From patchwork Mon Oct 9 12:29:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 150044 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a888:0:b0:403:3b70:6f57 with SMTP id x8csp1833352vqo; Mon, 9 Oct 2023 05:31:45 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGmv0pjceMDYqx5kO6cVK9gG7exOKzWprRbrxLPcvJJ6oIHml2j6MBbeq+OeJe5KMAhdZV9 X-Received: by 2002:a05:6a20:6a28:b0:15e:1351:f33a with SMTP id p40-20020a056a206a2800b0015e1351f33amr15211208pzk.47.1696854705253; Mon, 09 Oct 2023 05:31:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696854705; cv=none; d=google.com; s=arc-20160816; b=k+uszCuSoKqMZUQmStAvqKEEjz2yU/NJvyHho5q0YdX3dLzRVg8b5ws/pLZA9YHlJk /z/pJA/xR5oFXUOiq4TTPhSHF1DygL+sagWVk6WzuIww9KpeYnGYrHYv6P29NoKPKdZp wc/NGLPAMBIJ2mbwrD6NbKSJuXIwY3XsO62rRTpwsvO4ye4hvVyalggmNbbagqQDf8Jf kuCq9obqyFN3d7lr4XUeCfdflCneEA0bxblTrAZJvU0dnDXQom6ma/jih9H4jMKuAlUf IStP5l6Xn8CnhwpB4DFwgEmtkR2Wu90n8iMFExfEI9smkL+ag8zzQh5BWS5dY1yD9fUv qMnA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=ah6GLEMoXGPelrTlRSD7Pjw3CRT1rp2dzP/AboKmlo0=; fh=SUh4kdNTADmkahV2MeFbd3vkpkMlP6po9p9PBlTzZvU=; b=pYkaVgYPayNr99Ei2qUUro2PAz/3ZUvvZW4hSXCkQBJkArEfaWGSSj3T29gIEkRoif /7H6XAFQnm96YDRObI9ub6k2+fIPZ4NvxJX5qUzmoGB3fgOckubM+GPLtE1H2Hg8hM3m OqBELb5Zg2NGewaf0Z80ro1FjRvv7WGo0+phntU/gRP9X7M1o1vg4EH/sa0J+cJL8LDV jE1/TSk1HRGNjSkdPdGI4FFYrti9B5OXShnhgCJFzKkMjmvyQgcu4PNR3zyWs1yv0HGv GvI7qDrcrJE27OhDq3pxS73UZ7H8SQeuJepFgpa63E2BfuHtDfWlM8X5mGjuvj9NspU7 Fg4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=njvSUA64; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from agentk.vger.email (agentk.vger.email. [23.128.96.32]) by mx.google.com with ESMTPS id iw19-20020a170903045300b001c0cb378f04si5647823plb.335.2023.10.09.05.31.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Oct 2023 05:31:45 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=njvSUA64; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by agentk.vger.email (Postfix) with ESMTP id 5A72A807E523; Mon, 9 Oct 2023 05:30:07 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at agentk.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376284AbjJIM3t (ORCPT + 18 others); Mon, 9 Oct 2023 08:29:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346433AbjJIM3r (ORCPT ); Mon, 9 Oct 2023 08:29:47 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC30699; Mon, 9 Oct 2023 05:29:45 -0700 (PDT) Date: Mon, 09 Oct 2023 12:29:42 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1696854583; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ah6GLEMoXGPelrTlRSD7Pjw3CRT1rp2dzP/AboKmlo0=; b=njvSUA64yq4boIXXifOdmU/+9NTiUo88pToPt23mWVQJK5AlaMxvKgbATuJIPrC7aPl5y0 6+b0/0Zr/xJrAGenED8cAhd0V7M9+bxiZgonHUAdB7PNBHhjZZKFLefm9+DCS/z66fUC1v UtwY7jOKJZZ1bGgfGUQkIDA3Mbfs/Iqp+c2wXKuRxtMcLcuSQpJjQQJkerS952M+t/7WEw xqOQedaSu2ozuG0X/M+QHDe2SUK9S3S96ao6rhUvfQpz8gnswp6ulVkQd+NlONS2eu/drW 0Ci79+TZV5gGcVjxS4cG8xr37+hVQM1uWHU8fbAeEevxAx3w61nVTkmmiC4OLw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1696854583; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ah6GLEMoXGPelrTlRSD7Pjw3CRT1rp2dzP/AboKmlo0=; b=w9sb66YN0IVh+UOuUxHDniqT/2PEXLrm/LfZ17Nqhpg/0sQtuUIp3ZEEA9Kt+VL+q69dam 1EC1Wkg/pcLWmEAg== From: "tip-bot2 for Ashok Raj" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/microcode] x86/microcode/intel: Add a minimum required revision for late loading Cc: Thomas Gleixner , Ashok Raj , "Borislav Petkov (AMD)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20231002115903.776467264@linutronix.de> References: <20231002115903.776467264@linutronix.de> MIME-Version: 1.0 Message-ID: <169685458297.3135.13685812754249288504.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=2.7 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Mon, 09 Oct 2023 05:30:07 -0700 (PDT) X-Spam-Level: ** X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1779281119541474442 X-GMAIL-MSGID: 1779281119541474442 The following commit has been merged into the x86/microcode branch of tip: Commit-ID: 9975802d3f7426abc32fd9ac0924a639d11a7c4f Gitweb: https://git.kernel.org/tip/9975802d3f7426abc32fd9ac0924a639d11a7c4f Author: Ashok Raj AuthorDate: Mon, 02 Oct 2023 14:00:11 +02:00 Committer: Borislav Petkov (AMD) CommitterDate: Fri, 06 Oct 2023 15:12:25 +02:00 x86/microcode/intel: Add a minimum required revision for late loading In general users, don't have the necessary information to determine whether late loading of a new microcode version is safe and does not modify anything which the currently running kernel uses already, e.g. removal of CPUID bits or behavioural changes of MSRs. To address this issue, Intel has added a "minimum required version" field to a previously reserved field in the microcode header. Microcode updates should only be applied if the current microcode version is equal to, or greater than this minimum required version. Thomas made some suggestions on how meta-data in the microcode file could provide Linux with information to decide if the new microcode is suitable candidate for late loading. But even the "simpler" option requires a lot of metadata and corresponding kernel code to parse it, so the final suggestion was to add the 'minimum required version' field in the header. When microcode changes visible features, microcode will set the minimum required version to its own revision which prevents late loading. Old microcode blobs have the minimum revision field always set to 0, which indicates that there is no information and the kernel considers it unsafe. This is a pure OS software mechanism. The hardware/firmware ignores this header field. For early loading there is no restriction because OS visible features are enumerated after the early load and therefore a change has no effect. The check is always enabled, but by default not enforced. It can be enforced via Kconfig or kernel command line. If enforced, the kernel refuses to late load microcode with a minimum required version field which is zero or when the currently loaded microcode revision is smaller than the minimum required revision. If not enforced the load happens independent of the revision check to stay compatible with the existing behaviour, but it influences the decision whether the kernel is tainted or not. If the check signals that the late load is safe, then the kernel is not tainted. Early loading is not affected by this. [ tglx: Massaged changelog and fixed up the implementation ] Suggested-by: Thomas Gleixner Signed-off-by: Ashok Raj Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20231002115903.776467264@linutronix.de --- arch/x86/include/asm/microcode.h | 3 +- arch/x86/kernel/cpu/microcode/intel.c | 37 +++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h index 1ab475a..7811efe 100644 --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -36,7 +36,8 @@ struct microcode_header_intel { unsigned int datasize; unsigned int totalsize; unsigned int metasize; - unsigned int reserved[2]; + unsigned int min_req_ver; + unsigned int reserved; }; struct microcode_intel { diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c index 0e7ff3e..d6311f0 100644 --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c @@ -464,16 +464,40 @@ static enum ucode_state apply_microcode_late(int cpu) return ret; } +static bool ucode_validate_minrev(struct microcode_header_intel *mc_header) +{ + int cur_rev = boot_cpu_data.microcode; + + /* + * When late-loading, ensure the header declares a minimum revision + * required to perform a late-load. The previously reserved field + * is 0 in older microcode blobs. + */ + if (!mc_header->min_req_ver) { + pr_info("Unsafe microcode update: Microcode header does not specify a required min version\n"); + return false; + } + + /* + * Check whether the current revision is either greater or equal to + * to the minimum revision specified in the header. + */ + if (cur_rev < mc_header->min_req_ver) { + pr_info("Unsafe microcode update: Current revision 0x%x too old\n", cur_rev); + pr_info("Current should be at 0x%x or higher. Use early loading instead\n", mc_header->min_req_ver); + return false; + } + return true; +} + static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) { struct ucode_cpu_info *uci = ucode_cpu_info + cpu; + bool is_safe, new_is_safe = false; int cur_rev = uci->cpu_sig.rev; unsigned int curr_mc_size = 0; u8 *new_mc = NULL, *mc = NULL; - if (force_minrev) - return UCODE_NFOUND; - while (iov_iter_count(iter)) { struct microcode_header_intel mc_header; unsigned int mc_size, data_size; @@ -516,9 +540,14 @@ static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) if (!intel_find_matching_signature(mc, &uci->cpu_sig)) continue; + is_safe = ucode_validate_minrev(&mc_header); + if (force_minrev && !is_safe) + continue; + kvfree(new_mc); cur_rev = mc_header.rev; new_mc = mc; + new_is_safe = is_safe; mc = NULL; } @@ -530,7 +559,7 @@ static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) return UCODE_NFOUND; ucode_patch_late = (struct microcode_intel *)new_mc; - return UCODE_NEW; + return new_is_safe ? UCODE_NEW_SAFE : UCODE_NEW; fail: kvfree(mc);