 @@ -1,14 +1,14 @@
-/* $NetBSD: cpu_ucode_amd.c,v 1.2 2012/05/09 13:58:09 cegger Exp $ */
+/* $NetBSD: cpu_ucode_amd.c,v 1.3 2012/05/10 12:35:53 cegger Exp $ */
 /*
  * Copyright (c) 2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Christoph Egger.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -19,27 +19,27 @@
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cpu_ucode_amd.c,v 1.2 2012/05/09 13:58:09 cegger Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cpu_ucode_amd.c,v 1.3 2012/05/10 12:35:53 cegger Exp $");
 #include "opt_xen.h"
 #include "opt_cpu_ucode.h"
 #include <sys/param.h>
 #include <sys/conf.h>
 #include <sys/cpuio.h>
 #include <sys/cpu.h>
 #include <sys/kmem.h>
 #include <sys/xcall.h>
 #include <machine/cpufunc.h>
 #include <machine/specialreg.h>
 @@ -140,32 +140,34 @@ struct mc_buf {
 	struct mpbhdr *mc_mpbuf;
 	struct microcode_amd *mc_amd;
 	int mc_error;
 };
 static void
 cpu_apply_cb(void *arg0, void *arg1)
+{
 	int error = 0;
 	const struct cpu_ucode_softc *sc = arg0;
 	struct microcode_amd mc_amd;
 	struct mc_buf mc;
 	device_t dev;
 	int s;
 	memcpy(&mc, arg1, sizeof(mc));
 	mc_amd.mpb = mc.mc_amd->mpb;
 	mc_amd.mpb_size = mc.mc_amd->mpb_size;
 	dev = curcpu()->ci_dev;
 	s = splhigh();
 	do {
 		uint64_t patchlevel;
 		struct microcode_amd_header *hdr;
 		if (mc.mc_mpbuf->mpb_type != UCODE_TYPE_PATCH) {
 			aprint_debug_dev(dev, "ucode: patch type expected\n");
 			goto next;
+		}
 		hdr = (struct microcode_amd_header *)mc_amd.mpb;
 		if (hdr->ah_processor_rev_id != mc.mc_equiv_cpuid) {
 			aprint_debug_dev(dev, "ucode: patch does not "
 @@ -186,43 +188,52 @@ cpu_apply_cb(void *arg0, void *arg1)
 		if (patchlevel == rdmsr(MSR_UCODE_AMD_PATCHLEVEL)) {
 			aprint_debug_dev(dev, "ucode: update from revision "
 			    "0x%"PRIx64" to 0x%x failed\n",
 			    patchlevel, hdr->ah_patch_id);
 			error = EIO;
 			goto out;
 		} else {
 			/* Success */
 			error = 0;
 			goto out;
+		}
 next:
-		if (mc.mc_mpbuf == NULL)
+		/* Check for race:
 		 * When we booted with -x a cpu might already finished
 		 * (why doesn't xc_wait() wait for *all* cpus?)
 		 * and sc->sc_blob is already freed.
 		 * In this case the calculation below touches
 		 * non-allocated memory and results in a crash.
 		 */
 		if (sc->sc_blob == NULL)
 			break;
 		mc.mc_buf += mc.mc_mpbuf->mpb_len +
 		    sizeof(mc.mc_mpbuf->mpb_type) +
 		    sizeof(mc.mc_mpbuf->mpb_len);
 		mc.mc_mpbuf = (struct mpbhdr *)mc.mc_buf;
 		mc_amd.mpb = (uint8_t *)mc.mc_mpbuf->mpb_data;
 		mc_amd.mpb_size = mc.mc_mpbuf->mpb_len;
 	} while ((uintptr_t)((mc.mc_buf) - (uint8_t *)sc->sc_blob) < sc->sc_blobsize);
 	aprint_error_dev(dev, "ucode: No newer patch available "
 	    "for this cpu than is already installed.\n");
 	error = ENOENT;
 out:
 	if (error)
 		((struct mc_buf *)(arg1))->mc_error = error;
 	splx(s);
+}
 int
 cpu_ucode_amd_apply(struct cpu_ucode_softc *sc)
+{
 	int i, error = 0;
 	uint32_t *magic;
 	uint32_t cpu_signature;
 	uint32_t equiv_cpuid = 0;
 	struct mc_buf mc;
 	int where;
 	cpu_signature = curcpu()->ci_signature;
 @@ -269,26 +280,26 @@ cpu_ucode_amd_apply(struct cpu_ucode_sof
 		error = ENOENT;
 		goto err1;
+	}
 	mc.mc_equiv_cpuid = equiv_cpuid;
 	mc.mc_buf += mc.mc_mpbuf->mpb_len + sizeof(mc.mc_mpbuf->mpb_type) +
 	    sizeof(mc.mc_mpbuf->mpb_len);
 	mc.mc_mpbuf = (struct mpbhdr *)mc.mc_buf;
 	mc.mc_amd->mpb = (uint8_t *)mc.mc_mpbuf->mpb_data;
 	mc.mc_amd->mpb_size = mc.mc_mpbuf->mpb_len;
 	/* Apply it on all cpus */
 	mc.mc_error = 0;
-	where = xc_broadcast(XC_HIGHPRI, cpu_apply_cb, sc, &mc);
+	where = xc_broadcast(0, cpu_apply_cb, sc, &mc);
 	/* Wait for completion */
 	xc_wait(where);
 	error = mc.mc_error;
 err1:
 	kmem_free(mc.mc_amd->ect, mc.mc_amd->ect_size);
 err0:
 	kmem_free(mc.mc_amd, sizeof(*mc.mc_amd));
 	return error;
+}
 #endif