13 files changed, 74 insertions, 25 deletions

diff --git a/Makefile.inc b/Makefile.inc
index 2741b19ffa..0c7cf8add0 100644
--- a/Makefile.inc
+++ b/Makefile.inc
@@ -1054,7 +1054,7 @@ ifeq ($(CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_HEADER),y)
 	$(FIT_OPTIONS)
 endif
 
-ifeq ($(CONFIG_CPU_MICROCODE_CBFS_GENERATE),y)
+ifeq ($(CONFIG_USE_CPU_MICROCODE_CBFS_BINS),y)
 	@printf "    UPDATE-FIT\n"
 	$(CBFSTOOL) $@.tmp update-fit -n cpu_microcode_blob.bin -x $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) \
 	$(FIT_OPTIONS)
diff --git a/src/cpu/Kconfig b/src/cpu/Kconfig
index a7cb99e4b3..f98ce6d0eb 100644
--- a/src/cpu/Kconfig
+++ b/src/cpu/Kconfig
@@ -84,14 +84,43 @@ config USES_MICROCODE_HEADER_FILES
 	  This is selected by a board or chipset to set the default for the
 	  microcode source choice to a list of external microcode headers
 
+config MICROCODE_BLOB_NOT_IN_BLOB_REPO
+	bool
+	help
+	  Selected by platforms that don't maintain microcode updates in the
+	  blobs repo yet.
+
+config MICROCODE_BLOB_NOT_HOOKED_UP
+	bool
+	help
+	  Selected by platforms that haven't hooked microcode updates up yet.
+
+config MICROCODE_BLOB_UNDISCLOSED
+	bool
+	help
+	  Selected by work-in-progress platforms that don't have microcode
+	  updates available yet.
+
+config USE_CPU_MICROCODE_CBFS_BINS
+	bool
+	help
+	  Automatically selected below to add binary microcode files
+	  (`cpu_microcode_bins` in the makefiles) to CBFS.
+
 choice
 	prompt "Include CPU microcode in CBFS" if ARCH_X86
 	default CPU_MICROCODE_CBFS_EXTERNAL_HEADER if USES_MICROCODE_HEADER_FILES
-	default CPU_MICROCODE_CBFS_GENERATE if SUPPORT_CPU_UCODE_IN_CBFS && USE_BLOBS
-	default CPU_MICROCODE_CBFS_NONE if !SUPPORT_CPU_UCODE_IN_CBFS
+	default CPU_MICROCODE_CBFS_NONE if MICROCODE_BLOB_NOT_IN_BLOB_REPO || \
+					   MICROCODE_BLOB_NOT_HOOKED_UP || \
+					   MICROCODE_BLOB_UNDISCLOSED
+	depends on SUPPORT_CPU_UCODE_IN_CBFS
 
-config CPU_MICROCODE_CBFS_GENERATE
+config CPU_MICROCODE_CBFS_DEFAULT_BINS
 	bool "Generate from tree"
+	select USE_CPU_MICROCODE_CBFS_BINS
+	depends on !(MICROCODE_BLOB_NOT_IN_BLOB_REPO || \
+		     MICROCODE_BLOB_NOT_HOOKED_UP || \
+		     MICROCODE_BLOB_UNDISCLOSED)
 	help
 	  Select this option if you want microcode updates to be assembled when
 	  building coreboot and included in the final image as a separate CBFS
@@ -102,8 +131,27 @@ config CPU_MICROCODE_CBFS_GENERATE
 
 	  If unsure, select this option.
 
+config CPU_MICROCODE_CBFS_EXTERNAL_BINS
+	bool "Include external microcode binary"
+	select USE_CPU_MICROCODE_CBFS_BINS
+	depends on !CPU_MICROCODE_MULTIPLE_FILES
+	help
+	  Select this option if you want to include external binary files
+	  in the CPUs native format. They will be included as a separate
+	  file in CBFS.
+
+	  A word of caution: only select this option if you are sure the
+	  microcode that you have is newer than the microcode shipping with
+	  coreboot.
+
+	  The microcode file may be removed from the ROM image at a later
+	  time with cbfstool, if desired.
+
+	  If unsure, and applicable, select "Generate from tree"
+
 config CPU_MICROCODE_CBFS_EXTERNAL_HEADER
 	bool "Include external microcode header files"
+	depends on !CPU_MICROCODE_MULTIPLE_FILES
 	help
 	  Select this option if you want to include external c header files
 	  containing the CPU microcode. This will be included as a separate
@@ -116,25 +164,17 @@ config CPU_MICROCODE_CBFS_EXTERNAL_HEADER
 	  The microcode file may be removed from the ROM image at a later
 	  time with cbfstool, if desired.
 
-	  If unsure, select "Generate from tree"
+	  If unsure, and applicable, select "Generate from tree"
 
 config CPU_MICROCODE_CBFS_NONE
 	bool "Do not include microcode updates"
 	help
 	  Select this option if you do not want CPU microcode included in CBFS.
-	  Note that for some CPUs, the microcode is hard-coded into the source
-	  tree and is not loaded from CBFS. In this case, microcode will still
-	  be updated. There is a push to move all microcode to CBFS, but this
-	  change is not implemented for all CPUs.
-
-	  This option currently applies to:
-	    - Intel SandyBridge/IvyBridge
-	    - VIA Nano
 
 	  Microcode may be added to the ROM image at a later time with cbfstool,
 	  if desired.
 
-	  If unsure, select "Generate from tree"
+	  If unsure, and applicable, select "Generate from tree"
 
 	  The GOOD:
 	  Microcode updates intend to solve issues that have been discovered
@@ -164,8 +204,6 @@ endchoice
 
 config CPU_MICROCODE_MULTIPLE_FILES
 	bool
-	default n
-	depends on CPU_MICROCODE_CBFS_GENERATE
 	help
 	  Select this option to install separate microcode container files into
 	  CBFS instead of using the traditional monolithic microcode file format.
@@ -179,7 +217,7 @@ config CPU_MICROCODE_HEADER_FILES
 
 config CPU_UCODE_BINARIES
 	string "Microcode binary path and filename"
-	depends on CPU_MICROCODE_CBFS_GENERATE
+	depends on CPU_MICROCODE_CBFS_EXTERNAL_BINS
 	default ""
 	help
 	  Some platforms have microcode in the blobs directory, and these can
diff --git a/src/cpu/Makefile.inc b/src/cpu/Makefile.inc
index 72fc29c1e0..66ee2f9169 100644
--- a/src/cpu/Makefile.inc
+++ b/src/cpu/Makefile.inc
@@ -17,7 +17,7 @@ $(eval $(call create_class_compiler,cpu_microcode,x86_32))
 ################################################################################
 
 ifneq ($(CONFIG_CPU_MICROCODE_MULTIPLE_FILES), y)
-cbfs-files-$(CONFIG_CPU_MICROCODE_CBFS_GENERATE)  += cpu_microcode_blob.bin
+cbfs-files-$(CONFIG_USE_CPU_MICROCODE_CBFS_BINS) += cpu_microcode_blob.bin
 endif
 
 ifeq ($(CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_HEADER),y)
@@ -29,6 +29,11 @@ $(objgenerated)/microcode.bin: $(call strip_quotes,$(CONFIG_CPU_MICROCODE_HEADER
 	util/scripts/ucode_h_to_bin.sh $(objgenerated)/microcode.bin $(CONFIG_CPU_MICROCODE_HEADER_FILES)
 endif
 
+ifeq ($(CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_BINS),y)
+cpu_microcode_bins := $(call strip_quotes,$(CONFIG_CPU_UCODE_BINARIES))
+endif
+# otherwise `cpu_microcode_bins` should be filled by platform makefiles
+
 # We just mash all microcode binaries together into one binary to rule them all.
 # This approach assumes that the microcode binaries are properly padded, and
 # their headers specify the correct size. This works fairly well on isolatied
@@ -44,14 +49,15 @@ $(obj)/cpu_microcode_blob.bin: $$(wildcard $$(cpu_microcode_bins))
 		fi; \
 	done; \
 	if [ -n "$$NO_MICROCODE_FILE" ]; then \
-		if [ -z "$(CONFIG_USE_BLOBS)" ] && [ -n "$(CONFIG_CPU_MICROCODE_CBFS_GENERATE)" ]; then \
+		if [ -z "$(CONFIG_USE_BLOBS)" ] && [ -n "$(CONFIG_CPU_MICROCODE_CBFS_DEFAULT_BINS)" ]; then \
 			echo "Try enabling binary-only repository in Kconfig 'General setup' menu."; \
 		fi; \
 		false; \
 	fi
+	$(if $^,,false) # fail if no file is given at all
 	@printf "    MICROCODE  $(subst $(obj)/,,$(@))\n"
 	@echo $(cpu_microcode_bins)
-	cat /dev/null $+ > $@
+	cat $^ > $@
 
 cpu_microcode_blob.bin-file ?= $(obj)/cpu_microcode_blob.bin
 cpu_microcode_blob.bin-type := microcode
diff --git a/src/cpu/amd/family_10h-family_15h/Kconfig b/src/cpu/amd/family_10h-family_15h/Kconfig
index cd3db0e420..8ff685f0c1 100644
--- a/src/cpu/amd/family_10h-family_15h/Kconfig
+++ b/src/cpu/amd/family_10h-family_15h/Kconfig
@@ -9,7 +9,7 @@ config CPU_AMD_MODEL_10XXX
 	select UDELAY_LAPIC
 	select HAVE_MONOTONIC_TIMER
 	select SUPPORT_CPU_UCODE_IN_CBFS
-	select CPU_MICROCODE_MULTIPLE_FILES if !CPU_MICROCODE_CBFS_NONE
+	select CPU_MICROCODE_MULTIPLE_FILES
 	select ACPI_HUGE_LOWMEM_BACKUP
 
 if CPU_AMD_MODEL_10XXX
diff --git a/src/cpu/amd/family_10h-family_15h/Makefile.inc b/src/cpu/amd/family_10h-family_15h/Makefile.inc
index 2ed76e1e1f..7035323026 100644
--- a/src/cpu/amd/family_10h-family_15h/Makefile.inc
+++ b/src/cpu/amd/family_10h-family_15h/Makefile.inc
@@ -15,11 +15,11 @@ ramstage-y += monotonic_timer.c
 ramstage-$(CONFIG_HAVE_ACPI_TABLES) += powernow_acpi.c
 
 # Microcode for Family 10h, 11h, 12h, and 14h
-cbfs-files-$(CONFIG_CPU_MICROCODE_MULTIPLE_FILES) += microcode_amd.bin
+cbfs-files-$(CONFIG_CPU_MICROCODE_CBFS_DEFAULT_BINS) += microcode_amd.bin
 microcode_amd.bin-file := 3rdparty/blobs/cpu/amd/family_10h-family_14h/microcode_amd.bin
 microcode_amd.bin-type := microcode
 
 # Microcode for Family 15h
-cbfs-files-$(CONFIG_CPU_MICROCODE_MULTIPLE_FILES) += microcode_amd_fam15h.bin
+cbfs-files-$(CONFIG_CPU_MICROCODE_CBFS_DEFAULT_BINS) += microcode_amd_fam15h.bin
 microcode_amd_fam15h.bin-file := 3rdparty/blobs/cpu/amd/family_15h/microcode_amd_fam15h.bin
 microcode_amd_fam15h.bin-type := microcode
diff --git a/src/cpu/intel/fsp_model_406dx/Kconfig b/src/cpu/intel/fsp_model_406dx/Kconfig
index 4c79b239b6..79658f9817 100644
--- a/src/cpu/intel/fsp_model_406dx/Kconfig
+++ b/src/cpu/intel/fsp_model_406dx/Kconfig
@@ -29,6 +29,7 @@ config CPU_SPECIFIC_OPTIONS
 	select SSE2
 	select UDELAY_LAPIC
 	select SUPPORT_CPU_UCODE_IN_CBFS
+	select MICROCODE_BLOB_NOT_IN_BLOB_REPO
 	select PARALLEL_CPU_INIT
 	select TSC_SYNC_MFENCE
 	select LAPIC_MONOTONIC_TIMER
diff --git a/src/cpu/intel/microcode/Makefile.inc b/src/cpu/intel/microcode/Makefile.inc
index b56e6a7e79..f589430771 100644
--- a/src/cpu/intel/microcode/Makefile.inc
+++ b/src/cpu/intel/microcode/Makefile.inc
@@ -4,5 +4,3 @@
 ################################################################################
 ramstage-$(CONFIG_SUPPORT_CPU_UCODE_IN_CBFS) += microcode.c
 romstage-$(CONFIG_SUPPORT_CPU_UCODE_IN_CBFS) += microcode.c
-
-cpu_microcode_bins += $(call strip_quotes,$(CONFIG_CPU_UCODE_BINARIES))
diff --git a/src/soc/intel/apollolake/Kconfig b/src/soc/intel/apollolake/Kconfig
index 7a5a11c840..bc1a80575d 100644
--- a/src/soc/intel/apollolake/Kconfig
+++ b/src/soc/intel/apollolake/Kconfig
@@ -31,6 +31,7 @@ config CPU_SPECIFIC_OPTIONS
 	select CPU_INTEL_FIRMWARE_INTERFACE_TABLE
 	select IOAPIC
 	select PCR_COMMON_IOSF_1_0
+	select MICROCODE_BLOB_NOT_HOOKED_UP
 	select SMP
 	select SSE2
 	select SUPPORT_CPU_UCODE_IN_CBFS
diff --git a/src/soc/intel/braswell/Kconfig b/src/soc/intel/braswell/Kconfig
index d0a250aad3..340ee76180 100644
--- a/src/soc/intel/braswell/Kconfig
+++ b/src/soc/intel/braswell/Kconfig
@@ -17,6 +17,7 @@ config CPU_SPECIFIC_OPTIONS
 	select CACHE_RELOCATED_RAMSTAGE_OUTSIDE_CBMEM
 	select COLLECT_TIMESTAMPS
 	select SUPPORT_CPU_UCODE_IN_CBFS
+	select MICROCODE_BLOB_NOT_IN_BLOB_REPO
 	select CPU_INTEL_TURBO_NOT_PACKAGE_SCOPED
 	select HAVE_MONOTONIC_TIMER
 	select HAVE_SMI_HANDLER
diff --git a/src/soc/intel/cannonlake/Kconfig b/src/soc/intel/cannonlake/Kconfig
index f8193cd754..a3390d80de 100644
--- a/src/soc/intel/cannonlake/Kconfig
+++ b/src/soc/intel/cannonlake/Kconfig
@@ -46,6 +46,7 @@ config CPU_SPECIFIC_OPTIONS
 	select PARALLEL_MP
 	select PARALLEL_MP_AP_WORK
 	select PLATFORM_USES_FSP2_0
+	select MICROCODE_BLOB_NOT_HOOKED_UP
 	select POSTCAR_CONSOLE
 	select POSTCAR_STAGE
 	select REG_SCRIPT
diff --git a/src/soc/intel/fsp_baytrail/Kconfig b/src/soc/intel/fsp_baytrail/Kconfig
index 7d82f3f49d..5228bb7ae4 100644
--- a/src/soc/intel/fsp_baytrail/Kconfig
+++ b/src/soc/intel/fsp_baytrail/Kconfig
@@ -41,6 +41,7 @@ config CPU_SPECIFIC_OPTIONS
 	select TSC_SYNC_MFENCE
 	select UDELAY_TSC
 	select SUPPORT_CPU_UCODE_IN_CBFS
+	select MICROCODE_BLOB_NOT_HOOKED_UP
 	select INTEL_DESCRIPTOR_MODE_CAPABLE
 	select HAVE_SPI_CONSOLE_SUPPORT
 
diff --git a/src/soc/intel/fsp_broadwell_de/Kconfig b/src/soc/intel/fsp_broadwell_de/Kconfig
index 197e365f74..051cd42b2b 100644
--- a/src/soc/intel/fsp_broadwell_de/Kconfig
+++ b/src/soc/intel/fsp_broadwell_de/Kconfig
@@ -20,6 +20,7 @@ config CPU_SPECIFIC_OPTIONS
 	select IOAPIC
 	select UDELAY_TSC
 	select SUPPORT_CPU_UCODE_IN_CBFS
+	select MICROCODE_BLOB_NOT_HOOKED_UP
 	# Microcode header files are delivered in FSP package
 	select USES_MICROCODE_HEADER_FILES if HAVE_FSP_BIN
 	select INTEL_DESCRIPTOR_MODE_CAPABLE
diff --git a/src/soc/intel/icelake/Kconfig b/src/soc/intel/icelake/Kconfig
index 1d687f0224..34af3395a6 100644
--- a/src/soc/intel/icelake/Kconfig
+++ b/src/soc/intel/icelake/Kconfig
@@ -33,6 +33,7 @@ config CPU_SPECIFIC_OPTIONS
 	select PARALLEL_MP
 	select PARALLEL_MP_AP_WORK
 	select PLATFORM_USES_FSP2_0
+	select MICROCODE_BLOB_UNDISCLOSED
 	select POSTCAR_CONSOLE
 	select POSTCAR_STAGE
 	select REG_SCRIPT