   |    |   |    |--- kunimitsu
|   |    |   |    |    |--- microcode_inputs
|   |    |   |    |    |    |--- kunimitsu
|   |    |   |    |    |    |    |--- cpu_microcode_506e3.bin
|   |    |   |    |    |    |    |--- cpu_microcode_506e4.bin

Users of this config option requires to manually place the microcode
binary files per CPUIDs as per the given format
(`cpu_microcode_$(CPUID).bin`) in a directory. Finally specify the
microcode binary directory path using CPU_UCODE_SPLIT_BINARIES config.

Additionally, modified the `find_cbfs_microcode()` logic to search
microcode from CBFS by CPUID. This change will improve the microcode
verification time from the CBFS, and will make it easier to update
individual microcodes.

BUG=b:242473942
TEST=emerge-rex sys-firmware/mtl-ucode-firmware-private
coreboot-private-files-baseboard-rex coreboot

Able to optimize ~10ms of boot time while loading microcode using
below configuration.

CONFIG_CPU_MICROCODE_CBFS_SPLIT_BINS=y
CONFIG_CPU_UCODE_SPLIT_BINARIES="3rdparty/blobs/mainboard/
               $(CONFIG_MAINBOARD_DIR)/microcode_inputs"

Without this patch:

  10:start of ramstage           1,005,139 (44)
  971:loading FSP-S              1,026,619 (21,479)

> RO/RW-A/RW-B CBFS contains unified cpu_microcode_blob.bin

  Name                           Offset     Type           Size   Comp
  ...
  cpu_microcode_blob.bin         0x1f740    microcode      273408 none
  intel_fit                      0x623c0    intel_fit          80 none
  ...
  ...
  bootblock                      0x3ee200   bootblock       32192 none

With this patch:

  10:start of ramstage           997,495 (43)
  971:loading FSP-S              1,010,148 (12,653)

> RO/RW-A/B CBFS that stores split microcode files per CPUID

  FMAP REGION: FW_MAIN_A
  Name                           Offset     Type           Size   Comp
  fallback/romstage              0x0        stage          127632 none
  cpu_microcode_a06a1.bin        0x1f340    microcode      137216 none
  cpu_microcode_a06a2.bin        0x40bc0    microcode      136192 none
  ...
  ...
  ecrw                           0x181280   raw            327680 none
  fallback/payload               0x1d1300   simple elf     127443 none

At reset, able to load the correct microcode using FIT table (RO CBFS)

  [NOTE ]  coreboot-coreboot-unknown.9999.3ad3153 Sat May 20 12:29:19
           UTC 2023 x86_32 bootblock starting (log level: 8)...
  [DEBUG]  CPU: Genuine Intel(R) 0000
  [DEBUG]  CPU: ID a06a1, MeteorLake A0, ucode: 00000016

Able to find `cpu_microcode_a06a1.bin` on google/rex with ES1 CPU
stepping (w/ CPUID 0xA06A1) (from RW CBFS)

  localhost ~ # cbmem -c -1 | grep microcode
  [DEBUG]  microcode: sig=0xa06a1 pf=0x80 revision=0x16
  [INFO ]  CBFS: Found 'cpu_microcode_a06a1.bin' @0x407c0 size 0x21800 in
           mcache @0x75c0d0e0
  [INFO ]  microcode: Update skipped, already up-to-date

Signed-off-by: Subrata Banik <subratabanik@google.com>
Change-Id: Ic7db73335ffa25399869cfb0d59129ee118f1012
Reviewed-on: https://review.coreboot.org/c/coreboot/+/75357
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-by: Lean Sheng Tan <sheng.tan@9elements.com>

5 files changed, 110 insertions, 6 deletions

diff --git a/src/cpu/Kconfig b/src/cpu/Kconfig
index 7d315a46b7..a94872a6f6 100644
--- a/src/cpu/Kconfig
+++ b/src/cpu/Kconfig
@@ -84,7 +84,7 @@ choice
 	default CPU_MICROCODE_CBFS_NONE if MICROCODE_BLOB_NOT_IN_BLOB_REPO || \
 					   MICROCODE_BLOB_NOT_HOOKED_UP || \
 					   MICROCODE_BLOB_UNDISCLOSED
-	depends on SUPPORT_CPU_UCODE_IN_CBFS
+	depends on SUPPORT_CPU_UCODE_IN_CBFS && !CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS
 
 config CPU_MICROCODE_CBFS_DEFAULT_BINS
 	bool "Generate from tree"
diff --git a/src/cpu/intel/fit/Makefile.inc b/src/cpu/intel/fit/Makefile.inc
index d3f12e43e6..da4549e5d1 100644
--- a/src/cpu/intel/fit/Makefile.inc
+++ b/src/cpu/intel/fit/Makefile.inc
@@ -19,7 +19,7 @@ FIT_ENTRY=$(call strip_quotes, $(CONFIG_INTEL_TOP_SWAP_FIT_ENTRY_FMAP_REG))
 
 ifneq ($(CONFIG_UPDATE_IMAGE),y) # never update the bootblock
 
-ifneq ($(CONFIG_CPU_MICROCODE_CBFS_NONE),y)
+ifneq ($(CONFIG_CPU_MICROCODE_CBFS_NONE)$(CONFIG_CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS),y)
 
 $(call add_intermediate, add_mcu_fit, set_fit_ptr $(IFITTOOL))
 	@printf "    UPDATE-FIT Microcode\n"
diff --git a/src/cpu/intel/microcode/Kconfig b/src/cpu/intel/microcode/Kconfig
index f5f9c761e8..4640c16991 100644
--- a/src/cpu/intel/microcode/Kconfig
+++ b/src/cpu/intel/microcode/Kconfig
@@ -16,3 +16,80 @@ config RELOAD_MICROCODE_PATCH
 	  This feature is mostly required with Intel latest generation
 	  processors starting with Alder Lake (with modified MCHECK init
 	  flow).
+
+config CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS
+	bool "For Intel CPU, include microcode per CPUID into CBFS"
+	depends on CBFS_VERIFICATION && !MICROCODE_UPDATE_PRE_RAM
+	default n
+	help
+	  This option controls whether to include external microcode binaries per
+	  CPUID in CBFS.
+
+	  The current approach of loading microcode blobs post CPU reset is to search
+	  the unified blob in the CBFS and then perform the CBFS verification. The bigger
+	  the unified microcode blob in size the longer it takes to perform the verification.
+
+	  Select this option to store the split microcode blobs per CPUID in the CBFS.
+	  As the microcode blobs will be divided into smaller chunks per CPUID, which will
+	  reduce the overall search, verify and load time.
+
+	  The microcode file may be removed from the ROM image at a later
+	  time with cbfstool, if desired.
+
+	  If unsure, and applicable, select "Generate from tree"
+
+config CPU_INTEL_UCODE_SPLIT_BINARIES
+	string "Specify the split microcode blob directory path"
+	depends on CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS
+	default ""
+	help
+	  Provide the split microcode blob directory path if
+	  CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config is enabled.
+
+	  CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config is allowed to pack the individual microcode
+	  patch file per CPUID inside the CBFS.
+
+	  Intel distributes CPU microcode updates based on CPUID as part of the github repository
+	  in INC format and expects it also getting used in binary form.
+
+	  For example: Intel CPU microcode `m506e3.inc` is getting converted into F-MO-S
+	  (06-5e-03) binary file for Linux kernel.
+
+	  `MicrocodeConverter` is an Intel-provided tool for converting binary form MCU into
+	  several other common formats for integration.
+
+	  Implementation logic behind CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config relies on
+	  converting Intel CPU microcode INC file into the binary file as per format specified
+	  here `cpu_microcode_$(CPUID).bin`. For example: Intel CPU microcode `m506e3.inc` to
+	  convert into `cpu_microcode_506e3.bin` binary file for coreboot to integrate if
+	  CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS config is enabled.
+
+	  This config provides the directory name (including path) that holds the split microcode
+	  binary files per CPUID as mentioned above for each coreboot variants. For example: if
+	  google/kunimitsu had built with Intel SkyLake processor with CPUID `506e3` and `506e4`
+	  then CPU_INTEL_UCODE_SPLIT_BINARIES refers to the directory path that holds the split
+	  microcode binary files aka `cpu_microcode_506e3.bin` and `cpu_microcode_506e4.bin`.
+
+	  CONFIG_CPU_UCODE_SPLIT_BINARIES="3rdparty/blobs/mainboard/google/kunimitsu/microcode_inputs/kunimitsu"
+	  Refer to the file representation below:
+	  |---3rdparty
+	  |   |--- blobs
+	  |   |    |--- mainboard
+	  |   |    |   |--- google
+	  |   |    |   |    |--- kunimitsu
+	  |   |    |   |    |    |--- microcode_inputs
+	  |   |    |   |    |    |    |--- kunimitsu
+	  |   |    |   |    |    |    |    |--- cpu_microcode_506e3.bin
+	  |   |    |   |    |    |    |    |--- cpu_microcode_506e4.bin
+
+	  Users of this config option requires to manually place the microcode binary files per
+	  CPUIDs as per the given format (`cpu_microcode_$(CPUID).bin`) in a directory.
+	  Finally specify the microcode binary directory path using CPU_UCODE_SPLIT_BINARIES
+	  config.
+
+	  At runtime (either from romstage/ramstage), coreboot read the CPUID and search for the
+	  `cpu_microcode_$(CPUID).bin` file (in this example: cpu_microcode_506e3.bin) inside RW
+	  CBFS. Eventually able to locate the appropriate `cpu_microcode_$(CPUID).bin` file and
+	  perform the verification prior loading into the CPUs (BSP and APs).
+
+	  If unsure, leave this blank.
diff --git a/src/cpu/intel/microcode/Makefile.inc b/src/cpu/intel/microcode/Makefile.inc
index 119c38fac2..4ea8227e13 100644
--- a/src/cpu/intel/microcode/Makefile.inc
+++ b/src/cpu/intel/microcode/Makefile.inc
@@ -3,3 +3,23 @@ bootblock-$(CONFIG_MICROCODE_UPDATE_PRE_RAM) += microcode_asm.S
 bootblock-$(CONFIG_SUPPORT_CPU_UCODE_IN_CBFS) += microcode.c
 ramstage-$(CONFIG_SUPPORT_CPU_UCODE_IN_CBFS) += microcode.c
 romstage-$(CONFIG_SUPPORT_CPU_UCODE_IN_CBFS) += microcode.c
+
+# Pack individual microcodes per CPUID from CONFIG_CPU_INTEL_UCODE_SPLIT_BINARIES directory into the CBFS.
+ifeq ($(CONFIG_CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS),y)
+microcode-params-dir := $(call strip_quotes,$(CONFIG_CPU_INTEL_UCODE_SPLIT_BINARIES))/
+microcode-params := $(shell find "$(microcode-params-dir)" -type f -exec basename {} \;)
+
+# Make "cpu_microcode_$(CPUID).bin" file entry into the FIT table
+$(call add_intermediate, add_mcu_fit, set_fit_ptr $(IFITTOOL))
+	$(foreach params, $(microcode-params), $(shell $(IFITTOOL) -f $< -a -n $(params) -t 1 \
+		-s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -r COREBOOT)) true
+
+# Add "cpu_microcode_$(CPUID).bin" file into the CBFS
+$(foreach params,$(microcode-params), \
+	$(eval cbfs-files-y += $(params)) \
+	$(eval $(params)-file := $(microcode-params-dir)/$(params)) \
+	$(eval $(params)-type := microcode) \
+	$(eval $(params)-align := $(if $(filter y,$(CONFIG_SOC_AMD_COMMON_BLOCK_LPC_SPI_DMA)),64,16)) \
+)
+
+endif
diff --git a/src/cpu/intel/microcode/microcode.c b/src/cpu/intel/microcode/microcode.c
index 6f6e2f12d0..0d52bafb31 100644
--- a/src/cpu/intel/microcode/microcode.c
+++ b/src/cpu/intel/microcode/microcode.c
@@ -8,6 +8,7 @@
 #include <cpu/intel/microcode.h>
 #include <cpu/x86/msr.h>
 #include <smp/spinlock.h>
+#include <stdio.h>
 #include <types.h>
 
 DECLARE_SPIN_LOCK(microcode_lock)
@@ -170,10 +171,6 @@ static const void *find_cbfs_microcode(void)
 	msr_t msr;
 	struct cpuinfo_x86 c;
 
-	ucode_updates = cbfs_map(MICROCODE_CBFS_FILE, &microcode_len);
-	if (ucode_updates == NULL)
-		return NULL;
-
 	rev = read_microcode_rev();
 	eax = cpuid_eax(1);
 	get_fms(&c, eax);
@@ -188,6 +185,16 @@ static const void *find_cbfs_microcode(void)
 	printk(BIOS_DEBUG, "microcode: sig=0x%x pf=0x%x revision=0x%x\n",
 			sig, pf, rev);
 
+	if (CONFIG(CPU_INTEL_MICROCODE_CBFS_SPLIT_BINS)) {
+		char cbfs_filename[25];
+		snprintf(cbfs_filename, sizeof(cbfs_filename), "cpu_microcode_%x.bin", sig);
+		ucode_updates = cbfs_map(cbfs_filename, &microcode_len);
+	} else {
+		ucode_updates = cbfs_map(MICROCODE_CBFS_FILE, &microcode_len);
+	}
+	if (ucode_updates == NULL)
+		return NULL;
+
 	while (microcode_len >= sizeof(*ucode_updates)) {
 		/* Newer microcode updates include a size field, whereas older
 		 * containers set it at 0 and are exactly 2048 bytes long */