From patchwork Tue Oct 24 13:20:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 157445 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:ce89:0:b0:403:3b70:6f57 with SMTP id p9csp1937031vqx; Tue, 24 Oct 2023 06:21:23 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGRZnbZsTLIlj+LfMio8SG9BfUDov9A5ob025nPj12xjZIVLdMwDuVt3c0+WbjStqWmDOqR X-Received: by 2002:a05:6a21:4987:b0:15e:bf2b:e6d3 with SMTP id ax7-20020a056a21498700b0015ebf2be6d3mr2430308pzc.46.1698153682786; Tue, 24 Oct 2023 06:21:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1698153682; cv=none; d=google.com; s=arc-20160816; b=CCX6rrNF4rO20Vo2DmXcstujWDvok6UEsWGp+TFNa/fij36dBatP5W/3mYh50dfKwC swQcTu9uVY3thW+6YNQEidd3Wxp80ifzvuPmdesaPFxnUpSNNJx5ZtLO0Joh8+gwnpnl Q11X+h4pC6Qbgf3+LTTVwr7PQg7UzlrvfUHb+/3tDWNrYn7pAwXSfulN7mZGrOfQqrRt YgKcoZh4BTz9VbDhZndkIVYrI75HN4eUB3v2lz+l2y8IRrDNUp/CENOBn3mo6QOEchue E58HUUxXZWfYUZmaAjojn46xL6f6u1bCihKeqcjVZu6YFjU8+ujBxx5fF2q7nBzvieDq OOVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=i4/Jk22nxtI+oh3IjIzTmjcKS47ASGIt+IAVY7jntJ0=; fh=SUh4kdNTADmkahV2MeFbd3vkpkMlP6po9p9PBlTzZvU=; b=pNggLtSZKNufXW6E15HEfQEVzH6FmWT9w9LgBFnc4YIFgLPw/GWyElrdXjpk/WAHma 9a5IR1BdeyOlkN7gtGsaR7fay7WMJ2tdFHyalgWUspW5PktEsQza8wZDccz7iH9FcnP5 uwjHWCl95JB8knvugMFC/dOMAEGV6FYUhsGlBDKBWBRzev9Hw0b/mOmySVAMQKalGUyr ZY2Hor1DiAWvg+hKZ5hu0QrjWXT/ggXEPXrCangdPGosocsvlNZNs65NBY7kYG6+WfU5 v+KxU1qF15MxFRYUToZ59OK4feS4eBE9Xi/CBl+5KgCSmmw7r3z3pbfysq1jp7qQHj8r 1klw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b="B6pApU/S"; dkim=neutral (no key) header.i=@linutronix.de; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from snail.vger.email (snail.vger.email. [23.128.96.37]) by mx.google.com with ESMTPS id k8-20020aa788c8000000b0068e4c3f3ac2si8745179pff.245.2023.10.24.06.21.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Oct 2023 06:21:22 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b="B6pApU/S"; dkim=neutral (no key) header.i=@linutronix.de; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id A2FAB806117C; Tue, 24 Oct 2023 06:21:21 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234593AbjJXNVQ (ORCPT + 26 others); Tue, 24 Oct 2023 09:21:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234512AbjJXNUz (ORCPT ); Tue, 24 Oct 2023 09:20:55 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5DD2B10E; Tue, 24 Oct 2023 06:20:50 -0700 (PDT) Date: Tue, 24 Oct 2023 13:20:46 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1698153648; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=i4/Jk22nxtI+oh3IjIzTmjcKS47ASGIt+IAVY7jntJ0=; b=B6pApU/SwGDYVXa4BfX/581G/3LIoq9V0yNCEjAwiPumLo/ouOntWevLpvc1bDTLlZP9F6 7G78Gw9ROfN5cWh/YrlCEuMQb1vc1NAGpILnOvv6KtOxq1qvv0STvajBqJ/21b3D71rXuS 06VXJUOsWYb7g5MEdlosaT7+TXVcuWiLxul6f/UkJRZqdcYMtl9wOwxQzaUoUXPypT2i/y cSqpVPiS7nYlKshUcS0xPjHzdFJJw/UDis3DoTQTDutA0+ghIDEOtjZLsQifTtXtGthnf3 oYhv/RreJLcf0uTYpyU/wGT020lu+G3VgpeR+GrV2YNqc1+6oRwmdmhnq+y3YA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1698153648; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=i4/Jk22nxtI+oh3IjIzTmjcKS47ASGIt+IAVY7jntJ0=; b=9r/vvUD8JbE9F2jthjlk5paVW5HWH0tRTjWR9RwquQDL6HGPKJXi6yNqaIL61XThZcTmWU Nq63Eft0K/qFsTAQ== From: "tip-bot2 for Ashok Raj" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/microcode] x86/microcode/intel: Add a minimum required revision for late loading Cc: Thomas Gleixner , Ashok Raj , "Borislav Petkov (AMD)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20231002115903.776467264@linutronix.de> References: <20231002115903.776467264@linutronix.de> MIME-Version: 1.0 Message-ID: <169815364666.3135.13998262514229110819.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Tue, 24 Oct 2023 06:21:21 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1779281119541474442 X-GMAIL-MSGID: 1780643196057573332 The following commit has been merged into the x86/microcode branch of tip: Commit-ID: cf5ab01c87030a085e211a0a327535932ec6f719 Gitweb: https://git.kernel.org/tip/cf5ab01c87030a085e211a0a327535932ec6f719 Author: Ashok Raj AuthorDate: Mon, 02 Oct 2023 14:00:11 +02:00 Committer: Borislav Petkov (AMD) CommitterDate: Tue, 24 Oct 2023 15:05:55 +02:00 x86/microcode/intel: Add a minimum required revision for late loading In general users, don't have the necessary information to determine whether late loading of a new microcode version is safe and does not modify anything which the currently running kernel uses already, e.g. removal of CPUID bits or behavioural changes of MSRs. To address this issue, Intel has added a "minimum required version" field to a previously reserved field in the microcode header. Microcode updates should only be applied if the current microcode version is equal to, or greater than this minimum required version. Thomas made some suggestions on how meta-data in the microcode file could provide Linux with information to decide if the new microcode is suitable candidate for late loading. But even the "simpler" option requires a lot of metadata and corresponding kernel code to parse it, so the final suggestion was to add the 'minimum required version' field in the header. When microcode changes visible features, microcode will set the minimum required version to its own revision which prevents late loading. Old microcode blobs have the minimum revision field always set to 0, which indicates that there is no information and the kernel considers it unsafe. This is a pure OS software mechanism. The hardware/firmware ignores this header field. For early loading there is no restriction because OS visible features are enumerated after the early load and therefore a change has no effect. The check is always enabled, but by default not enforced. It can be enforced via Kconfig or kernel command line. If enforced, the kernel refuses to late load microcode with a minimum required version field which is zero or when the currently loaded microcode revision is smaller than the minimum required revision. If not enforced the load happens independent of the revision check to stay compatible with the existing behaviour, but it influences the decision whether the kernel is tainted or not. If the check signals that the late load is safe, then the kernel is not tainted. Early loading is not affected by this. [ tglx: Massaged changelog and fixed up the implementation ] Suggested-by: Thomas Gleixner Signed-off-by: Ashok Raj Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20231002115903.776467264@linutronix.de --- arch/x86/include/asm/microcode.h | 3 +- arch/x86/kernel/cpu/microcode/intel.c | 37 +++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h index 0ee6ed0..695e569 100644 --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -38,7 +38,8 @@ struct microcode_header_intel { unsigned int datasize; unsigned int totalsize; unsigned int metasize; - unsigned int reserved[2]; + unsigned int min_req_ver; + unsigned int reserved; }; struct microcode_intel { diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c index 14aa4c6..6024feb 100644 --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c @@ -473,16 +473,40 @@ static enum ucode_state apply_microcode_late(int cpu) return ret; } +static bool ucode_validate_minrev(struct microcode_header_intel *mc_header) +{ + int cur_rev = boot_cpu_data.microcode; + + /* + * When late-loading, ensure the header declares a minimum revision + * required to perform a late-load. The previously reserved field + * is 0 in older microcode blobs. + */ + if (!mc_header->min_req_ver) { + pr_info("Unsafe microcode update: Microcode header does not specify a required min version\n"); + return false; + } + + /* + * Check whether the current revision is either greater or equal to + * to the minimum revision specified in the header. + */ + if (cur_rev < mc_header->min_req_ver) { + pr_info("Unsafe microcode update: Current revision 0x%x too old\n", cur_rev); + pr_info("Current should be at 0x%x or higher. Use early loading instead\n", mc_header->min_req_ver); + return false; + } + return true; +} + static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) { struct ucode_cpu_info *uci = ucode_cpu_info + cpu; + bool is_safe, new_is_safe = false; int cur_rev = uci->cpu_sig.rev; unsigned int curr_mc_size = 0; u8 *new_mc = NULL, *mc = NULL; - if (force_minrev) - return UCODE_NFOUND; - while (iov_iter_count(iter)) { struct microcode_header_intel mc_header; unsigned int mc_size, data_size; @@ -525,9 +549,14 @@ static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) if (!intel_find_matching_signature(mc, &uci->cpu_sig)) continue; + is_safe = ucode_validate_minrev(&mc_header); + if (force_minrev && !is_safe) + continue; + kvfree(new_mc); cur_rev = mc_header.rev; new_mc = mc; + new_is_safe = is_safe; mc = NULL; } @@ -539,7 +568,7 @@ static enum ucode_state parse_microcode_blobs(int cpu, struct iov_iter *iter) return UCODE_NFOUND; ucode_patch_late = (struct microcode_intel *)new_mc; - return UCODE_NEW; + return new_is_safe ? UCODE_NEW_SAFE : UCODE_NEW; fail: kvfree(mc);