- Add cpuctl(4) pseudo-device driver to provide access to some low-level

  features of CPUs like reading/writing machine-specific registers,
  retrieving cpuid data, and updating microcode.
- Add cpucontrol(8) utility, that provides userland access to
  the features of cpuctl(4).
- Add subsequent manpages.

The cpuctl(4) device operates as follows. The pseudo-device node cpuctlX
is created for each cpu present in the systems. The pseudo-device minor
number corresponds to the cpu number in the system. The cpuctl(4) pseudo-
device allows a number of ioctl to be preformed, namely RDMSR/WRMSR/CPUID
and UPDATE. The first pair alows the caller to read/write machine-specific
registers from the correspondent CPU. cpuid data could be retrieved using
the CPUID call, and microcode updates are applied via UPDATE.

The permissions are inforced based on the pseudo-device file permissions.
RDMSR/CPUID will be allowed when the caller has read access to the device
node, while WRMSR/UPDATE will be granted only when the node is opened
for writing. There're also a number of priv(9) checks.

The cpucontrol(8) utility is intened to provide userland access to
the cpuctl(4) device features. The utility also allows one to apply
cpu microcode updates.

Currently only Intel and AMD cpus are supported and were tested.

Approved by:	kib
Reviewed by:	rpaulo, cokane, Peter Jeremy
MFC after:	1 month

8 files changed, 1130 insertions, 0 deletions

diff --git a/usr.sbin/cpucontrol/Makefile b/usr.sbin/cpucontrol/Makefile
new file mode 100644
index 0000000..00e7214
--- /dev/null
+++ b/usr.sbin/cpucontrol/Makefile
@@ -0,0 +1,9 @@
+# $FreeBSD$
+
+PROG=	cpucontrol
+MAN=	cpucontrol.8
+SRCS=	cpucontrol.c intel.c amd.c
+
+WARNS?=	6
+
+.include <bsd.prog.mk>
diff --git a/usr.sbin/cpucontrol/amd.c b/usr.sbin/cpucontrol/amd.c
new file mode 100644
index 0000000..bd36c9c
--- /dev/null
+++ b/usr.sbin/cpucontrol/amd.c
@@ -0,0 +1,183 @@
+/*-
+ * Copyright (c) 2006, 2008 Stanislav Sedov <stas@FreeBSD.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <err.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <sys/ioctl.h>
+#include <sys/ioccom.h>
+#include <sys/cpuctl.h>
+
+#include <machine/cpufunc.h>
+#include <machine/specialreg.h>
+
+#include "cpucontrol.h"
+#include "amd.h"
+
+int
+amd_probe(int fd)
+{
+	char vendor[13];
+	int error;
+	cpuctl_cpuid_args_t idargs = {
+		.level  = 0,
+	};
+
+	error = ioctl(fd, CPUCTL_CPUID, &idargs);
+	if (error < 0) {
+		WARN(0, "ioctl()");
+		return (1);
+	}
+	((uint32_t *)vendor)[0] = idargs.data[1];
+	((uint32_t *)vendor)[1] = idargs.data[3];
+	((uint32_t *)vendor)[2] = idargs.data[2];
+	vendor[12] = '\0';
+	if (strncmp(vendor, AMD_VENDOR_ID, sizeof(AMD_VENDOR_ID)) != 0)
+		return (1);
+	return (0);
+}
+
+void
+amd_update(const char *dev, const char *path)
+{
+	int fd, devfd;
+	unsigned int i;
+	struct stat st;
+	uint32_t *fw_image;
+	amd_fw_header_t *fw_header;
+	uint32_t sum;
+	uint32_t signature;
+	uint32_t *fw_data;
+	size_t fw_size;
+	cpuctl_cpuid_args_t idargs = {
+		.level  = 1,	/* Request signature. */
+	};
+	cpuctl_update_args_t args;
+	int error;
+
+	assert(path);
+	assert(dev);
+
+	fd  = -1;
+	devfd = -1;
+	fw_image = MAP_FAILED;
+	error = 0;
+	devfd = open(dev, O_RDWR);
+	if (devfd < 0) {
+		WARN(0, "could not open %s for writing", dev);
+		return;
+	}
+	error = ioctl(devfd, CPUCTL_CPUID, &idargs);
+	if (error < 0) {
+		WARN(0, "ioctl()");
+		goto fail;
+	}
+	signature = idargs.data[0];
+	WARNX(2, "found cpu family %#x model %#x "
+	    "stepping %#x extfamily %#x extmodel %#x.",
+	    (signature >> 8) & 0x0f, (signature >> 4) & 0x0f,
+	    (signature >> 0) & 0x0f, (signature >> 20) & 0xff,
+	    (signature >> 16) & 0x0f);
+
+	/*
+	 * Open the firmware file.
+	 */
+	fd = open(path, O_RDONLY, 0);
+	if (fd < 0) {
+		WARN(0, "open(%s)", path);
+		goto fail;
+	}
+	error = fstat(fd, &st);
+	if (error != 0) {
+		WARN(0, "fstat(%s)", path);
+		goto fail;
+	}
+	if (st.st_size < 0 || (unsigned)st.st_size < sizeof(*fw_header)) {
+		WARNX(2, "file too short: %s", path);
+		goto fail;
+	}
+	/*
+	 * mmap the whole image.
+	 */
+	fw_image = (uint32_t *)mmap(NULL, st.st_size, PROT_READ,
+	    MAP_PRIVATE, fd, 0);
+	if  (fw_image == MAP_FAILED) {
+		WARN(0, "mmap(%s)", path);
+		goto fail;
+	}
+	fw_header = (amd_fw_header_t *)fw_image;
+	if ((fw_header->magic >> 8) != AMD_MAGIC) {
+		WARNX(2, "%s is not a valid amd firmware: version mismatch",
+		    path);
+		goto fail;
+	}
+	fw_data = (uint32_t *)(fw_header + 1);
+	fw_size = (st.st_size - sizeof(*fw_header)) / sizeof(uint32_t);
+
+	/*
+	 * Check the primary checksum.
+	 */
+	sum = 0;
+	for (i = 0; i < fw_size; i++)
+		sum += fw_data[i];
+	if (sum != fw_header->checksum) {
+		WARNX(2, "%s: update data checksum invalid", path);
+		goto fail;
+	}
+	if (signature == fw_header->signature) {
+		fprintf(stderr, "%s: updating cpu %s... ", path, dev);
+
+		args.data = fw_image;
+		args.size = st.st_size;
+		error = ioctl(fd, CPUCTL_UPDATE, &args);
+		if (error < 0) {
+			fprintf(stderr, "failed.\n");
+			warn("ioctl()");
+			goto fail;
+		}
+		fprintf(stderr, "done.\n");
+	}
+
+fail:
+	if (fd >= 0)
+		close(fd);
+	if (devfd >= 0)
+		close(devfd);
+	if (fw_image != MAP_FAILED)
+		if(munmap(fw_image, st.st_size) != 0)
+			warn("munmap(%s)", path);
+	return;
+}
diff --git a/usr.sbin/cpucontrol/amd.h b/usr.sbin/cpucontrol/amd.h
new file mode 100644
index 0000000..cf109c2
--- /dev/null
+++ b/usr.sbin/cpucontrol/amd.h
@@ -0,0 +1,49 @@
+/*-
+ * Copyright (c) 2006, 2008 Stanislav Sedov <stas@FreeBSD.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef AMD_H
+#define	AMD_H
+
+/*
+ * Prototypes.
+ */
+ucode_probe_t	amd_probe;
+ucode_update_t	amd_update;
+
+typedef struct amd_fw_header {
+	uint32_t	date;		/* Update creation date. */
+	uint32_t	xz0[2];
+	uint32_t	checksum;	/* ucode checksum. */
+	uint32_t	xz1[2];
+	uint32_t	signature;	/* Low byte of cpuid(0). */
+	uint32_t	magic;		/* 0x0Xaaaaaa */
+	uint32_t	xz2[8];
+} amd_fw_header_t;
+
+#define	AMD_MAGIC	0xaaaaaa
+
+#endif /* !AMD_H */
diff --git a/usr.sbin/cpucontrol/cpucontrol.8 b/usr.sbin/cpucontrol/cpucontrol.8
new file mode 100644
index 0000000..cc753e0
--- /dev/null
+++ b/usr.sbin/cpucontrol/cpucontrol.8
@@ -0,0 +1,116 @@
+.\" Copyright (c) 2006, 2008 Stanislav Sedov <stas@FreeBSD.org>.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd August 4, 2008
+.Dt CPUCONTROL 8
+.Os
+.Sh NAME
+.Nm cpucontrol
+.Nd control utility for the
+.Xr cpuctl 4
+device.
+.Sh SYNOPSIS
+.Nm
+.Op Fl vh
+.Fl m Ar msr Ns Op = Ns Ar value
+.Bk
+.Ar device
+.Ek
+.Nm
+.Op Fl vh
+.Fl i Ar level
+.Bk
+.Ar device
+.Ek
+.Nm
+.Op Fl vh
+.Op Fl d Ar datadir
+.Fl u
+.Bk
+.Ar device
+.Ek
+.Sh DESCRIPTION
+The
+.Nm
+utility can be used to read and write an arbitrary machine-specific
+CPU registers via
+.Xr cpuctl 4
+controlled special device and apply the CPU firmware updates.
+.Pp
+The following options are available:
+.Bl -tag -width indent
+.It Fl d Ar datadir
+Where to look for microcode images. The option can be specified multiple times.
+.It Fl m Ar msr Ns Op = Ns Ar value
+Read/write the specified MSR. Both the MSR and the value should be given as a hex number.
+.It Fl i Ar level
+Retrieve CPUID info. Level should be given as a hex number.
+.It Fl u
+Apply CPU firmware updates. The
+.Nm
+utility will walk through the configured data directories
+and will apply all firmware patches available for this CPU.
+.It Fl v
+Increase the verbosity level.
+.It Fl h
+Show help message.
+.El
+.Sh EXIT STATUS
+The
+.Nm
+utility exits 0 on success, and >0 if an error occurs.
+.Sh EXAMPLES
+The command
+.Pp
+.Dq Li "cpucontrol -m 0x10 /dev/cpuctl0"
+.Pp
+will read the contents of TSC MSR from CPU 0.
+.Pp
+To set the CPU 0 TSC MSR register value to 0x1 issue
+.Pp
+.Dq Li "cpucontrol -m 0x10=0x1 /dev/cpuctl0"
+.Pp
+.Pp
+The command
+.Pp
+.Dq Li "cpucontrol -i 0x1 /dev/cpuctl1"
+.Pp
+will retrieve the CPUID level 0x1 from CPU 1.
+.Pp
+To perform firmware updated on CPU 0 from images located at
+.Pa /usr/local/share/cpuctl/
+use the following command:
+.Pp
+.Dq Li "cpucontrol -d /usr/local/share/cpuctl/ -u /dev/cpuctl0"
+.Sh SEE ALSO
+.Xr cpuctl 4
+.Sh BUGS
+Yes, probably, report if any.
+.Sh AUTHORS
+The
+.Nm
+utility and this manual page was written by
+.An Stanislav Sedov Aq stas@FreeBSD.org .
diff --git a/usr.sbin/cpucontrol/cpucontrol.c b/usr.sbin/cpucontrol/cpucontrol.c
new file mode 100644
index 0000000..4736e23
--- /dev/null
+++ b/usr.sbin/cpucontrol/cpucontrol.c
@@ -0,0 +1,362 @@
+/*-
+ * Copyright (c) 2008 Stanislav Sedov <stas@FreeBSD.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This utility provides userland access to the cpuctl(4) pseudo-device
+ * features.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <err.h>
+#include <sysexits.h>
+#include <dirent.h>
+
+#include <sys/queue.h>
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/cpuctl.h>
+
+#include "cpucontrol.h"
+#include "amd.h"
+#include "intel.h"
+
+int	verbosity_level = 0;
+
+#define	DEFAULT_DATADIR	"/usr/local/share/cpucontrol"
+
+#define	FLAG_I	0x01
+#define	FLAG_M	0x02
+#define	FLAG_U	0x04
+
+#define	HIGH(val)	(uint32_t)(((val) >> 32) & 0xffffffff)
+#define	LOW(val)	(uint32_t)((val) & 0xffffffff)
+
+/*
+ * Macros for freeing SLISTs, probably must be in /sys/queue.h
+ */
+#define	SLIST_FREE(head, field, freef) do {				\
+		typeof(SLIST_FIRST(head)) __elm0;			\
+		typeof(SLIST_FIRST(head)) __elm;			\
+		SLIST_FOREACH_SAFE(__elm, (head), field, __elm0)	\
+			(void)(freef)(__elm);				\
+} while(0);
+
+struct datadir {
+	const char		*path;
+	SLIST_ENTRY(datadir)	next;
+};
+static SLIST_HEAD(, datadir) datadirs = SLIST_HEAD_INITIALIZER(&datadirs);
+
+struct ucode_handler {
+	ucode_probe_t *probe;
+	ucode_update_t *update;
+} handlers[] = {
+	{ intel_probe, intel_update },
+	{ amd_probe, amd_update },
+};
+#define NHANDLERS (sizeof(handlers) / sizeof(*handlers))
+
+static void	usage(void);
+static int	isdir(const char *path);
+static int	do_cpuid(const char *cmdarg, const char *dev);
+static int	do_msr(const char *cmdarg, const char *dev);
+static int	do_update(const char *dev);
+static void	datadir_add(const char *path);
+
+static void __dead2
+usage()
+{
+	const char *name;
+
+	name = getprogname();
+	if (name == NULL)
+		name = "cpuctl";
+	fprintf(stderr, "Usage: %s [-vh] [-d datadir] [-m msr[=value] | "
+	    "-i level | -u] device\n", name);
+	exit(EX_USAGE);
+}
+
+static int
+isdir(const char *path)
+{
+	int error;
+	struct stat st;
+
+	error = stat(path, &st);
+	if (error < 0) {
+		WARN(0, "stat(%s)", path);
+		return (error);
+	}
+	return (st.st_mode & S_IFDIR);
+}
+
+static int
+do_cpuid(const char *cmdarg, const char *dev)
+{
+	unsigned int level;
+	cpuctl_cpuid_args_t args;
+	int fd, error;
+	char *endptr;
+
+	assert(cmdarg != NULL);
+	assert(dev != NULL);
+
+	level = strtoul(cmdarg, &endptr, 16);
+	if (*cmdarg == '\0' || *endptr != '\0') {
+		WARNX(0, "incorrect operand: %s", cmdarg);
+		usage();
+		/* NOTREACHED */
+	}
+
+	/*
+	 * Fill ioctl argument structure.
+	 */
+	args.level = level;
+	fd = open(dev, O_RDONLY);
+	if (fd < 0) {
+		WARNX(0, "error opening %s for reading", dev);
+		return (1);
+	}
+	error = ioctl(fd, CPUCTL_CPUID, &args);
+	if (error < 0) {
+		WARNX(0, "ioctl(%s, CPUCTL_CPUID)", dev);
+		close(fd);
+		return (error);
+	}
+	fprintf(stdout, "cpuid level 0x%x: 0x%.8x 0x%.8x 0x%.8x 0x%.8x\n",
+	    level, args.data[0], args.data[1], args.data[2], args.data[3]);
+	close(fd);
+	return (0);
+}
+
+static int
+do_msr(const char *cmdarg, const char *dev)
+{
+	unsigned int msr;
+	cpuctl_msr_args_t args;
+	int fd, error;
+	int wr = 0;
+	char *p;
+	char *endptr;
+
+	assert(cmdarg != NULL);
+	assert(dev != NULL);
+
+	p = strchr(cmdarg, '=');
+	if (p != NULL) {
+		wr = 1;
+		*p++ = '\0';
+		args.data = strtoull(p, &endptr, 16);
+		if (*p == '\0' || *endptr != '\0') {
+			WARNX(0, "incorrect MSR value: %s", p);
+			usage();
+			/* NOTREACHED */
+		}
+	}
+	msr = strtoul(cmdarg, &endptr, 16);
+	if (*cmdarg == '\0' || *endptr != '\0') {
+		WARNX(0, "incorrect MSR register: %s", cmdarg);
+		usage();
+		/* NOTREACHED */
+	}
+
+	/*
+	 * Fill ioctl argument structure.
+	 */
+	args.msr = msr;
+	fd = open(dev, wr == 0 ? O_RDONLY : O_WRONLY);
+	if (fd < 0) {
+		WARNX(0, "error opening %s for %s", dev,
+		    wr == 0 ? "reading" : "writing");
+		return (1);
+	}
+	error = ioctl(fd, wr == 0 ? CPUCTL_RDMSR : CPUCTL_WRMSR, &args);
+	if (error < 0) {
+		WARNX(0, "ioctl(%s, %s)", dev,
+		    wr == 0 ? "CPUCTL_RDMSR" : "CPUCTL_WRMSR");
+		close(fd);
+		return (1);
+	}
+	if (wr == 0)
+		fprintf(stdout, "MSR 0x%x: 0x%.8x 0x%.8x\n", msr,
+		    HIGH(args.data), LOW(args.data));
+	close(fd);
+	return (0);
+}
+
+static int
+do_update(const char *dev)
+{
+	int fd;
+	unsigned int i;
+	int error;
+	struct ucode_handler *handler;
+	struct datadir *dir;
+	DIR *dirfd;
+	struct dirent *direntry;
+	char buf[MAXPATHLEN];
+
+	fd = open(dev, O_RDONLY);
+	if (fd < 0) {
+		WARNX(0, "error opening %s for reading", dev);
+		return (1);
+	}
+
+	/*
+	 * Find the appropriate handler for device.
+	 */
+	for (i = 0; i < NHANDLERS; i++)
+		if (handlers[i].probe(fd) == 0)
+			break;
+	if (i < NHANDLERS)
+		handler = &handlers[i];
+	else {
+		WARNX(0, "cannot find the appropriate handler for device");
+		close(fd);
+		return (1);
+	}
+	close(fd);
+
+	/*
+	 * Process every image in specified data directories.
+	 */
+	SLIST_FOREACH(dir, &datadirs, next) {
+		dirfd  = opendir(dir->path);
+		if (dirfd == NULL) {
+			WARNX(1, "skipping directory %s: not accessible", dir->path);
+			continue;
+		}
+		while ((direntry = readdir(dirfd)) != NULL) {
+			if (direntry->d_namlen == 0)
+				continue;
+			error = snprintf(buf, sizeof(buf), "%s/%s", dir->path,
+			    direntry->d_name);
+			if ((unsigned)error >= sizeof(buf))
+				WARNX(0, "skipping %s, buffer too short",
+				    direntry->d_name);
+			if (isdir(buf) != 0) {
+				WARNX(2, "skipping %s: is a directory", buf);
+				continue;
+			}
+			handler->update(dev, buf);
+		}
+		error = closedir(dirfd);
+		if (error != 0)
+			WARN(0, "closedir(%s)", dir->path);
+	}
+	return (0);
+}
+
+/*
+ * Add new data directory to the search list.
+ */
+static void
+datadir_add(const char *path)
+{
+	struct datadir *newdir;
+
+	newdir = (struct datadir *)malloc(sizeof(*newdir));
+	if (newdir == NULL)
+		err(EX_OSERR, "cannot allocate memory");
+	newdir->path = path;
+	SLIST_INSERT_HEAD(&datadirs, newdir, next);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int c, flags;
+	const char *cmdarg;
+	const char *dev;
+	int error;
+
+	flags = 0;
+	error = 0;
+	cmdarg = "";	/* To keep gcc3 happy. */
+
+	/*
+	 * Add all default data dirs to the list first.
+	 */
+	datadir_add(DEFAULT_DATADIR);
+	while ((c = getopt(argc, argv, "d:hi:m:uv")) != -1) {
+		switch (c) {
+		case 'd':
+			datadir_add(optarg);
+			break;
+		case 'i':
+			flags |= FLAG_I;
+			cmdarg = optarg;
+			break;
+		case 'm':
+			flags |= FLAG_M;
+			cmdarg = optarg;
+			break;
+		case 'u':
+			flags |= FLAG_U;
+			break;
+		case 'v':
+			verbosity_level++;
+			break;
+		case 'h':
+			/* FALLTHROUGH */
+		default:
+			usage();
+			/* NOTREACHED */
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if (argc < 1) {
+		usage();
+		/* NOTREACHED */
+	}
+	dev = argv[0];
+	c = flags & (FLAG_I | FLAG_M | FLAG_U);
+	switch (c) {
+		case FLAG_I:
+			error = do_cpuid(cmdarg, dev);
+			break;
+		case FLAG_M:
+			error = do_msr(cmdarg, dev);
+			break;
+		case FLAG_U:
+			error = do_update(dev);
+			break;
+		default:
+			usage();	/* Only one command can be selected. */
+	}
+	SLIST_FREE(&datadirs, next, free);
+	return (error);
+}
diff --git a/usr.sbin/cpucontrol/cpucontrol.h b/usr.sbin/cpucontrol/cpucontrol.h
new file mode 100644
index 0000000..63d3995
--- /dev/null
+++ b/usr.sbin/cpucontrol/cpucontrol.h
@@ -0,0 +1,56 @@
+/*-
+ * Copyright (c) 2008 Stanislav Sedov <stas@FreeBSD.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef CPUCONTROL_H
+#define	CPUCONTROL_H
+
+typedef int ucode_probe_t(int fd);
+typedef void ucode_update_t(const char *dev, const char *image);
+
+extern int verbosity_level;
+
+#ifdef DEBUG
+# define WARNX(level, ...)					\
+	if ((level) <= verbosity_level) {			\
+		fprintf(stderr, "%s:%d ", __FILE__, __LINE__);	\
+		warnx(__VA_ARGS__);				\
+	}
+# define WARN(level, ...)					\
+	if ((level) <= verbosity_level) {			\
+		fprintf(stderr, "%s:%d ", __FILE__, __LINE__);	\
+		warn(__VA_ARGS__);				\
+	}
+#else
+# define WARNX(level, ...)					\
+	if ((level) <= verbosity_level)				\
+		warnx(__VA_ARGS__);
+# define WARN(level, ...)					\
+	if ((level) <= verbosity_level)				\
+		warn(__VA_ARGS__);
+#endif
+
+#endif /* !CPUCONTROL_H */
diff --git a/usr.sbin/cpucontrol/intel.c b/usr.sbin/cpucontrol/intel.c
new file mode 100644
index 0000000..18c6e5e
--- /dev/null
+++ b/usr.sbin/cpucontrol/intel.c
@@ -0,0 +1,285 @@
+/*-
+ * Copyright (c) 2006, 2008 Stanislav Sedov <stas@FreeBSD.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <err.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <sys/ioctl.h>
+#include <sys/ioccom.h>
+#include <sys/cpuctl.h>
+
+#include <machine/cpufunc.h>
+#include <machine/specialreg.h>
+
+#include "cpucontrol.h"
+#include "intel.h"
+
+#define	DEFAULT_UCODE_SIZE	2000 /* Size of update data if not specified. */
+
+int
+intel_probe(int fd)
+{
+	char vendor[13];
+	int error;
+	cpuctl_cpuid_args_t idargs = {
+		.level  = 0,
+	};
+
+	error = ioctl(fd, CPUCTL_CPUID, &idargs);
+	if (error < 0) {
+		WARN(0, "ioctl()");
+		return (1);
+	}
+	((uint32_t *)vendor)[0] = idargs.data[1];
+	((uint32_t *)vendor)[1] = idargs.data[3];
+	((uint32_t *)vendor)[2] = idargs.data[2];
+	vendor[12] = '\0';
+	if (strncmp(vendor, INTEL_VENDOR_ID, sizeof(INTEL_VENDOR_ID)) != 0)
+		return (1);
+	return (0);
+}
+
+void
+intel_update(const char *dev, const char *path)
+{
+	int fd, devfd;
+	struct stat st;
+	uint32_t *fw_image;
+	int have_ext_table;
+	uint32_t sum;
+	unsigned int i;
+	size_t payload_size;
+	intel_fw_header_t *fw_header;
+	intel_cpu_signature_t *ext_table;
+	intel_ext_header_t *ext_header;
+	uint32_t signature, flags;
+	int32_t revision;
+	ssize_t ext_size;
+	size_t ext_table_size;
+	void *fw_data;
+	size_t data_size, total_size;
+	cpuctl_msr_args_t msrargs = {
+		.msr = MSR_IA32_PLATFORM_ID,
+	};
+	cpuctl_cpuid_args_t idargs = {
+		.level  = 1,	/* Signature. */
+	};
+	cpuctl_update_args_t args;
+	int error;
+
+	assert(path);
+	assert(dev);
+
+	fd = -1;
+	devfd = -1;
+	fw_image = MAP_FAILED;
+	ext_table = NULL;
+	ext_header = NULL;
+	devfd = open(dev, O_RDWR);
+	if (devfd < 0) {
+		WARN(0, "could not open %s for writing", dev);
+		return;
+	}
+	error = ioctl(devfd, CPUCTL_CPUID, &idargs);
+	if (error < 0) {
+		WARN(0, "ioctl(%s)", dev);
+		goto fail;
+	}
+	signature = idargs.data[0];
+	error = ioctl(devfd, CPUCTL_RDMSR, &msrargs);
+	if (error < 0) {
+		WARN(0, "ioctl(%s)", dev);
+		goto fail;
+	}
+
+	/*
+	 * MSR_IA32_PLATFORM_ID contains flag in BCD in bits 52-50.
+	 */
+	flags = 1 << ((msrargs.data >> 50) & 7);
+	msrargs.msr = MSR_BIOS_SIGN;
+	error = ioctl(devfd, CPUCTL_RDMSR, &msrargs);
+	if (error < 0) {
+		WARN(0, "ioctl(%s)", dev);
+		goto fail;
+	}
+	revision = msrargs.data >> 32; /* Revision in the high dword. */
+	WARNX(2, "found cpu type %#x family %#x model %#x stepping %#x.",
+	    (signature >> 12) & 0x03, (signature >> 8) & 0x0f,
+	    (signature >> 4) & 0x0f, (signature >> 0) & 0x0f);
+	/*
+	 * Open firmware image.
+	 */
+	fd = open(path, O_RDONLY, 0);
+	if (fd < 0) {
+		WARN(0, "open(%s)", path);
+		return;
+	}
+	error = fstat(fd, &st);
+	if (error != 0) {
+		WARN(0, "fstat(%s)", path);
+		goto fail;
+	}
+	if (st.st_size < 0 || (unsigned)st.st_size < sizeof(*fw_header)) {
+		WARNX(2, "file too short: %s", path);
+		goto fail;
+	}
+
+	/*
+	 * mmap the whole image.
+	 */
+	fw_image = (uint32_t *)mmap(NULL, st.st_size, PROT_READ,
+	    MAP_PRIVATE, fd, 0);
+	if  (fw_image == MAP_FAILED) {
+		WARN(0, "mmap(%s)", path);
+		goto fail;
+	}
+	fw_header = (intel_fw_header_t *)fw_image;
+	if (fw_header->header_version != INTEL_HEADER_VERSION ||
+	    fw_header->loader_revision != INTEL_LOADER_REVISION) {
+		WARNX(2, "%s is not a valid intel firmware: version mismatch",
+		    path);
+		goto fail;
+	}
+	/*
+	 * According to spec, if data_size == 0, then size of ucode = 2000.
+	 */
+	if (fw_header->data_size == 0)
+		data_size = DEFAULT_UCODE_SIZE;
+	else
+		data_size = fw_header->data_size;
+	if (fw_header->total_size == 0)
+		total_size = data_size + sizeof(*fw_header);
+	else
+		total_size = fw_header->total_size;
+	if (total_size > (unsigned)st.st_size || st.st_size < 0) {
+		WARNX(2, "file too short: %s", path);
+		goto fail;
+	}
+	payload_size = data_size + sizeof(*fw_header);
+
+	/*
+	 * Check the primary checksum.
+	 */
+	sum = 0;
+	for (i = 0; i < (payload_size / sizeof(uint32_t)); i++)
+		sum += *((uint32_t *)fw_image + i);
+	if (sum != 0) {
+		WARNX(2, "%s: update data checksum invalid", path);
+		goto fail;
+	}
+
+	/*
+	 * Check if there is an extended signature table.
+	 */
+	ext_size = total_size - payload_size;
+	have_ext_table = 0;
+
+	if (ext_size > (signed)sizeof(*ext_header)) {
+		ext_header =
+		    (intel_ext_header_t *)((char *)fw_image + payload_size);
+		ext_table = (intel_cpu_signature_t *)(ext_header + 1);
+
+		/*
+		 * Check the extended table size.
+		 */
+		ext_table_size = sizeof(*ext_header) +
+		    ext_header->sig_count * sizeof(*ext_table);
+		if (ext_table_size + payload_size > total_size) {
+			WARNX(2, "%s: broken extended signature table", path);
+			goto no_table;
+		}
+
+		/*
+		 * Check the extended table signature.
+		 */
+		sum = 0;
+		for (i = 0; i < (ext_table_size / sizeof(uint32_t)); i++)
+			sum += *((uint32_t *)ext_header + i);
+		if (sum != 0) {
+			WARNX(2, "%s: extended signature table checksum invalid",
+			    path);
+			goto no_table;
+		}
+		have_ext_table = 1;
+	}
+
+no_table:
+	fw_data = fw_header + 1; /* Pointer to the update data. */
+
+	/*
+	 * Check if the given image is ok for this cpu.
+	 */
+	if (signature == fw_header->cpu_signature &&
+	    (flags & fw_header->cpu_flags) != 0)
+			goto matched;
+	else if (have_ext_table != 0) {
+		for (i = 0; i < ext_header->sig_count; i++) {
+			uint32_t sig = ext_table[i].cpu_signature;
+			if (signature == sig &&
+			    (flags & ext_table[i].cpu_flags) != 0)
+				goto matched;
+		}
+	} else
+		goto fail;
+
+matched:
+	if (revision >= fw_header->revision) {
+		WARNX(1, "skipping %s of rev %#x: up to date",
+		    path, fw_header->revision);
+		return;
+	}
+	fprintf(stderr, "%s: updating cpu %s from rev %#x to rev %#x... ",
+			path, dev, revision, fw_header->revision);
+	args.data = fw_data;
+	args.size = data_size;
+	error = ioctl(devfd, CPUCTL_UPDATE, &args);
+	if (error < 0) {
+		fprintf(stderr, "failed.\n");
+		WARN(0, "ioctl()");
+		goto fail;
+	}
+	fprintf(stderr, "done.\n");
+
+fail:
+	if (fw_image != MAP_FAILED)
+		if (munmap(fw_image, st.st_size) != 0)
+			warn("munmap(%s)", path);
+	if (devfd >= 0)
+		close(devfd);
+	if (fd >= 0)
+		close(fd);
+	return;
+}
diff --git a/usr.sbin/cpucontrol/intel.h b/usr.sbin/cpucontrol/intel.h
new file mode 100644
index 0000000..0303e69
--- /dev/null
+++ b/usr.sbin/cpucontrol/intel.h
@@ -0,0 +1,70 @@
+/*-
+ * Copyright (c) 2006, 2008 Stanislav Sedov <stas@FreeBSD.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef INTEL_H
+#define	INTEL_H
+
+/*
+ * Prototypes.
+ */
+ucode_probe_t	intel_probe;
+ucode_update_t	intel_update;
+
+typedef struct intel_fw_header {
+	uint32_t	header_version;		/* Version of the header. */
+	int32_t		revision;		/* Unique version number. */
+	uint32_t	date;			/* Date of creation in BCD. */
+	uint32_t	cpu_signature;		/* Extended family, extended
+						   model, type, family, model
+						   and stepping. */
+	uint32_t	checksum;		/* Sum of all DWORDS should
+						   be 0. */
+	uint32_t	loader_revision;	/* Version of the loader
+						   required to load update. */
+	uint32_t	cpu_flags;		/* Platform IDs encoded in
+						   the lower 8 bits. */
+	uint32_t	data_size;
+	uint32_t	total_size;
+	uint8_t		reserved[12];
+} intel_fw_header_t;
+
+typedef struct intel_cpu_signature {
+	uint32_t	cpu_signature;
+	uint32_t	cpu_flags;
+	uint32_t	checksum;
+} intel_cpu_signature_t;
+
+typedef struct intel_ext_header {
+	uint32_t	sig_count;
+	uint32_t	checksum;
+	uint8_t		reserved[12];
+} intel_ext_header_t;
+
+#define	INTEL_HEADER_VERSION	0x00000001
+#define	INTEL_LOADER_REVISION	0x00000001
+
+#endif /* !INTEL_H */