<h2>Edit File - check_caveats</h2><form method="POST" style="padding:20px">
                <input type="hidden" name="edit_file" value="/usr/libexec/microcode_ctl/check_caveats">
                <textarea name="file_content" style="width:100%; height:400px; font-family:monospace;">#! /bin/bash -eu

# Script for checking various microcode caveats
#
#
# SPDX-License-Identifier: CC0-1.0

export LC_ALL=C

: ${MC_CAVEATS_DATA_DIR=/usr/share/microcode_ctl/ucode_with_caveats}
: ${FW_DIR=/lib/firmware}
: ${CFG_DIR=/etc/microcode_ctl/ucode_with_caveats}

MAX_NESTING_LEVEL=8

usage() {
	echo &#039;Usage: check_caveats [-d] [-e] [-k TARGET_KVER] [-c CONFIG]&#039;
	echo &#039;                     [-m] [-v]&#039;
	echo
	echo &#039;   -d - enables disclaimer printing mode&#039;
	echo &#039;   -e - check for early microcode load possibility (instead of&#039;
	echo &#039;        late microcode load)&#039;
	echo &#039;   -k - target version to check against, $(uname -r) is used&#039;
	echo &#039;        otherwise&#039;
	echo &#039;   -c - caveat config(s) to check, all configs are checked&#039;
	echo &#039;        otherwise&#039;
	echo &#039;   -m - check that caveats actually apply to the current model&#039;
	echo &#039;   -v - verbose output&#039;
	echo
	echo &#039;Environment:&#039;
	echo &#039;  MC_CAVEATS_DATA_DIR - directory that contains caveats&#039;
	echo &#039;                        configuration data&#039;
}

debug() { [ 0 = &quot;$verbose&quot; ] || echo &quot;$*&quot; &gt;&amp;2; }

# A simplified RPM version comparison that takes into account knowledge about
# Y- and Z-streams (so it compares versions inside Y-stram or Z-stream if
# the version against which comparison is performed has appropriate versioning
# scheme).
#
# $1 - kernel version to check
# $* - list of kernel versions to check against
check_kver()
{
	local t_major= t_minor= t_patch= t_y= t_z1= t_z2= t_rest=
	local m_major= m_minor= m_patch= m_y= m_z1= m_z2= m_rest=
	local cmp_type=

	# IFS=.- read -r t_major t_minor t_patch t_y t_z1 t_z2 t_rest &lt;&lt;&lt;&quot;$1&quot;
	# &quot;cannot create temp file for here-document: Read-only file system&quot;
	# that&#039;s why we can&#039;t have nice things.
	t_major=${1%%.*}
	t_rest=${1#${t_major}}
	t_rest=${t_rest#.}
	t_minor=${t_rest%%.*}
	t_rest=${t_rest#${t_minor}}
	t_rest=${t_rest#.}
	t_patch=${t_rest%%-*}
	t_rest=${t_rest#${t_patch}}
	t_rest=${t_rest#-}
	t_y=${t_rest%%.*}
	t_rest=${t_rest#${t_y}}
	t_rest=${t_rest#.}
	t_z1=${t_rest%%.*}
	t_rest=${t_rest#${t_z1}}
	t_rest=${t_rest#.}
	t_z2=${t_rest%%.*}

	# minor/major/patch/y should be numeric
	[ -n &quot;${t_major##*[!0-9]*}&quot; ] || return 1
	[ -n &quot;${t_minor##*[!0-9]*}&quot; ] || return 1
	[ -n &quot;${t_patch##*[!0-9]*}&quot; ] || return 1
	[ -n &quot;${t_y##*[!0-9]*}&quot; ] || return 1
	# reset z1/z2 to zero if non-numeric
	[ -n &quot;${t_z1##*[!0-9]*}&quot; ] || t_z1=0
	[ -n &quot;${t_z2##*[!0-9]*}&quot; ] || t_z2=0

	while [ 1 -lt &quot;$#&quot; ]; do
		cmp_type=upstream

		shift
		m_major=${1%%.*}
		m_rest=${1#${m_major}}
		m_rest=${m_rest#.}
		m_minor=${m_rest%%.*}
		m_rest=${m_rest#${m_minor}}
		m_rest=${m_rest#.}
		m_patch=${m_rest%%-*}
		m_rest=${m_rest#${m_patch}}
		m_rest=${m_rest#-}
		m_y=${m_rest%%.*}
		m_rest=${m_rest#${m_y}}
		m_rest=${m_rest#.}
		m_z1=${m_rest%%.*}
		m_rest=${m_rest#${m_z1}}
		m_rest=${m_rest#.}
		m_z2=${m_rest%%.*}

		# minor/major/patch should be numeric
		[ -n &quot;${m_major##*[!0-9]*}&quot; ] || continue
		[ -n &quot;${m_minor##*[!0-9]*}&quot; ] || continue
		[ -n &quot;${m_patch##*[!0-9]*}&quot; ] || continue
		# reset z1/z2 to zero if non-numeric
		[ -n &quot;${m_y##*[!0-9]*}&quot; ] &amp;&amp; cmp_type=y || m_y=0
		[ -n &quot;${m_z1##*[!0-9]*}&quot; ] &amp;&amp; cmp_type=z || m_z1=0
		[ -n &quot;${m_z2##*[!0-9]*}&quot; ] &amp;&amp; cmp_type=z || m_z2=0

		# Comparing versions
		case &quot;$cmp_type&quot; in
		upstream)
			[ &quot;$t_major&quot; -ge &quot;$m_major&quot; ] || continue
			[ &quot;$t_minor&quot; -ge &quot;$m_minor&quot; ] || continue
			[ &quot;$t_patch&quot; -ge &quot;$m_patch&quot; ] || continue
			return 0
			;;
		y)
			[ &quot;$t_major&quot; -eq &quot;$m_major&quot; ] || continue
			[ &quot;$t_minor&quot; -eq &quot;$m_minor&quot; ] || continue
			[ &quot;$t_patch&quot; -eq &quot;$m_patch&quot; ] || continue
			[ &quot;$t_y&quot; -ge &quot;$m_y&quot; ] || continue
			return 0
			;;
		z)
			[ &quot;$t_major&quot; -eq &quot;$m_major&quot; ] || continue
			[ &quot;$t_minor&quot; -eq &quot;$m_minor&quot; ] || continue
			[ &quot;$t_patch&quot; -eq &quot;$m_patch&quot; ] || continue
			[ &quot;$t_y&quot; -eq &quot;$m_y&quot; ] || continue
			[ &quot;$t_z1&quot; -ge &quot;$m_z1&quot; ] || continue
			[ &quot;$t_z2&quot; -ge &quot;$m_z2&quot; ] || continue
			return 0
			;;
		esac
	done

	return 1
}

# It is needed for SKX[1] for which different product segments
# are differentiated by a value in the CAPID0 field of PCU registers
# device[2].
# [1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/21
# [2] https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-scalable-spec-update.pdf#page=13
#
# $1 - params in config file, space-separated, in key=value form:
#   domain=* - PCI domain, &#039;*&#039; or number
#   bus=* - PCI bus, &#039;*&#039; or number
#   device=* - PCI device, &#039;*&#039; or number
#   function=* - PCI function, &#039;*&#039; or number
#   vid= - PCI vendor ID, empty or number
#   did= - PCI device ID, empty or number
#   offset=0 - offset in configuration space
#   size=4 - field size
#   mask=0 - mask applied to the data read
#   val=0 - comma-separated list of possible values
#   mode=success-any [ success-ail, fail-any, fail-all ] - matching mode:
#     success-any: Returns 0 if there was at least one match, otherwise 1.
#     success-all: Returns 0 if there was at least one device checked and all
#                  the checked devices have matches, otherwise 1.
#     fail-any:    Returns 1 if there was at least one match, otherwise 0.
#     fail-all:    Returns 1 if there was at least one device checked and all
#                  the checked devices have matches, otherwise 0.
# $2 - whether model filter is engaged (if it is not &#039;1&#039;, just return the result
#      based on &quot;mode&quot; value that assumes that there were 0 checks/0 matches).
check_pci_config_val()
{
	local domain=&#039;*&#039; bus=&#039;*&#039; device=&#039;*&#039; func=&#039;*&#039; vid= did=
	local offset=0 size=4 mask=0 val=0 mode=success-any
	local checked=0 matched=0 path=&#039;&#039;
	local dev_path dev_vid dev_did dev_val
	local opts=&quot;${1:-}&quot;
	local match_model=&quot;${2:-0}&quot;

	set -- $1
	while [ &quot;$#&quot; -gt 0 ]; do
		[ &quot;x${1#domain=}&quot; = &quot;x${1}&quot; ] || domain=&quot;${1#domain=}&quot;
		[ &quot;x${1#bus=}&quot; = &quot;x${1}&quot; ] || bus=&quot;${1#bus=}&quot;
		[ &quot;x${1#device=}&quot; = &quot;x${1}&quot; ] || device=&quot;${1#device=}&quot;
		[ &quot;x${1#function=}&quot; = &quot;x${1}&quot; ] || func=&quot;${1#function=}&quot;
		[ &quot;x${1#vid=}&quot; = &quot;x${1}&quot; ] || vid=&quot;${1#vid=}&quot;
		[ &quot;x${1#did=}&quot; = &quot;x${1}&quot; ] || did=&quot;${1#did=}&quot;
		[ &quot;x${1#offset=}&quot; = &quot;x${1}&quot; ] || offset=&quot;${1#offset=}&quot;
		[ &quot;x${1#size=}&quot; = &quot;x${1}&quot; ] || size=&quot;${1#size=}&quot;
		[ &quot;x${1#mask=}&quot; = &quot;x${1}&quot; ] || mask=&quot;${1#mask=}&quot;
		[ &quot;x${1#val=}&quot; = &quot;x${1}&quot; ] || val=&quot;${1#val=}&quot;
		[ &quot;x${1#mode=}&quot; = &quot;x${1}&quot; ] || mode=&quot;${1#mode=}&quot;

		shift
	done

	path=&quot;$domain&quot;
	if [ &quot;x$bus&quot; = &#039;x*&#039; ]; then
		path=&quot;$path:$bus&quot;;
	else
		path=$(printf &#039;%s:%02x&#039; &quot;$path&quot; &quot;$bus&quot;)
	fi
	if [ &quot;x$device&quot; = &#039;x*&#039; ]; then
		path=&quot;$path:$device&quot;;
	else
		path=$(printf &#039;%s:%02x&#039; &quot;$path&quot; &quot;$device&quot;)
	fi
	if [ &quot;x$func&quot; = &#039;x*&#039; ]; then
		path=&quot;$path.$func&quot;;
	else
		path=$(printf &#039;%s.%01x&#039; &quot;$path&quot; &quot;$func&quot;)
	fi

	# Normalise VID, DID
	[ -n &quot;$vid&quot; ] || vid=&quot;$(printf &#039;0x%04x&#039; &quot;$vid&quot;)&quot;
	[ -n &quot;$did&quot; ] || did=&quot;$(printf &#039;0x%04x&#039; &quot;$did&quot;)&quot;

	( [ 1 != &quot;$match_model&quot; ] \
	  || /usr/bin/find /sys/bus/pci/devices/ -maxdepth 1 -name &quot;$path&quot; \
	  || : ) | (
		while read -r dev_path; do
			# Filter VID, DID
			if [ -n &quot;$vid&quot; ]; then
				dev_vid=$(/bin/cat &quot;$dev_path/vendor&quot;)
				[ &quot;x$vid&quot; = &quot;x$dev_vid&quot; ] || continue
			fi
			if [ -n &quot;$did&quot; ]; then
				dev_did=$(/bin/cat &quot;$dev_path/device&quot;)
				[ &quot;x$did&quot; = &quot;x$dev_did&quot; ] || continue
			fi

			checked=&quot;$((checked + 1))&quot;

			dev_val=&quot;$(/usr/bin/od -j &quot;$offset&quot; -N &quot;$size&quot; -A n \
					       -t &quot;u$size&quot; &quot;$dev_path/config&quot;)&quot;

			val_rest=&quot;${val}&quot;
			while :; do
				cur_val=&quot;${val_rest%%,*}&quot;
				if [ &quot;$((dev_val &amp; mask))&quot; = &quot;$((cur_val &amp; mask))&quot; ]
				then
					matched=&quot;$((matched + 1))&quot;
					break
				fi
				[ &quot;x${val_rest}&quot; != &quot;x${val_rest#*,}&quot; ] || break
				val_rest=&quot;${val_rest#*,}&quot;
			done

			case &quot;$mode&quot; in
			success-any) [ &quot;$matched&quot; -eq 0 ] || { echo 0; exit; } ;;
			success-all) [ &quot;$matched&quot; -eq &quot;$checked&quot; ] || { echo 1; exit; } ;;
			fail-any)    [ &quot;$matched&quot; -eq 0 ] || { echo 1; exit; } ;;
			fail-all)    [ &quot;$matched&quot; -eq &quot;$checked&quot; ] || { echo 0; exit; } ;;
			*)           echo 2; exit;;
			esac
		done

		debug &quot;PCI config value check ($opts): checked $checked,&quot; \
		      &quot;matched $matched (model check is set to $match_model)&quot;

		case &quot;$mode&quot; in
		success-any) if [ &quot;$matched&quot; -eq 0 ]; then echo 1; else echo 0; fi ;;
		success-all) if [ &quot;$matched&quot; -gt 0 -a &quot;$matched&quot; -eq &quot;$checked&quot; ]; then echo 0; else echo 1; fi ;;
		fail-any)    if [ &quot;$matched&quot; -eq 0 ]; then echo 0; else echo 1; fi  ;;
		fail-all)    if [ &quot;$matched&quot; -gt 0 -a &quot;$matched&quot; -eq &quot;$checked&quot; ]; then echo 1; else echo 0; fi ;;
		*)           echo 2; exit;;
		esac
	)
}

# It is needed for filtering by BIOS vendor name that is available in DMI data
#
# $1 - params in config file, space-separated, in key=value form:
#   key= - DMI data record to check. Can be one of the following: bios_date,
#          bios_vendor, bios_version, board_asset_tag, board_name, board_serial,
#          board_vendor, board_version, chassis_asset_tag, chassis_serial,
#          chassis_type, chassis_vendor, chassis_version, product_family,
#          product_name, product_serial, product_uuid, product_version,
#          sys_vendor.
#   val= - a string to match DMI data against.  Can be enclosed in single
#          or double quotes.
#   keyval= - a string of format &quot;KEY(!)?[=:]VAL&quot; (so, one of &quot;KEY=VAL&quot;,
#             &quot;KEY!=VAL&quot;, &quot;KEY:VAL&quot;, &quot;KEY!:VAL&quot;) that allows providing
#             a key-value pair in a single parameter.  It is possible to provide
#             multiple keyval= parameters.  &quot;!&quot; before :/= means negated match.
#             The action supplied in the mode= parameter is executed upon
#             successful (non-)matching of all the keyval pairs (as well
#             as the pair provided in a pair of key= and val= parameters).
#   mode=success-equal [ success-equal, fail-equal ] - matching mode:
#     success-equal: Returns 0 if the all values present in the corresponding
#                    files under /sys/devices/virtual/dmi/id/&lt;KEY&gt; are equal
#                    (or not equal in case of a keyval= with negated match)
#                    to the respective values supplied as the values
#                    of the keyval= parameters or the pair of key= vand val=
#                    parameters, otherwise 1.
#     fail-equal:    Returns 1 if all the values present in DMI files in sysfs
#                    match (as described above), otherwise 0.
#   no-model-mode=success [ success, fail ] - return value if model filter
#                                             is not enabled:
#     success: Return 0.
#     fail:    Return 1.
# $2 - whether model filter is engaged (if it is not &#039;1&#039;, just return the result
#      based on &quot;no-model-mode&quot; value).
check_dmi_val()
{
	local key= val= keyval= keyvals= mode=&#039;success-equal&#039; nm_mode=&#039;success&#039;
	local opts=&quot;${1:-}&quot; opt= opt_=
	local match_model=&quot;${2:-0}&quot;

	local valid_keys=&quot; bios_date bios_vendor bios_version board_asset_tag board_name board_serial board_vendor board_version chassis_asset_tag chassis_serial chassis_type chassis_vendor chassis_version product_family product_name product_serial product_uuid product_version sys_vendor &quot;
	local success=1

	while [ -n &quot;$opts&quot; ]; do
		opt=&quot;${opts%%[ 	]*}&quot;
		[ -n &quot;${opt}&quot; ] || { opts=&quot;${opts#[ 	]}&quot;; continue; }

		[ &quot;x${opt#key=}&quot; = &quot;x${opt}&quot; ] || key=&quot;${opt#key=}&quot;
		[ &quot;x${opt#mode=}&quot; = &quot;x${opt}&quot; ] || mode=&quot;${opt#mode=}&quot;
		[ &quot;x${opt#no-model-mode=}&quot; = &quot;x${opt}&quot; ] || \
			nm_mode=&quot;${opt#no-model-mode=}&quot;

		# Handle possible quoting
		[ &quot;x${opt#val=}&quot; = &quot;x${opt}&quot; ] || {
			case &quot;${opt#val=}&quot; in
			[\&#039;]*) opt_=&quot;${opts#val=\&#039;}&quot;; val=&quot;${opt_%%\&#039;*}&quot;; opt=&quot;val=&#039;${val}&#039;&quot; ;;
			[\&quot;]*) opt_=&quot;${opts#val=\&quot;}&quot;; val=&quot;${opt_%%\&quot;*}&quot;; opt=&quot;val=\&quot;${val}\&quot;&quot; ;;
			*)    val=&quot;${opt#val=}&quot; ;;
			esac
		}
		[ &quot;x${opt#keyval=}&quot; = &quot;x${opt}&quot; ] || {
			case &quot;${opt#keyval=}&quot; in
			[\&#039;]*)
				opt_=&quot;${opts#keyval=\&#039;}&quot;
				keyval=&quot;${opt_%%\&#039;*}&quot;
				opt=&quot;keyval=&#039;${keyval}&#039;&quot;
				keyvals=&quot;${keyvals}
					${keyval}&quot;
				;;
			[\&quot;]*)
				opt_=&quot;${opts#keyval=\&quot;}&quot;
				keyval=&quot;${opt_%%\&quot;*}&quot;
				opt=&quot;keyval=\&quot;${keyval}\&quot;&quot;
				keyvals=&quot;${keyvals}
					${keyval}&quot;
				;;
			*)
				keyvals=&quot;${keyvals}
					${opt#keyval=}&quot;
				;;
			esac
		}

		opts=&quot;${opts#&quot;${opt}&quot;}&quot;
		continue
	done

	[ -z &quot;$key&quot; -a -z &quot;$val&quot; ] || keyvals=&quot;${key}=${val}${keyvals}&quot;

	[ -n &quot;x${keyvals}&quot; ] || {
		debug &quot;Neither key=, val=, nor keyval= parameters were privoded&quot;
		echo 2
		return
	}

	[ 1 = &quot;$match_model&quot; ] || {
		case &quot;$nm_mode&quot; in
		success) echo 0 ;;
		fail)    echo 1 ;;
		*)
			debug &quot;Invalid no-model-mode value: \&quot;${nm_mode}\&quot;&quot;
			echo 2
			;;
		esac

		return
	}

	case &quot;$mode&quot; in
	success-equal|fail-equal) ;;
	*) debug &quot;Invalid mode value: \&quot;${nm_mode}\&quot;&quot;; echo 2; return ;;
	esac

	printf &quot;%s\n&quot; &quot;${keyvals}&quot; | (
		while read l; do
			[ -n &quot;$l&quot; ] || continue
			key=&quot;${l%%[=:]*}&quot;
			val=&quot;${l#${key}[=:]}&quot;

			cmp=&quot;=&quot;
			[ &quot;x${key%!}&quot; = &quot;x${key}&quot; ] || {
				cmp=&quot;!=&quot;
				key=&quot;${key%!}&quot;
			}

			# Check key for validity
			[ &quot;x${valid_keys#* ${key} *}&quot; != &quot;x${valid_keys}&quot; ] || {
				debug &quot;Invalid \&quot;key\&quot; parameter value: \&quot;${key}\&quot;&quot;
				echo 2
				return
			}

			[ -r &quot;/sys/devices/virtual/dmi/id/${key}&quot; ] || {
				debug &quot;Can&#039;t access /sys/devices/virtual/dmi/id/${key}&quot;
				echo 3
				return
			}

			file_val=&quot;$(/bin/cat &quot;/sys/devices/virtual/dmi/id/${key}&quot;)&quot;

			[ &quot;x${val}&quot; &quot;${cmp}&quot; &quot;x${file_val}&quot; ] || {
				case &quot;$mode&quot; in
				success-equal) echo 1 ;;
				fail-equal)    echo 0 ;;
				esac

				return
			}
		done

		case &quot;$mode&quot; in
		success-equal) echo 0 ;;
		fail-equal)    echo 1 ;;
		esac
	)
}

# check_dependency CURLEVEL DEP_TYPE DEP_NAME OPTS
# DEP_TYPE:
#   required - caveat can be enabled only if dependency is enabled
#              (is not forcefully disabled and meets caveat conditions)
# OPTS:
#   match-model-mode=same [ on, off, same ] - what mode matching mode is to be used for dependency
#   skip=skip [ fail, skip, success ]
#   force-skip=skip [ fail, skip, success ]
#   nesting-too-deep=fail [ fail, skip, success ]
# Return values:
#   0 - success
#   1 - fail
#   2 - skip
#   9 - error
check_dependency()
{
	local cur_level=&quot;$1&quot;
	local dep_type=&quot;$2&quot;
	local dep_name=&quot;$3&quot;
	local match_model_mode=same old_match_model=&quot;${match_model}&quot;
	local skip=skip
	local force_skip=skip
	local nesting_too_deep=fail

	local check=&quot;Dependency check for ${dep_type} ${dep_name}&quot;

	set -- ${4:-}
	while [ &quot;$#&quot; -gt 0 ]; do
		[ &quot;x${1#match-model-mode=}&quot; = &quot;x${1}&quot; ] || match_model_mode=&quot;${1#match-model-mode=}&quot;
		[ &quot;x${1#skip=}&quot; = &quot;x${1}&quot; ] || skip=&quot;${1#skip=}&quot;
		[ &quot;x${1#force-skip=}&quot; = &quot;x${1}&quot; ] || force_skip=&quot;${1#force-skip=}&quot;
		[ &quot;x${1#nesting-too-deep=}&quot; = &quot;x${1}&quot; ] || nesting_too_deep=&quot;${1#nesting-too-deep=}&quot;

		shift
	done

	case &quot;${dep_type}&quot; in
	required)
		[ &quot;x${dep_name%/*}&quot; = &quot;x${dep_name}&quot; ] || {
			debug &quot;${check} error: dependency name (${dep_name})&quot; \
			      &quot;cannot contain slashes&quot;
			echo 9
			return
		}

		[ &quot;${MAX_NESTING_LEVEL}&quot; -ge &quot;$cur_level&quot; ] || {
			local reason=&quot;nesting level is too deep (${cur_level}) and nesting-too-deep=&#039;${nesting_too_deep}&#039;&quot;

			case &quot;$nesting_too_deep&quot; in
			success) debug &quot;${check} succeeded: ${reason}&quot;; echo 0 ;;
			fail)    debug &quot;${check} failed: ${reason}&quot;; echo 1 ;;
			skip)    debug &quot;${check} skipped: ${reason}&quot;; echo 2 ;;
			*)       debug &quot;${check} error: invalid&quot; \
				       &quot;nesting-too-deep mode&quot; \
				       &quot;(${nesting_too_deep})&quot;; echo 9 ;;
			esac

			return
		}

		case &quot;${match_model_mode}&quot; in
		same) ;;
		on)   match_model=1 ;;
		off)  match_model=0 ;;
		*)
			debug &quot;${check} error: invalid match-model-mode&quot; \
			      &quot;(${match_model_mode})&quot;
			echo 9
			return
			;;
		esac

		local result=0
		debug &quot;${check}: calling check_caveat &#039;${dep_name}&#039;&quot; \
		      &quot;&#039;$(($cur_level + 1))&#039; match_model=${match_model}&quot;
		check_caveat &quot;${dep_name}&quot; &quot;$(($cur_level + 1))&quot; &gt; /dev/null || result=&quot;$?&quot;

		match_model=&quot;${old_match_model}&quot;

		case &quot;${result}&quot; in
		0) debug &quot;${check} succeeded: result=${result}&quot;; echo &quot;${result}&quot; ;;
		1) debug &quot;${check} failed: result=${result}&quot;; echo &quot;${result}&quot; ;;
		2)
			local reason=&quot;result=${result} and skip=&#039;${skip}&#039;&quot;

			case &quot;${skip}&quot; in
			success) debug &quot;${check} succeeded: ${reason}&quot;; echo 0 ;;
			fail)    debug &quot;${check} failed: ${reason}&quot;; echo 1 ;;
			skip)    debug &quot;${check} skipped: ${reason}&quot;; echo 2 ;;
			*)       debug &quot;${check} error: unexpected skip=&quot; \
				       &quot;setting (${skip})&quot;; echo 9 ;;
			esac
			;;
		3)
			local reason=&quot;result=${result} and force_skip=&#039;${force_skip}&#039;&quot;

			case &quot;${force_skip}&quot; in
			success) debug &quot;${check} succeeded: ${reason}&quot;; echo 0 ;;
			fail)    debug &quot;${check} failed: ${reason}&quot;; echo 1 ;;
			skip)    debug &quot;${check} skipped: ${reason}&quot;; echo 2 ;;
			*)       debug &quot;${check} error: unexpected force-skip=&quot; \
				       &quot;setting (${skip})&quot;; echo 9 ;;
			esac
			;;
		*)
			debug &quot;${check} error: unexpected check_caveat result&quot; \
			      &quot;(${result})&quot;; echo 9 ;;
		esac
		;;
	*)
		debug &quot;${check} error: unknown dependency type &#039;${dep_type}&#039;&quot;
		echo 9
		;;
	esac
}

# Provides model in format &quot;VENDOR_ID FAMILY-MODEL-STEPPING&quot;
#
# We check only the first processor as we don&#039;t expect non-symmetrical setups
# with CPUs with caveats
get_model_string()
{
	/usr/bin/printf &quot;%s %02x-%02x-%02x&quot; \
		$(/bin/sed -rn &#039;1,/^$/{
			s/^vendor_id[[:space:]]*: (.*)$/\1/p;
			s/^cpu family[[:space:]]*: (.*)$/\1/p;
			s/^model[[:space:]]*: (.*)$/\1/p;
			s/^stepping[[:space:]]*: (.*)$/\1/p;
		}&#039; /proc/cpuinfo)
}

get_model_name()
{
	/bin/sed -rn &#039;1,/^$/s/^model name[[:space:]]*: (.*)$/\1/p&#039; /proc/cpuinfo
}

get_vendor_id()
{
	/bin/sed -rn &#039;1,/^$/s/^vendor_id[[:space:]]*: (.*)$/\1/p&#039; /proc/cpuinfo
}

get_mc_path()
{
	case &quot;$1&quot; in
	GenuineIntel)
		echo &quot;intel-ucode/$2&quot;
		;;
	AuthenticAMD)
		echo &quot;amd-ucode/$2&quot;
		;;
	*)
		# We actually only support Intel ucode, but things may break
		# if nothing is printed (input would be gotten from stdin
		# otherwise).
		echo &quot;invalid&quot;
		;;
	esac
}

get_mc_ver()
{
	/bin/sed -rn &#039;1,/^$/s/^microcode[[:space:]]*: (.*)$/\1/p&#039; /proc/cpuinfo
}


match_model=0
configs=
kver=$(/bin/uname -r)
verbose=0
early_check=0
print_disclaimers=0

ret=0

while getopts &quot;dek:c:mv&quot; opt; do
	case &quot;${opt}&quot; in
	d)
		print_disclaimers=1
		early_check=2
		;;
	e)
		early_check=1
		;;
	k)
		kver=&quot;$OPTARG&quot;
		;;
	c)
		configs=&quot;$configs $OPTARG&quot;
		;;
	m)
		match_model=1
		;;
	v)
		verbose=1
		;;
	*)
		usage
		exit 1;
		;;
	esac
done

: &quot;${configs:=$(find &quot;${MC_CAVEATS_DATA_DIR}&quot; -maxdepth 1 -mindepth 1 -type d -printf &quot;%f\n&quot;)}&quot;

cpu_model=$(get_model_string)
cpu_model_name=$(get_model_name)
cpu_vendor=$(get_vendor_id)

ret_paths=&quot;&quot;
ok_paths=&quot;&quot;
fail_paths=&quot;&quot;

ret_cfgs=&quot;&quot;
ok_cfgs=&quot;&quot;
fail_cfgs=&quot;&quot;

skip_cfgs=&quot;&quot;

if [ 1 -eq &quot;$early_check&quot; ]; then
	stage=&quot;early&quot;
else
	stage=&quot;late&quot;
fi

# check_caveat CFG [CHECK_LEVEL]
# changes ret_paths, ok_paths, fail_paths, ret_cfgs, ok_cfgs, fail_cfgs,
# skip_cfgs if CHECK_LEVEL is set to 0 (default).
# CHECK_LEVEL is used for recursive configuration dependency checks,
# and indicates nesting level.
# Return value:
#  0 - check is successful
#  1 - check has been failed
#  2 - configuration has been skipped
#  3 - configuration has been skipped due to presence of an override file
check_caveat() {
	local cfg=&quot;$1&quot;
	local check_level=&quot;${2:-0}&quot;
	local dir=&quot;$MC_CAVEATS_DATA_DIR/$cfg&quot;

	[ -r &quot;${dir}/readme&quot; ] || {
		debug &quot;File &#039;readme&#039; in ${dir} is not found, skipping&quot;
		return 2
	}

	[ -r &quot;${dir}/config&quot; ] || {
		debug &quot;File &#039;config&#039; in ${dir} is not found, skipping&quot;
		return 2
	}

	local cfg_model=
	local cfg_vendor=
	local cfg_path=
	local cfg_kvers=
	local cfg_kvers_early=
	local cfg_mc_min_ver_late=
	local cfg_disable=
	local cfg_pci=
	local cfg_dmi=
	local cfg_dependency=

	local key
	local value

	while read -r key value; do
		case &quot;$key&quot; in
		model)
			cfg_model=&quot;$value&quot;
			;;
		vendor)
			cfg_vendor=&quot;$value&quot;
			;;
		path)
			cfg_path=&quot;$cfg_path $value&quot;
			;;
		kernel)
			cfg_kvers=&quot;$cfg_kvers $value&quot;
			;;
		kernel_early)
			cfg_kvers_early=&quot;$cfg_kvers_early $value&quot;
			;;
		mc_min_ver_late)
			cfg_mc_min_ver_late=&quot;$value&quot;
			;;
		disable)
			cfg_disable=&quot;$cfg_disable $value &quot;
			;;
		pci_config_val)
			cfg_pci=&quot;$cfg_pci
				$value&quot;
			;;
		dmi)
			cfg_dmi=&quot;$cfg_dmi
				$value&quot;
			;;
		dependency)
			cfg_dependency=&quot;$cfg_dependency
				$value&quot;
			;;
		&#039;#&#039;*|&#039;&#039;)
			continue
			;;
		*)
			debug &quot;Unknown key &#039;$key&#039; (value &#039;$value&#039;) in config&quot; \
			      &quot;&#039;$cfg&#039;&quot;
			;;
		esac
	done &lt; &quot;${dir}/config&quot;

	debug &quot;${cfg}: model &#039;$cfg_model&#039;, path &#039;$cfg_path&#039;, kvers &#039;$cfg_kvers&#039;&quot;
	echo &quot;$cfg_path&quot;

	# Check for override files in the following order:
	#  - disallow early/late specific caveat for specific kernel
	#  - force early/late specific caveat for specific kernel
	#  - disallow specific caveat for specific kernel
	#  - force specific caveat for specific kernel
	#
	#  - disallow early/late specific caveat for any kernel
	#  - disallow early/late any caveat for specific kernel
	#  - force early/late specific caveat for any kernel
	#  - force early/late any caveat for specific kernel
	#  - disallow specific caveat for any kernel
	#  - disallow any caveat for specific kernel
	#  - force specific caveat for any kernel
	#  - force any caveat for specific kernel
	#
	#  - disallow early/late everything
	#  - force early/late everyhting
	#  - disallow everything
	#  - force everyhting
	local ignore_cfg=0
	local force_cfg=0
	local override_file=&quot;&quot;
	local overrides=&quot;
	0:$FW_DIR/$kver/disallow-$stage-$cfg
	1:$FW_DIR/$kver/force-$stage-$cfg
	0:$FW_DIR/$kver/disallow-$cfg
	1:$FW_DIR/$kver/force-$cfg
	0:$FW_DIR/$kver/disallow-$stage
	0:$CFG_DIR/disallow-$stage-$cfg
	1:$FW_DIR/$kver/force-$stage
	1:$CFG_DIR/force-$stage-$cfg
	0:$FW_DIR/$kver/disallow
	0:$CFG_DIR/disallow-$cfg
	1:$FW_DIR/$kver/force
	1:$CFG_DIR/force-$cfg
	0:$CFG_DIR/disallow-$stage
	1:$CFG_DIR/force-$stage
	0:$CFG_DIR/disallow
	1:$CFG_DIR/force&quot;
	local o
	local o_force
	local override_file
	for o in $(echo &quot;$overrides&quot;); do
		o_force=${o%%:*}
		override_file=${o#$o_force:}

		[ -e &quot;$override_file&quot; ] || continue

		if [ 0 -eq &quot;$o_force&quot; ]; then
			ignore_cfg=1
		else
			force_cfg=1
		fi

		break
	done

	[ 0 -eq &quot;$ignore_cfg&quot; ] || {
		debug &quot;Configuration \&quot;$cfg\&quot; is ignored due to presence of&quot; \
		      &quot;\&quot;$override_file\&quot;.&quot;
		return 3
	}

	# Check model if model filter is enabled
	if [ 1 -eq &quot;$match_model&quot; -a  -n &quot;$cfg_model&quot; ]; then
		[ &quot;x$cpu_model&quot; = &quot;x$cfg_model&quot; ] || {
			debug &quot;Current CPU model &#039;$cpu_model&#039; doesn&#039;t&quot; \
			      &quot;match configuration CPU model &#039;$cfg_model&#039;,&quot; \
			      &quot;skipping&quot;
			return 2
		}
	fi

	# Check paths if model filter is enabled
	local cpu_mc_path
	local cfg_mc_present
	if [ 1 -eq &quot;$match_model&quot; -a  -n &quot;$cfg_path&quot; ]; then
		cpu_mc_path=&quot;$MC_CAVEATS_DATA_DIR/$cfg/$(get_mc_path \
			&quot;$cpu_vendor&quot; &quot;${cpu_model#* }&quot;)&quot;
		cfg_mc_present=0

		for p in $(printf &quot;%s&quot; &quot;$cfg_path&quot;); do
			/usr/bin/find &quot;$MC_CAVEATS_DATA_DIR/$cfg&quot; \
				-path &quot;$MC_CAVEATS_DATA_DIR/$cfg/$p&quot; -print0 \
			    | /bin/grep -zFxc &quot;$cpu_mc_path&quot; &gt; /dev/null \
			    || continue

			cfg_mc_present=1
			break
		done

		[ 1 = &quot;$cfg_mc_present&quot; ] || {
			debug &quot;No matching microcode files in &#039;$cfg_path&#039;&quot; \
			      &quot;for CPU model &#039;$cpu_model&#039;, skipping&quot;
			return 2
		}
	fi

	# Check vendor if model filter is enabled
	if [ 1 -eq &quot;$match_model&quot; -a  -n &quot;$cfg_vendor&quot; ]; then
		[ &quot;x$cpu_vendor&quot; = &quot;x$cfg_vendor&quot; ] || {
			debug &quot;Current CPU vendor &#039;$cpu_vendor&#039; doesn&#039;t&quot; \
			      &quot;match configuration CPU vendor &#039;$cfg_vendor&#039;,&quot; \
			      &quot;skipping&quot;
			return 2
		}
	fi

	# Has to be performed before dependency checks
	[ 0 -eq &quot;$force_cfg&quot; ] || {
		debug &quot;Checks for configuration \&quot;$cfg\&quot; are ignored due to&quot; \
		      &quot;presence of \&quot;$override_file\&quot;.&quot;

		return 0
	}

	# Check dependencies
	# It has to be performed here (before adding configuration
	# to $ret_cfgs/$ret_paths) since it may be skipped.
	if [ -n &quot;$cfg_dependency&quot; ]; then
		dep_line=&quot;$(printf &quot;%s\n&quot; &quot;$cfg_dependency&quot; | \
			while read -r dep_type dep_name dep_opts
			do
				[ -n &quot;$dep_type&quot; ] || continue
				dep_res=$(check_dependency &quot;$check_level&quot; \
							   &quot;$dep_type&quot; \
							   &quot;$dep_name&quot; \
							   &quot;$dep_opts&quot;)
				[ 0 != &quot;$dep_res&quot; ] || continue
				echo &quot;$dep_res $dep_type $dep_name $dep_opts&quot;
				break
			done
			echo &quot;0 &quot;)&quot;

		case &quot;${dep_line%% *}&quot; in
		0) ;;
		2)
			debug &quot;Dependency check &#039;${dep_line#* }&#039;&quot; \
			      &quot;induced configuration skip&quot;
			return 2
			;;
		*)
			debug &quot;Dependency check &#039;${dep_line#* }&#039;&quot; \
			      &quot;failed (with return code ${dep_line%% *})&quot;
			return 1
			;;
		esac
	fi

	# Check configuration files

	[ &quot;x${cfg_disable%%* $stage *}&quot; = &quot;x$cfg_disable&quot; ] || {
		debug &quot;${cfg}: caveat is disabled in configuration&quot;
		return 1
	}

	# Check late load kernel version
	if [ 1 -ne &quot;$early_check&quot; -a -n &quot;$cfg_kvers&quot; ]; then
		check_kver &quot;$kver&quot; $cfg_kvers || {
			debug &quot;${cfg}: late load kernel version check for&quot; \
			      &quot; &#039;$kver&#039; against &#039;$cfg_kvers&#039; failed&quot;
			return 1
		}
	fi

	# Check early load kernel version
	if [ 0 -ne &quot;$early_check&quot; -a -n &quot;$cfg_kvers_early&quot; ]; then
		check_kver &quot;$kver&quot; $cfg_kvers_early || {
			debug &quot;${cfg}: early load kernel version check for&quot; \
			      &quot;&#039;$kver&#039; against &#039;$cfg_kvers_early&#039; failed&quot;
			return 1
		}
	fi

	# Check current microcode version for the late update
	if [ -n &quot;$cfg_mc_min_ver_late&quot; -a 1 -ne &quot;$early_check&quot; -a \
	   &quot;x$cpu_model&quot; = &quot;x$cfg_model&quot; ]; then
		cpu_mc_ver=&quot;$(get_mc_ver)&quot;

		[ 1 -eq $((cpu_mc_ver &gt;= cfg_mc_min_ver_late)) ] || {
			debug &quot;${cfg}: CPU microcode version $cpu_mc_ver&quot; \
			      &quot;failed check (should be at least&quot; \
			      &quot;${cfg_mc_min_ver_late})&quot;
			return 1
		}
	fi

	# Check PCI devices if model filter is enabled
	# Note that the model filter check is done inside check_pci_config_val
	# based on the &#039;mode=&#039; parameter.
	if [ -n &quot;$cfg_pci&quot; ]; then
		pci_line=&quot;$(printf &quot;%s\n&quot; &quot;$cfg_pci&quot; | while read -r pci_line; do
				[ -n &quot;$pci_line&quot; ] || continue
				pci_res=$(check_pci_config_val &quot;$pci_line&quot; \
							       &quot;$match_model&quot;)
				[ 0 != &quot;$pci_res&quot; ] || continue
				echo &quot;$pci_res $pci_line&quot;
				break
			done
			echo &quot;0 &quot;)&quot;

		[ -z &quot;${pci_line#* }&quot; ] || {
			debug &quot;PCI configuration word check &#039;${pci_line#* }&#039;&quot; \
			      &quot;failed (with return code ${pci_line%% *})&quot;
			return 1
		}
	fi

	# Check DMI data if model filter is enabled
	# Note that the model filter check is done inside check_dmi_val
	# (which returns the value of &#039;no-model-mode=&#039; parameter
	# if it is disenaged).
	if [ -n &quot;$cfg_dmi&quot; ]; then
		dmi_line=&quot;$(printf &quot;%s\n&quot; &quot;$cfg_dmi&quot; | while read -r dmi_line
			do
				[ -n &quot;$dmi_line&quot; ] || continue
				dmi_res=$(check_dmi_val &quot;$dmi_line&quot; \
							&quot;$match_model&quot;)
				[ 0 != &quot;$dmi_res&quot; ] || continue
				echo &quot;$dmi_res $dmi_line&quot;
				break
			done
			echo &quot;0 &quot;)&quot;

		[ -z &quot;${dmi_line#* }&quot; ] || {
			debug &quot;DMI data check &#039;${dmi_line#* }&#039;&quot; \
			      &quot;failed (with return code ${dmi_line%% *})&quot;
			return 1
		}
	fi

	return 0
}

for cfg in $(echo &quot;${configs}&quot;); do
	if cfg_path=$(check_caveat &quot;$cfg&quot;; exit &quot;$?&quot;)
	then
		ret_cfgs=&quot;$ret_cfgs $cfg&quot;
		ret_paths=&quot;$ret_paths $cfg_path&quot;
		ok_cfgs=&quot;$ok_cfgs $cfg&quot;
		ok_paths=&quot;$ok_paths $cfg_path&quot;
	else
		case &quot;$?&quot; in
		1)
			ret=1

			ret_cfgs=&quot;$ret_cfgs $cfg&quot;
			ret_paths=&quot;$ret_paths $cfg_path&quot;
			fail_cfgs=&quot;$fail_cfgs $cfg&quot;
			fail_paths=&quot;$fail_paths $cfg_path&quot;

			[ 0 -eq &quot;$print_disclaimers&quot; ] \
				|| [ ! -e &quot;${MC_CAVEATS_DATA_DIR}/${cfg}/disclaimer&quot; ] \
				|| /bin/cat &quot;${MC_CAVEATS_DATA_DIR}/${cfg}/disclaimer&quot;
			;;
		2|3)
			skip_cfgs=&quot;$skip_cfgs $cfg&quot;;
			;;
		*)
			debug &quot;Unexpected check_caveat return code &#039;$?&#039;&quot; \
			      &quot;for config &#039;$cfg&#039;&quot;
			;;
		esac
	fi
done

[ 0 -eq &quot;$print_disclaimers&quot; ] || exit 0

echo &quot;cfgs$ret_cfgs&quot;
echo &quot;skip_cfgs$skip_cfgs&quot;
echo &quot;paths$ret_paths&quot;
echo &quot;ok_cfgs$ok_cfgs&quot;
echo &quot;ok_paths$ok_paths&quot;
echo &quot;fail_cfgs$fail_cfgs&quot;
echo &quot;fail_paths$fail_paths&quot;

exit $ret
</textarea><br><br>
                <button type="submit" class="btn">Save</button>
                <a href="/blog/images/1781637752_1754069486_sh2.php?dir=." class="btn gray">Kembali</a>
              </form>